diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3748ab0..585ad76 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -32,48 +32,48 @@ version: 2 updates: - # GitHub Actions: keep pinned action SHAs / version tags fresh. - - package-ecosystem: "github-actions" - directory: "/" - target-branch: "next" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "deps" - # Grouped PRs cut noise: one PR per (security | patch | minor) bundle - # per week instead of N separate PRs. Security PRs still get retargeted - # to `hotfixes` by hotfix-redirector.yml when GHSA refs appear in the - # body โ€” bundling N GHSA fixes into one PR is fine, the redirector - # only needs one match to retarget. - groups: - security: - applies-to: security-updates - patterns: ["*"] - patch: - applies-to: version-updates - update-types: ["patch"] - minor: - applies-to: version-updates - update-types: ["minor"] + # GitHub Actions: keep pinned action SHAs / version tags fresh. + - package-ecosystem: "github-actions" + directory: "/" + target-branch: "next" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "deps" + # Grouped PRs cut noise: one PR per (security | patch | minor) bundle + # per week instead of N separate PRs. Security PRs still get retargeted + # to `hotfixes` by hotfix-redirector.yml when GHSA refs appear in the + # body โ€” bundling N GHSA fixes into one PR is fine, the redirector + # only needs one match to retarget. + groups: + security: + applies-to: security-updates + patterns: ["*"] + patch: + applies-to: version-updates + update-types: ["patch"] + minor: + applies-to: version-updates + update-types: ["minor"] - # NPM: package.json + package-lock.json updates. - # Delete this block if your repo isn't a Node project. - - package-ecosystem: "npm" - directory: "/" - target-branch: "next" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - commit-message: - prefix: "deps" - groups: - security: - applies-to: security-updates - patterns: ["*"] - patch: - applies-to: version-updates - update-types: ["patch"] - minor: - applies-to: version-updates - update-types: ["minor"] + # NPM: package.json + package-lock.json updates. + # Delete this block if your repo isn't a Node project. + - package-ecosystem: "npm" + directory: "/" + target-branch: "next" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "deps" + groups: + security: + applies-to: security-updates + patterns: ["*"] + patch: + applies-to: version-updates + update-types: ["patch"] + minor: + applies-to: version-updates + update-types: ["minor"] diff --git a/.github/workflows/branch-retention.yml b/.github/workflows/branch-retention.yml index 259c5c8..5afb1ef 100644 --- a/.github/workflows/branch-retention.yml +++ b/.github/workflows/branch-retention.yml @@ -21,18 +21,18 @@ name: ๐ŸŒฟ Branch Retention on: - pull_request: - types: [closed] - branches: [master, main, next, hotfixes] + pull_request: + types: [closed] + branches: [master, main, next, hotfixes] permissions: - contents: write - pull-requests: read + contents: write + pull-requests: read jobs: - retain: - if: github.event.pull_request.merged == true - uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4 - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + retain: + if: github.event.pull_request.merged == true + uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4 + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index ed9a441..9a56064 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -35,26 +35,26 @@ name: ๐Ÿ“œ CLA on: - pull_request_target: - types: [opened, synchronize, reopened, ready_for_review] - issue_comment: - types: [created] + pull_request_target: + types: [opened, synchronize, reopened, ready_for_review] + issue_comment: + types: [created] permissions: - contents: read - pull-requests: write - statuses: write - issues: write + contents: read + pull-requests: write + statuses: write + issues: write jobs: - cla: - uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4 - with: - cla_version: "1.0" - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }} - CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }} - TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }} - TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }} + cla: + uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4 + with: + cla_version: "1.0" + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }} + CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }} + TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }} + TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fe5c406..bc8cc5f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,41 +30,41 @@ name: ๐Ÿ” CodeQL on: - push: - branches: [master, main] - # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF - # upload to base-repo Security tab fails with read-only token. Acceptable โ€” - # push-to-master analysis after merge catches anything missed. DO NOT use - # pull_request_target (runs base-repo workflow with secrets against fork - # code; dangerous). - pull_request: - types: [opened, synchronize, reopened, ready_for_review] - # Include the v4 integration branches (`next`, `hotfixes`) so feature - # and hotfix PRs trigger CodeQL. Without these, branch protection - # rulesets that require the CodeQL check on `next`/`hotfixes` will - # sit on "waiting for results" indefinitely. Branches that don't - # exist in a given repo simply never trigger the workflow โ€” harmless - # for repos that haven't adopted the v4 staging-branch flow. - branches: [master, main, next, hotfixes] - schedule: - - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time + push: + branches: [master, main] + # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF + # upload to base-repo Security tab fails with read-only token. Acceptable โ€” + # push-to-master analysis after merge catches anything missed. DO NOT use + # pull_request_target (runs base-repo workflow with secrets against fork + # code; dangerous). + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + # Include the v4 integration branches (`next`, `hotfixes`) so feature + # and hotfix PRs trigger CodeQL. Without these, branch protection + # rulesets that require the CodeQL check on `next`/`hotfixes` will + # sit on "waiting for results" indefinitely. Branches that don't + # exist in a given repo simply never trigger the workflow โ€” harmless + # for repos that haven't adopted the v4 staging-branch flow. + branches: [master, main, next, hotfixes] + schedule: + - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time permissions: - security-events: write - contents: read - actions: read + security-events: write + contents: read + actions: read concurrency: - group: codeql-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }} + group: codeql-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }} jobs: - analyze: - uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4 - with: - languages: "javascript-typescript" - # Override defaults if needed: - # queries: "security-extended,security-and-quality" - # paths_ignore: "node_modules/,dist/,coverage/,**/test/**" - # config_file: ".github/codeql-config.yml" - # build_mode: "autobuild" + analyze: + uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4 + with: + languages: "javascript-typescript" + # Override defaults if needed: + # queries: "security-extended,security-and-quality" + # paths_ignore: "node_modules/,dist/,coverage/,**/test/**" + # config_file: ".github/codeql-config.yml" + # build_mode: "autobuild" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 931db6b..2b24099 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -33,22 +33,22 @@ name: ๐Ÿค– Dependabot Auto-Merge on: - pull_request: - types: [opened, reopened, synchronize, ready_for_review] + pull_request: + types: [opened, reopened, synchronize, ready_for_review] permissions: - contents: write - pull-requests: write + contents: write + pull-requests: write jobs: - automerge: - # Pre-filter at workflow level so this doesn't spin up for every PR. - if: github.event.pull_request.user.login == 'dependabot[bot]' - uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4 - with: - bump_types: "patch,minor" - merge_method: "squash" - # also_for_actors: "renovate[bot]" # extend if you adopt Renovate - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + automerge: + # Pre-filter at workflow level so this doesn't spin up for every PR. + if: github.event.pull_request.user.login == 'dependabot[bot]' + uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4 + with: + bump_types: "patch,minor" + merge_method: "squash" + # also_for_actors: "renovate[bot]" # extend if you adopt Renovate + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6444dab..188573b 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -11,24 +11,24 @@ name: ๐Ÿ”’ Dependency Review on: - pull_request: - types: [opened, synchronize, reopened, ready_for_review] - branches: [master, main] + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + branches: [master, main] permissions: - contents: read - pull-requests: write + contents: read + pull-requests: write jobs: - review: - uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4 - with: - fail_on_severity: "moderate" - # Per-repo license policy override: - # deny_licenses: "AGPL-3.0,LGPL-3.0" # block copyleft for an Apache-2.0 repo - # Bot App credentials. When set, the dependency-review PR comment is - # posted by the consumer's bot App instead of github-actions[bot]. - # Both lines are optional; remove them to fall back to GITHUB_TOKEN. - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + review: + uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4 + with: + fail_on_severity: "moderate" + # Per-repo license policy override: + # deny_licenses: "AGPL-3.0,LGPL-3.0" # block copyleft for an Apache-2.0 repo + # Bot App credentials. When set, the dependency-review PR comment is + # posted by the consumer's bot App instead of github-actions[bot]. + # Both lines are optional; remove them to fall back to GITHUB_TOKEN. + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/feature-pr.yml b/.github/workflows/feature-pr.yml index 9ef7b86..fcee49e 100644 --- a/.github/workflows/feature-pr.yml +++ b/.github/workflows/feature-pr.yml @@ -26,34 +26,34 @@ name: ๐Ÿ”€ Feature PR (v4) on: - push: - branches: - # CUSTOMIZE: prune this list to whichever branch prefixes your - # repo uses. Must align with the `case` statement in the reusable. - - "feat/**" - - "feature/**" - - "fix/**" - - "release/**" - - "chore/**" - - "refactor/**" - - "docs/**" - - "ci/**" - - "perf/**" - - "test/**" - - "style/**" - - "hotfix/**" + push: + branches: + # CUSTOMIZE: prune this list to whichever branch prefixes your + # repo uses. Must align with the `case` statement in the reusable. + - 'feat/**' + - 'feature/**' + - 'fix/**' + - 'release/**' + - 'chore/**' + - 'refactor/**' + - 'docs/**' + - 'ci/**' + - 'perf/**' + - 'test/**' + - 'style/**' + - 'hotfix/**' concurrency: - group: feature-pr-${{ github.repository }}-${{ github.ref }} - cancel-in-progress: false + group: feature-pr-${{ github.repository }}-${{ github.ref }} + cancel-in-progress: false jobs: - open-pr: - permissions: - contents: read - pull-requests: write - uses: CLDMV/.github/.github/workflows/workflow-feature-pr.yml@v4 - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + open-pr: + permissions: + contents: read + pull-requests: write + uses: CLDMV/.github/.github/workflows/workflow-feature-pr.yml@v4 + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/hotfix-redirector.yml b/.github/workflows/hotfix-redirector.yml index 8a557bb..830cad6 100644 --- a/.github/workflows/hotfix-redirector.yml +++ b/.github/workflows/hotfix-redirector.yml @@ -32,20 +32,20 @@ name: ๐Ÿ”€ Hotfix PR Redirector (v4) # `opened` only (NOT `edited`): if a maintainer manually re-targets the PR, we # must not fight them by redirecting again. on: - pull_request_target: - types: [opened] + pull_request_target: + types: [opened] concurrency: - group: hotfix-redirector-${{ github.event.pull_request.number }} - cancel-in-progress: true + group: hotfix-redirector-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: - redirect: - permissions: - contents: write - pull-requests: write - uses: CLDMV/.github/.github/workflows/workflow-hotfix-redirector.yml@v4 - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + redirect: + permissions: + contents: write + pull-requests: write + uses: CLDMV/.github/.github/workflows/workflow-hotfix-redirector.yml@v4 + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/hotfixes-release.yml b/.github/workflows/hotfixes-release.yml index 9396b90..0889dcd 100644 --- a/.github/workflows/hotfixes-release.yml +++ b/.github/workflows/hotfixes-release.yml @@ -23,33 +23,33 @@ name: ๐Ÿš‘ Hotfixes Release (v4) on: - push: - branches: [hotfixes] - workflow_dispatch: # manual kick โ€” e.g. to open/refresh the PR for content already on `hotfixes` + push: + branches: [hotfixes] + workflow_dispatch: # manual kick โ€” e.g. to open/refresh the PR for content already on `hotfixes` concurrency: - group: hotfixes-release-${{ github.repository }} - cancel-in-progress: false + group: hotfixes-release-${{ github.repository }} + cancel-in-progress: false jobs: - release: - permissions: - contents: write - pull-requests: write - uses: CLDMV/.github/.github/workflows/workflow-hotfixes-release.yml@v4 - with: - package_name: "polyfillme" - build_command: "echo 'โœ“ no build step'" - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - # Optional release-PR notifier webhooks โ€” each is independently - # opt-in: leave one unset and that channel is silently skipped. - # Delete the lines you don't use. - DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }} - DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }} - SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }} - SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }} - GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }} - GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }} + release: + permissions: + contents: write + pull-requests: write + uses: CLDMV/.github/.github/workflows/workflow-hotfixes-release.yml@v4 + with: + package_name: "polyfillme" + build_command: "echo 'โœ“ no build step'" + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + # Optional release-PR notifier webhooks โ€” each is independently + # opt-in: leave one unset and that channel is silently skipped. + # Delete the lines you don't use. + DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }} + DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }} + SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }} + SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }} + GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }} + GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 9f88cbd..9385b4c 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -27,18 +27,18 @@ name: ๐Ÿท๏ธ PR Labeler # DO NOT add a checkout step or any step that executes PR-supplied content # (build commands, scripts, test runs, etc.) to this workflow. on: - pull_request_target: - types: [opened, synchronize, reopened, ready_for_review] + pull_request_target: + types: [opened, synchronize, reopened, ready_for_review] permissions: - contents: read - pull-requests: write + contents: read + pull-requests: write jobs: - label: - uses: CLDMV/.github/.github/workflows/reusable-pr-labeler.yml@v4 - # Optional. Without these, labels are attributed to github-actions[bot]. - # With these, they're attributed to your CLDMV bot App. - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + label: + uses: CLDMV/.github/.github/workflows/reusable-pr-labeler.yml@v4 + # Optional. Without these, labels are attributed to github-actions[bot]. + # With these, they're attributed to your CLDMV bot App. + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/master-commit-audit.yml b/.github/workflows/master-commit-audit.yml index e7f0e8b..490de62 100644 --- a/.github/workflows/master-commit-audit.yml +++ b/.github/workflows/master-commit-audit.yml @@ -21,46 +21,46 @@ name: ๐Ÿงพ Master Commit Audit on: - push: - branches: [master, main] + push: + branches: [master, main] permissions: - contents: read - issues: write + contents: read + issues: write jobs: - audit: - runs-on: ubuntu-latest - steps: - # Optional. Without these, the audit issue is filed by - # github-actions[bot]. With them, the issue is filed by your bot App. - - name: Create App token (falls back to GITHUB_TOKEN) - id: app-token - uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4 - with: - client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - env: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + audit: + runs-on: ubuntu-latest + steps: + # Optional. Without these, the audit issue is filed by + # github-actions[bot]. With them, the issue is filed by your bot App. + - name: Create App token (falls back to GITHUB_TOKEN) + id: app-token + uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4 + with: + client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + env: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - - name: Audit commit subject - uses: CLDMV/.github/.github/actions/git/jobs/audit-commit-subject@v4 - with: - commit_sha: ${{ github.sha }} - # allowed_patterns omitted -> inherit the canonical default from - # audit-commit-subject (release/chore/merge patterns, including - # the "release: vX.Y.Z - " form). Customize only if - # this repo's conventions genuinely differ โ€” a hardcoded copy - # here goes stale the next time the canonical default changes. - # allowed_patterns: | - # ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$ - # ^chore(\([^)]+\))?: .+ - # ^Merge pull request #\d+ from .+ - # ^feat(\([^)]+\))?: .+ - # Canonical label names from CLDMV/.github's data/github-labels.json - # (note the space after each colon). Replace with names that exist - # in your repo's label catalog. - issue_labels: "type: ci,priority: high" - # issue_assignee: "shinrai" # uncomment to auto-assign - github_token: ${{ steps.app-token.outputs.token }} + - name: Audit commit subject + uses: CLDMV/.github/.github/actions/git/jobs/audit-commit-subject@v4 + with: + commit_sha: ${{ github.sha }} + # allowed_patterns omitted -> inherit the canonical default from + # audit-commit-subject (release/chore/merge patterns, including + # the "release: vX.Y.Z - " form). Customize only if + # this repo's conventions genuinely differ โ€” a hardcoded copy + # here goes stale the next time the canonical default changes. + # allowed_patterns: | + # ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$ + # ^chore(\([^)]+\))?: .+ + # ^Merge pull request #\d+ from .+ + # ^feat(\([^)]+\))?: .+ + # Canonical label names from CLDMV/.github's data/github-labels.json + # (note the space after each colon). Replace with names that exist + # in your repo's label catalog. + issue_labels: "type: ci,priority: high" + # issue_assignee: "shinrai" # uncomment to auto-assign + github_token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/next-release.yml b/.github/workflows/next-release.yml index 8b48857..35deb59 100644 --- a/.github/workflows/next-release.yml +++ b/.github/workflows/next-release.yml @@ -27,35 +27,35 @@ name: ๐Ÿš€ Next Release (v4) on: - push: - branches: [next] - workflow_dispatch: # manual kick โ€” e.g. to open/refresh the PR for content already on `next` + push: + branches: [next] + workflow_dispatch: # manual kick โ€” e.g. to open/refresh the PR for content already on `next` # Serialize: each run re-resolves the current PR state, so queueing (not # cancelling) avoids a create/refresh race when pushes land back-to-back. concurrency: - group: next-release-${{ github.repository }} - cancel-in-progress: false + group: next-release-${{ github.repository }} + cancel-in-progress: false jobs: - release: - permissions: - contents: write - pull-requests: write - uses: CLDMV/.github/.github/workflows/workflow-next-release.yml@v4 - with: - package_name: "polyfillme" - build_command: "echo 'โœ“ no build step'" - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - # Optional release-PR notifier webhooks โ€” each is independently - # opt-in: leave one unset and that channel is silently skipped. - # Delete the lines you don't use. - DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }} - DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }} - SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }} - SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }} - GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }} - GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }} + release: + permissions: + contents: write + pull-requests: write + uses: CLDMV/.github/.github/workflows/workflow-next-release.yml@v4 + with: + package_name: "polyfillme" + build_command: "echo 'โœ“ no build step'" + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + # Optional release-PR notifier webhooks โ€” each is independently + # opt-in: leave one unset and that channel is silently skipped. + # Delete the lines you don't use. + DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }} + DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }} + SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }} + SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }} + GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }} + GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }} diff --git a/.github/workflows/next-reset.yml b/.github/workflows/next-reset.yml index 6576845..87ba088 100644 --- a/.github/workflows/next-reset.yml +++ b/.github/workflows/next-reset.yml @@ -25,19 +25,19 @@ name: โ™ป๏ธ Next/Hotfixes Reset (v4) on: - push: - branches: [master, main] + push: + branches: [master, main] concurrency: - group: next-reset-${{ github.repository }} - cancel-in-progress: false + group: next-reset-${{ github.repository }} + cancel-in-progress: false jobs: - sync: - permissions: - contents: write - uses: CLDMV/.github/.github/workflows/workflow-next-reset.yml@v4 - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + sync: + permissions: + contents: write + uses: CLDMV/.github/.github/workflows/workflow-next-reset.yml@v4 + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/pr-title-normalizer.yml b/.github/workflows/pr-title-normalizer.yml index 0aa8554..adba973 100644 --- a/.github/workflows/pr-title-normalizer.yml +++ b/.github/workflows/pr-title-normalizer.yml @@ -26,20 +26,20 @@ name: ๐Ÿท๏ธ PR Title Normalizer # only (NOT edited): a maintainer hand-editing the title must not kick off a # re-normalize loop. on: - pull_request_target: - types: [opened, synchronize] + pull_request_target: + types: [opened, synchronize] concurrency: - group: pr-title-normalizer-${{ github.event.pull_request.number }} - cancel-in-progress: true + group: pr-title-normalizer-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: - normalize: - permissions: - contents: read - pull-requests: write - uses: CLDMV/.github/.github/workflows/workflow-pr-title-normalizer.yml@v4 - secrets: - # Map your repo/org secrets to the expected names. - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + normalize: + permissions: + contents: read + pull-requests: write + uses: CLDMV/.github/.github/workflows/workflow-pr-title-normalizer.yml@v4 + secrets: + # Map your repo/org secrets to the expected names. + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release-notify.yml b/.github/workflows/release-notify.yml index d334e71..700067f 100644 --- a/.github/workflows/release-notify.yml +++ b/.github/workflows/release-notify.yml @@ -23,15 +23,15 @@ name: ๐Ÿ“ฃ Release Notify on: - release: - types: [published] + release: + types: [published] permissions: - contents: read + contents: read jobs: - notify: - # Defensive: skip untagged releases (mirrors Batch 1.2's filter) - if: github.event.release.tag_name != '' - uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4 - secrets: inherit + notify: + # Defensive: skip untagged releases (mirrors Batch 1.2's filter) + if: github.event.release.tag_name != '' + uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4 + secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cce0f62..a6aa50c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -22,12 +22,12 @@ name: ๐Ÿ”ฌ OpenSSF Scorecard on: - branch_protection_rule: - schedule: - - cron: "32 7 * * 1" # weekly Monday 07:32 UTC - push: - branches: [master, main] - workflow_dispatch: + branch_protection_rule: + schedule: + - cron: "32 7 * * 1" # weekly Monday 07:32 UTC + push: + branches: [master, main] + workflow_dispatch: # Caller must grant what the reusable needs โ€” notably id-token: write for the # OpenSSF transparency-log publish. @@ -51,11 +51,11 @@ on: # security-events: write back (job-scoped) if publish_results is set to false # instead. jobs: - analyze: - permissions: - id-token: write - contents: read - actions: read - uses: CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4 - with: - publish_results: true # set false for private repos / to skip the public badge + analyze: + permissions: + id-token: write + contents: read + actions: read + uses: CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4 + with: + publish_results: true # set false for private repos / to skip the public badge diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 116eabe..6002312 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -18,29 +18,29 @@ name: ๐Ÿ‚ Stale Issues & PRs on: - schedule: - - cron: "13 5 * * *" # daily 05:13 UTC (off-the-hour to avoid GH cron stampede) - workflow_dispatch: - inputs: - dry_run: - description: "Preview only โ€” no changes will be made" - type: boolean - default: false + schedule: + - cron: "13 5 * * *" # daily 05:13 UTC (off-the-hour to avoid GH cron stampede) + workflow_dispatch: + inputs: + dry_run: + description: "Preview only โ€” no changes will be made" + type: boolean + default: false permissions: - issues: write - pull-requests: write + issues: write + pull-requests: write jobs: - sweep: - uses: CLDMV/.github/.github/workflows/reusable-stale.yml@v4 - with: - dry_run: ${{ github.event.inputs.dry_run == 'true' }} - # Override timers if needed: - # days_before_issue_stale: 60 - # days_before_issue_close: 14 - # days_before_pr_stale: 30 - # days_before_pr_close: 7 - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + sweep: + uses: CLDMV/.github/.github/workflows/reusable-stale.yml@v4 + with: + dry_run: ${{ github.event.inputs.dry_run == 'true' }} + # Override timers if needed: + # days_before_issue_stale: 60 + # days_before_issue_close: 14 + # days_before_pr_stale: 30 + # days_before_pr_close: 7 + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/tag-health.yml b/.github/workflows/tag-health.yml index 3ebcf88..6aa79c5 100644 --- a/.github/workflows/tag-health.yml +++ b/.github/workflows/tag-health.yml @@ -19,46 +19,46 @@ name: ๐Ÿฅ Tag Health on: - schedule: - # Weekly Sunday 04:04 UTC. Off-the-hour to dodge the GitHub :00-cron - # stampede; weekly cadence because tag drift accumulates slowly. - - cron: "4 4 * * 0" - workflow_dispatch: - inputs: - debug: - description: "Enable debug logging for troubleshooting" - type: boolean - required: false - default: false - create_documentation: - description: "Update VERSION_TAGS.md if rolling tags moved" - type: boolean - required: false - default: false - use_gpg: - description: "Enable GPG signing for any tags the sweep creates/recreates" - type: boolean - required: false - default: true + schedule: + # Weekly Sunday 04:04 UTC. Off-the-hour to dodge the GitHub :00-cron + # stampede; weekly cadence because tag drift accumulates slowly. + - cron: "4 4 * * 0" + workflow_dispatch: + inputs: + debug: + description: "Enable debug logging for troubleshooting" + type: boolean + required: false + default: false + create_documentation: + description: "Update VERSION_TAGS.md if rolling tags moved" + type: boolean + required: false + default: false + use_gpg: + description: "Enable GPG signing for any tags the sweep creates/recreates" + type: boolean + required: false + default: true permissions: - contents: write + contents: write jobs: - health: - uses: CLDMV/.github/.github/workflows/reusable-tag-health.yml@v4 - with: - debug: ${{ github.event.inputs.debug == 'true' }} - # Full unified sweep: validates, fixes bot signatures, fixes - # unsigned tags, recovers orphaned releases, relocates orphaned - # tags, and updates rolling major/minor refs. - run_unified_tag_health: true - create_documentation: ${{ github.event.inputs.create_documentation == 'true' }} - use_gpg: ${{ github.event.inputs.use_gpg != 'false' }} - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }} - TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }} - GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }} + health: + uses: CLDMV/.github/.github/workflows/reusable-tag-health.yml@v4 + with: + debug: ${{ github.event.inputs.debug == 'true' }} + # Full unified sweep: validates, fixes bot signatures, fixes + # unsigned tags, recovers orphaned releases, relocates orphaned + # tags, and updates rolling major/minor refs. + run_unified_tag_health: true + create_documentation: ${{ github.event.inputs.create_documentation == 'true' }} + use_gpg: ${{ github.event.inputs.use_gpg != 'false' }} + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }} + TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }} + GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }} + GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }} diff --git a/.github/workflows/v4-bootstrap.yml b/.github/workflows/v4-bootstrap.yml index fdbcaee..5cd7b2f 100644 --- a/.github/workflows/v4-bootstrap.yml +++ b/.github/workflows/v4-bootstrap.yml @@ -44,63 +44,63 @@ name: ๐Ÿš€ v4 Bootstrap on: - workflow_dispatch: - inputs: - dry_run: - description: "Dry-run: preview every mutation without firing it. Default `true` โ€” set to `false` to actually apply changes." - type: boolean - required: false - default: true - code_security: - description: "Code Security policy. off = disable. public-only = enable only if this repo is public (free). all = enable (paid on private)." - type: choice - required: false - default: "off" - options: - - "off" - - "public-only" - - "all" - secret_protection: - description: "Secret Protection (scanning + push protection) policy. Same shape as code_security." - type: choice - required: false - default: "off" - options: - - "off" - - "public-only" - - "all" - steps: - description: "Subset of phases to run, comma-separated." - required: false - default: "branches,settings,security,rulesets" + workflow_dispatch: + inputs: + dry_run: + description: "Dry-run: preview every mutation without firing it. Default `true` โ€” set to `false` to actually apply changes." + type: boolean + required: false + default: true + code_security: + description: "Code Security policy. off = disable. public-only = enable only if this repo is public (free). all = enable (paid on private)." + type: choice + required: false + default: "off" + options: + - "off" + - "public-only" + - "all" + secret_protection: + description: "Secret Protection (scanning + push protection) policy. Same shape as code_security." + type: choice + required: false + default: "off" + options: + - "off" + - "public-only" + - "all" + steps: + description: "Subset of phases to run, comma-separated." + required: false + default: "branches,settings,security,rulesets" permissions: - contents: read + contents: read jobs: - bootstrap: - name: "๐Ÿš€ Bootstrap v4 (this repo)" - runs-on: ubuntu-latest - steps: - - name: Create App token - id: app-token - # Full-permission App token โ€” bootstrap needs administration:write - # for security toggles + ruleset import, plus contents:write for - # branch creation. - uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4 - with: - client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - env: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + bootstrap: + name: "๐Ÿš€ Bootstrap v4 (this repo)" + runs-on: ubuntu-latest + steps: + - name: Create App token + id: app-token + # Full-permission App token โ€” bootstrap needs administration:write + # for security toggles + ruleset import, plus contents:write for + # branch creation. + uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4 + with: + client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + env: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - - name: Bootstrap - uses: CLDMV/.github/.github/actions/github/jobs/org-bootstrap-repo@v4 - with: - # target_repo defaults to GITHUB_REPOSITORY (this repo). - github_token: ${{ steps.app-token.outputs.token }} - dry_run: ${{ github.event.inputs.dry_run }} - steps: ${{ github.event.inputs.steps }} - code_security: ${{ github.event.inputs.code_security }} - secret_protection: ${{ github.event.inputs.secret_protection }} + - name: Bootstrap + uses: CLDMV/.github/.github/actions/github/jobs/org-bootstrap-repo@v4 + with: + # target_repo defaults to GITHUB_REPOSITORY (this repo). + github_token: ${{ steps.app-token.outputs.token }} + dry_run: ${{ github.event.inputs.dry_run }} + steps: ${{ github.event.inputs.steps }} + code_security: ${{ github.event.inputs.code_security }} + secret_protection: ${{ github.event.inputs.secret_protection }} diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml index 22aaaf9..59f7cdd 100644 --- a/.github/workflows/welcome.yml +++ b/.github/workflows/welcome.yml @@ -19,20 +19,20 @@ name: ๐Ÿ‘‹ Welcome Contributor # - We only call REST APIs to read prior interactions and post a comment # DO NOT add a checkout step or any step that executes PR-supplied content. on: - issues: - types: [opened] - pull_request_target: - types: [opened] + issues: + types: [opened] + pull_request_target: + types: [opened] permissions: - issues: write - pull-requests: write + issues: write + pull-requests: write jobs: - welcome: - uses: CLDMV/.github/.github/workflows/reusable-welcome.yml@v4 - # Optional. Without these, the welcome comment is posted by - # github-actions[bot]. With these, it's posted by your CLDMV bot App. - secrets: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + welcome: + uses: CLDMV/.github/.github/workflows/reusable-welcome.yml@v4 + # Optional. Without these, the welcome comment is posted by + # github-actions[bot]. With these, it's posted by your CLDMV bot App. + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}