feat(ci): canonical fleet-CI reusable workflows (#2293) - #1
Merged
Merged
Conversation
added 2 commits
June 29, 2026 21:40
- security.yml: add osv-scanner job (nested reusable) + run_osv/osv_config/ osv_lockfile/cargo_deny_timeout_minutes inputs; bump cargo-deny-action SHA - gate-attestation.yml: fix actor→PR-author bug (Re-run-job flips github.actor to maintainer, re-arming trailer check on bot PRs); drop unused runner input - codeql.yml: new reusable (actions + rust, security-extended, inputs for both) - no-ai-attribution.yml: new reusable (commits + PR body/title, pattern-file input) - dependabot-auto-merge.yml: new reusable (patch + minor-dev; endswith() matcher tolerates caller-job/leaf-job prefix from reusable workflow check names) - release-please.yml: add RELEASE_PLEASE_TOKEN secret + config_file/manifest_file inputs; token falls back to GITHUB_TOKEN so existing callers are unaffected - actionlint.yml: new standalone (validates .github/workflows/** on PR; run: install of actionlint v1.7.7 — no third-party action SHA needed) - dependabot.yml: github-actions ecosystem, weekly — centralises SHA bumps fleet-wide
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
run_osv/osv_config/osv_lockfile/cargo_deny_timeout_minutesinputs; bumps cargo-deny-action to v2.0.20 SHAgithub.actorflips to maintainer on "Re-run failed jobs", re-arming the trailer check on bot PRs; fix keys waiver offgithub.event.pull_request.user.login; drops unusedrunnerinput.github/no-ai-attribution-patterns.txtendswith()matcher tolerates thecaller-job / leaf-jobcheck-name prefix from reusable workflowsRELEASE_PLEASE_TOKENsecret (falls back toGITHUB_TOKEN) +config_file/manifest_fileinputs so callers can override; existing callers unaffected.github/workflows/**on PRs touching those files; run-installs actionlint v1.7.7 (no third-party action SHA)github-actionsecosystem, weekly — centralises third-party action SHA bumps in this repo once for the whole fleetInert until per-repo callers point at them. Refs #2293.