From 9ab3cfb6266b451b18f4c42256fa902956c6d8ce Mon Sep 17 00:00:00 2001 From: Vishnu Santhosh Date: Tue, 30 Jun 2026 12:00:05 +0530 Subject: [PATCH 1/2] ci: Add QC preflight checks workflow Adds the Qualcomm preflight checks workflow from qcom-actions, enabling semgrep scans, dependency review, copyright/license checks, and commit email validation on PRs and pushes to main. Signed-off-by: Vishnu Santhosh --- .github/workflows/qcom-preflight-checks.yml | 24 +++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/workflows/qcom-preflight-checks.yml diff --git a/.github/workflows/qcom-preflight-checks.yml b/.github/workflows/qcom-preflight-checks.yml new file mode 100644 index 0000000..1b06899 --- /dev/null +++ b/.github/workflows/qcom-preflight-checks.yml @@ -0,0 +1,24 @@ +name: QC Preflight Checks + +on: + pull_request: + push: + branches: [main] + workflow_dispatch: + +jobs: + preflight: + name: Run QC Preflight Checks + uses: qualcomm/qcom-reusable-workflows/.github/workflows/reusable-qcom-preflight-checks-orchestrator.yml@v2 + with: + enable-semgrep-scan: true + enable-dependency-review: true + enable-repolinter-check: true + enable-copyright-license-check: true + enable-commit-email-check: true + enable-commit-msg-check: false + enable-armor-checkers: false + + permissions: + contents: read + security-events: write From 677aff4e589fec7b35c537895d47f962c41889ec Mon Sep 17 00:00:00 2001 From: Vishnu Santhosh Date: Fri, 3 Jul 2026 14:25:43 +0530 Subject: [PATCH 2/2] ci: Replace pull_request_target with pull_request in PR workflow pull_request_target grants write access from fork context which fails the QC preflight security check. Use pull_request instead. Signed-off-by: Vishnu Santhosh --- .github/workflows/pull-request.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index ae18d59..32af06b 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -1,6 +1,6 @@ name: Prevent pull request to main on: - pull_request_target: + pull_request: types: - opened - reopened