Skip to content

Commit 8749928

Browse files
p-linnanep-linnane
authored
Merge pull request #65 from Homebrew/sync-shared-config
2 parents 8eb25d8 + 1750223 commit 8749928

File tree

7 files changed

+372
-25
lines changed

7 files changed

+372
-25
lines changed

‎.github/codeql/extensions/homebrew-actions.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is synced from the `.github` repository, do not modify it directly.
2+
extensions:
3+
- addsTo:
4+
pack: codeql/actions-all
5+
extensible: trustedActionsOwnerDataModel
6+
data:
7+
- ["Homebrew"]

‎.github/dependabot.yml

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
1+
# This file is synced from the `.github` repository, do not modify it directly.
2+
---
13
version: 2
2-
3-
updates:
4-
- package-ecosystem: github-actions
5-
directory: /
4+
multi-ecosystem-groups:
5+
all:
66
schedule:
7-
interval: daily
8-
allow:
9-
- dependency-type: all
10-
groups:
11-
artifacts:
12-
patterns:
13-
- actions/*-artifact
7+
interval: weekly
8+
day: friday
9+
time: '08:00'
10+
timezone: Etc/UTC
11+
updates:
12+
- package-ecosystem: github-actions
13+
directory: "/"
14+
multi-ecosystem-group: all
15+
patterns:
16+
- "*"
17+
allow:
18+
- dependency-type: all
19+
cooldown:
20+
default-days: 1
21+
include:
22+
- "*"
1423

15-
- package-ecosystem: terraform
16-
directory: /
17-
schedule:
18-
interval: daily

‎.github/workflows/actionlint.yml

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
1-
name: actionlint
1+
# This file is synced from the `.github` repository, do not modify it directly.
2+
name: Actionlint
23

34
on:
45
push:
56
branches:
67
- main
7-
paths:
8-
- '.github/workflows/*.ya?ml'
8+
- master
99
pull_request:
10-
paths:
11-
- '.github/workflows/*.ya?ml'
1210

1311
defaults:
1412
run:
@@ -25,15 +23,18 @@ env:
2523

2624
permissions: {}
2725

28-
# FIXME: The `Install tools` step fails inside the Docker container for some reason.
2926
jobs:
3027
workflow_syntax:
3128
if: github.repository_owner == 'Homebrew'
3229
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
container:
33+
image: ghcr.io/homebrew/ubuntu22.04:main
3334
steps:
3435
- name: Set up Homebrew
3536
id: setup-homebrew
36-
uses: Homebrew/actions/setup-homebrew@master
37+
uses: Homebrew/actions/setup-homebrew@main
3738
with:
3839
core: false
3940
cask: false
@@ -47,26 +48,39 @@ jobs:
4748
persist-credentials: false
4849

4950
- run: zizmor --format sarif . > results.sarif
51+
env:
52+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5053

5154
- name: Upload SARIF file
5255
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
56+
# We can't use the SARIF file when triggered by `merge_group` so we don't upload it.
57+
if: always() && github.event_name != 'merge_group'
5358
with:
5459
name: results.sarif
5560
path: results.sarif
5661

5762
- name: Set up actionlint
5863
run: |
59-
# Setting `shell: /bin/bash` prevents shellcheck from running on
60-
# those steps, so let's change them to `shell: bash` for linting.
64+
# In homebrew-core, setting `shell: /bin/bash` prevents shellcheck from running on
65+
# those steps, so let's change them to `shell: bash` temporarily for better linting.
6166
sed -i 's|shell: /bin/bash -x|shell: bash -x|' .github/workflows/*.y*ml
62-
# The JSON matcher needs to be accessible to the container host.
67+
68+
# In homebrew-core, the JSON matcher needs to be accessible to the container host.
6369
cp "$(brew --repository)/.github/actionlint-matcher.json" "$HOME"
70+
6471
echo "::add-matcher::$HOME/actionlint-matcher.json"
6572
6673
- run: actionlint
6774

6875
upload_sarif:
6976
needs: workflow_syntax
77+
# We want to always upload this even if `actionlint` failed.
78+
# This is only available on public repositories.
79+
if: >
80+
always() &&
81+
!contains(fromJSON('["cancelled", "skipped"]'), needs.workflow_syntax.result) &&
82+
!github.event.repository.private &&
83+
github.event_name != 'merge_group'
7084
runs-on: ubuntu-latest
7185
permissions:
7286
contents: read

‎.github/workflows/stale-issues.yml

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# This file is synced from the `.github` repository, do not modify it directly.
2+
name: Manage stale issues
3+
4+
on:
5+
push:
6+
paths:
7+
- .github/workflows/stale-issues.yml
8+
branches-ignore:
9+
- dependabot/**
10+
schedule:
11+
# Once every day at midnight UTC
12+
- cron: "0 0 * * *"
13+
issue_comment:
14+
15+
permissions: {}
16+
17+
defaults:
18+
run:
19+
shell: bash -xeuo pipefail {0}
20+
21+
concurrency:
22+
group: stale-issues
23+
cancel-in-progress: ${{ github.event_name != 'issue_comment' }}
24+
25+
jobs:
26+
stale:
27+
if: >
28+
github.repository_owner == 'Homebrew' && (
29+
github.event_name != 'issue_comment' || (
30+
contains(github.event.issue.labels.*.name, 'stale') ||
31+
contains(github.event.pull_request.labels.*.name, 'stale')
32+
)
33+
)
34+
runs-on: ubuntu-latest
35+
permissions:
36+
contents: write
37+
issues: write
38+
pull-requests: write
39+
steps:
40+
- name: Mark/Close Stale Issues and Pull Requests
41+
uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
42+
with:
43+
repo-token: ${{ secrets.GITHUB_TOKEN }}
44+
days-before-stale: 21
45+
days-before-close: 7
46+
stale-issue-message: >
47+
This issue has been automatically marked as stale because it has not had
48+
recent activity. It will be closed if no further activity occurs.
49+
stale-pr-message: >
50+
This pull request has been automatically marked as stale because it has not had
51+
recent activity. It will be closed if no further activity occurs.
52+
exempt-issue-labels: "gsoc-outreachy,help wanted,in progress"
53+
exempt-pr-labels: "gsoc-outreachy,help wanted,in progress"
54+
delete-branch: true
55+
56+
bump-pr-stale:
57+
if: >
58+
github.repository_owner == 'Homebrew' && (
59+
github.event_name != 'issue_comment' || (
60+
contains(github.event.issue.labels.*.name, 'stale') ||
61+
contains(github.event.pull_request.labels.*.name, 'stale')
62+
)
63+
)
64+
runs-on: ubuntu-latest
65+
permissions:
66+
contents: write
67+
issues: write
68+
pull-requests: write
69+
steps:
70+
- name: Mark/Close Stale `bump-formula-pr` and `bump-cask-pr` Pull Requests
71+
uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
72+
with:
73+
repo-token: ${{ secrets.GITHUB_TOKEN }}
74+
days-before-stale: 2
75+
days-before-close: 1
76+
stale-pr-message: >
77+
This pull request has been automatically marked as stale because it has not had
78+
recent activity. It will be closed if no further activity occurs. To keep this
79+
pull request open, add a `help wanted` or `in progress` label.
80+
exempt-pr-labels: "help wanted,in progress"
81+
any-of-labels: "bump-formula-pr,bump-cask-pr"
82+
delete-branch: true

‎.github/zizmor.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This file is synced from the `.github` repository, do not modify it directly.
2+
rules:
3+
unpinned-uses:
4+
config:
5+
policies:
6+
Homebrew/actions/*: ref-pin

0 commit comments

Comments
 (0)