Skip to content

Commit b5e4ac6

Browse files
LizardByte-botReenigneArcher
LizardByte-bot
and
ReenigneArcher
authored
chore: update global workflows (#395)
Co-authored-by: ReenigneArcher <[email protected]>
1 parent 0faf5ab commit b5e4ac6

File tree

5 files changed

+111
-50
lines changed

5 files changed

+111
-50
lines changed

‎.github/workflows/ci-docker.yml

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
# This action is centrally managed in https://github.com/<organization>/.github/
2+
# This workflow is centrally managed in https://github.com/<organization>/.github/
33
# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
44
# the above-mentioned repo.
55

@@ -19,13 +19,20 @@
1919
# GitHub runner.
2020

2121
name: CI Docker
22+
permissions:
23+
contents: read
2224

2325
on:
2426
pull_request:
25-
branches: [master]
26-
types: [opened, synchronize, reopened]
27+
branches:
28+
- master
29+
types:
30+
- opened
31+
- synchronize
32+
- reopened
2733
push:
28-
branches: [master]
34+
branches:
35+
- master
2936
workflow_dispatch:
3037

3138
concurrency:
@@ -97,41 +104,43 @@ jobs:
97104
solution: ${{ steps.find_dotnet.outputs.solution }}
98105

99106
setup_release:
100-
if: ${{ needs.check_dockerfiles.outputs.dockerfiles }}
101107
name: Setup Release
102-
needs:
103-
- check_dockerfiles
108+
if: needs.check_dockerfiles.outputs.dockerfiles
109+
needs: check_dockerfiles
104110
outputs:
105111
publish_release: ${{ steps.setup_release.outputs.publish_release }}
106112
release_body: ${{ steps.setup_release.outputs.release_body }}
107113
release_commit: ${{ steps.setup_release.outputs.release_commit }}
108114
release_generate_release_notes: ${{ steps.setup_release.outputs.release_generate_release_notes }}
109115
release_tag: ${{ steps.setup_release.outputs.release_tag }}
110116
release_version: ${{ steps.setup_release.outputs.release_version }}
117+
permissions:
118+
contents: write # read does not work to check squash and merge details
111119
runs-on: ubuntu-latest
112120
steps:
113121
- name: Checkout
114122
uses: actions/checkout@v4
115123

116124
- name: Setup Release
117125
id: setup_release
118-
uses: LizardByte/setup-release-action@v2025.102.14715
126+
uses: LizardByte/setup-release-action@v2025.426.225
119127
with:
120128
dotnet: ${{ needs.check_dockerfiles.outputs.dotnet }}
121129
github_token: ${{ secrets.GITHUB_TOKEN }}
122130

123131
docker:
124-
needs: [check_dockerfiles, setup_release]
125-
if: ${{ needs.check_dockerfiles.outputs.dockerfiles }}
126-
runs-on: ubuntu-22.04
132+
name: Docker${{ matrix.tag }}
133+
if: needs.check_dockerfiles.outputs.dockerfiles
134+
needs:
135+
- check_dockerfiles
136+
- setup_release
127137
permissions:
128138
packages: write
129139
contents: write
140+
runs-on: ubuntu-22.04
130141
strategy:
131142
fail-fast: false
132143
matrix: ${{ fromJson(needs.check_dockerfiles.outputs.matrix) }}
133-
name: Docker${{ matrix.tag }}
134-
135144
steps:
136145
- name: Maximize build space
137146
uses: easimon/maximize-build-space@v10
@@ -256,22 +265,22 @@ jobs:
256265
Docker-buildx${{ matrix.tag }}-
257266
258267
- name: Log in to Docker Hub
259-
if: ${{ needs.setup_release.outputs.publish_release == 'true' }} # PRs do not have access to secrets
268+
if: needs.setup_release.outputs.publish_release == 'true' # PRs do not have access to secrets
260269
uses: docker/login-action@v3
261270
with:
262271
username: ${{ secrets.DOCKER_HUB_USERNAME }}
263272
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
264273

265274
- name: Log in to the Container registry
266-
if: ${{ needs.setup_release.outputs.publish_release == 'true' }} # PRs do not have access to secrets
275+
if: needs.setup_release.outputs.publish_release == 'true' # PRs do not have access to secrets
267276
uses: docker/login-action@v3
268277
with:
269278
registry: ghcr.io
270279
username: ${{ secrets.GH_BOT_NAME }}
271280
password: ${{ secrets.GH_BOT_TOKEN }}
272281

273282
- name: Build artifacts
274-
if: ${{ steps.prepare.outputs.artifacts == 'true' }}
283+
if: steps.prepare.outputs.artifacts == 'true'
275284
id: build_artifacts
276285
uses: docker/build-push-action@v6
277286
with:
@@ -314,7 +323,7 @@ jobs:
314323
no-cache-filters: ${{ steps.prepare.outputs.no_cache_filters }}
315324

316325
- name: Arrange Artifacts
317-
if: ${{ steps.prepare.outputs.artifacts == 'true' }}
326+
if: steps.prepare.outputs.artifacts == 'true'
318327
working-directory: artifacts
319328
run: |
320329
# debug directory
@@ -336,15 +345,18 @@ jobs:
336345
rm -f ./provenance.json
337346
338347
- name: Upload Artifacts
339-
if: ${{ steps.prepare.outputs.artifacts == 'true' }}
348+
if: steps.prepare.outputs.artifacts == 'true'
340349
uses: actions/upload-artifact@v4
341350
with:
342351
name: Docker${{ matrix.tag }}
343352
path: artifacts/
353+
if-no-files-found: error
344354

345355
- name: Create/Update GitHub Release
346-
if: ${{ needs.setup_release.outputs.publish_release == 'true' && steps.prepare.outputs.artifacts == 'true' }}
347-
uses: LizardByte/[email protected]
356+
if: >
357+
needs.setup_release.outputs.publish_release == 'true' &&
358+
steps.prepare.outputs.artifacts == 'true'
359+
uses: LizardByte/[email protected]
348360
with:
349361
allowUpdates: true
350362
artifacts: "*artifacts/*"
@@ -356,7 +368,9 @@ jobs:
356368
token: ${{ secrets.GH_BOT_TOKEN }}
357369

358370
- name: Update Docker Hub Description
359-
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
371+
if: >
372+
github.event_name == 'push' &&
373+
github.ref == 'refs/heads/master'
360374
uses: peter-evans/dockerhub-description@v4
361375
with:
362376
username: ${{ secrets.DOCKER_HUB_USERNAME }}

‎.github/workflows/ci.yml

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
---
22
name: CI
3+
permissions:
4+
contents: read
35

46
on:
57
pull_request:
6-
branches: [master]
7-
types: [opened, synchronize, reopened]
8+
branches:
9+
- master
10+
types:
11+
- opened
12+
- synchronize
13+
- reopened
814
push:
9-
branches: [master]
15+
branches:
16+
- master
1017
workflow_dispatch:
1118

1219
concurrency:

‎.github/workflows/codeql.yml

Lines changed: 46 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
---
2-
# This action is centrally managed in https://github.com/<organization>/.github/
2+
# This workflow is centrally managed in https://github.com/<organization>/.github/
33
# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
44
# the above-mentioned repo.
55

66
# This workflow will analyze all supported languages in the repository using CodeQL Analysis.
77

88
name: "CodeQL"
9+
permissions:
10+
contents: read
911

1012
on:
1113
push:
12-
branches: ["master"]
14+
branches:
15+
- master
1316
pull_request:
14-
branches: ["master"]
17+
branches:
18+
- master
1519
schedule:
1620
- cron: '00 12 * * 0' # every Sunday at 12:00 UTC
1721

@@ -22,14 +26,17 @@ concurrency:
2226
jobs:
2327
languages:
2428
name: Get language matrix
25-
runs-on: ubuntu-latest
2629
outputs:
2730
matrix: ${{ steps.lang.outputs.result }}
2831
continue: ${{ steps.continue.outputs.result }}
32+
runs-on: ubuntu-latest
2933
steps:
34+
- name: Checkout repository
35+
uses: actions/checkout@v4
36+
3037
- name: Get repo languages
31-
uses: actions/github-script@v7
3238
id: lang
39+
uses: actions/github-script@v7
3340
with:
3441
script: |
3542
// CodeQL supports ['cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift']
@@ -54,6 +61,22 @@ jobs:
5461
// Track languages we've already added to avoid duplicates
5562
const addedLanguages = new Set()
5663
64+
// Check if workflow files exist to determine if we should add actions language
65+
const fs = require('fs');
66+
const hasYmlFiles = fs.existsSync('.github/workflows') &&
67+
fs.readdirSync('.github/workflows').some(file => file.endsWith('.yml') || file.endsWith('.yaml'));
68+
69+
// Add actions language if workflow files exist
70+
if (hasYmlFiles) {
71+
console.log('Found GitHub Actions workflow files. Adding actions to the matrix.');
72+
matrix['include'].push({
73+
"category": "/language:actions",
74+
"language": "actions",
75+
"name": "actions",
76+
"os": "ubuntu-latest"
77+
});
78+
}
79+
5780
for (let [key, value] of Object.entries(response.data)) {
5881
// remap language
5982
if (remap_languages[key.toLowerCase()]) {
@@ -78,11 +101,18 @@ jobs:
78101
// set name for matrix
79102
let name = osList.length === 1 ? normalizedKey : `${normalizedKey}, ${os}`
80103
104+
// set category for matrix
105+
let category = `/language:${normalizedKey}`
106+
if (normalizedKey === 'cpp') {
107+
category = `/language:cpp-${os.split('-')[0]}`
108+
}
109+
81110
// add to matrix
82111
matrix['include'].push({
112+
"category": category,
83113
"language": normalizedKey,
84-
"os": os,
85-
"name": name
114+
"name": name,
115+
"os": os
86116
})
87117
}
88118
}
@@ -94,8 +124,8 @@ jobs:
94124
return matrix
95125
96126
- name: Continue
97-
uses: actions/github-script@v7
98127
id: continue
128+
uses: actions/github-script@v7
99129
with:
100130
script: |
101131
// if matrix['include'] is an empty list return false, otherwise true
@@ -109,24 +139,22 @@ jobs:
109139
110140
analyze:
111141
name: Analyze (${{ matrix.name }})
112-
if: ${{ needs.languages.outputs.continue == 'true' }}
142+
if: needs.languages.outputs.continue == 'true'
113143
defaults:
114144
run:
115145
shell: ${{ matrix.os == 'windows-latest' && 'msys2 {0}' || 'bash' }}
116146
env:
117147
GITHUB_CODEQL_BUILD: true
118-
needs: [languages]
119-
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
120-
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
148+
needs: languages
121149
permissions:
122150
actions: read
123151
contents: read
124152
security-events: write
125-
153+
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
126154
strategy:
127155
fail-fast: false
128156
matrix: ${{ fromJson(needs.languages.outputs.matrix) }}
129-
157+
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
130158
steps:
131159
- name: Maximize build space
132160
if: >-
@@ -174,8 +202,7 @@ jobs:
174202
- third-party
175203
176204
# Pre autobuild
177-
# create a file named .codeql-prebuild-${{ matrix.language }}.sh in the root of your repository
178-
# create a file named .codeql-build-${{ matrix.language }}.sh in the root of your repository
205+
# create a file named .codeql-prebuild-${{ matrix.language }}-${{ runner.os }}.sh in the root of your repository
179206
- name: Prebuild
180207
id: prebuild
181208
run: |
@@ -194,7 +221,7 @@ jobs:
194221
- name: Perform CodeQL Analysis
195222
uses: github/codeql-action/analyze@v3
196223
with:
197-
category: "/language:${{matrix.language}}"
224+
category: "${{ matrix.category }}"
198225
output: sarif-results
199226
upload: failure-only
200227

@@ -211,11 +238,13 @@ jobs:
211238
- name: Upload SARIF
212239
uses: github/codeql-action/upload-sarif@v3
213240
with:
241+
category: "${{ matrix.category }}"
214242
sarif_file: sarif-results/${{ matrix.language }}.sarif
215243

216244
- name: Upload loc as a Build Artifact
217245
uses: actions/upload-artifact@v4
218246
with:
219247
name: sarif-results-${{ matrix.language }}-${{ runner.os }}
220248
path: sarif-results
249+
if-no-files-found: error
221250
retention-days: 1

‎.github/workflows/common-lint.yml

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
---
2-
# This action is centrally managed in https://github.com/<organization>/.github/
2+
# This workflow is centrally managed in https://github.com/<organization>/.github/
33
# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in
44
# the above-mentioned repo.
55

66
# Common linting.
77

88
name: common lint
9+
permissions:
10+
contents: read
911

1012
on:
1113
pull_request:
12-
branches: [master]
13-
types: [opened, synchronize, reopened]
14+
branches:
15+
- master
16+
types:
17+
- opened
18+
- synchronize
19+
- reopened
1420

1521
concurrency:
1622
group: "${{ github.workflow }}-${{ github.ref }}"
@@ -77,9 +83,10 @@ jobs:
7783
7884
- name: C++ - Clang format lint
7985
if: always() && steps.cpp_files.outputs.found_files
80-
uses: DoozyX/clang-format-lint-action@v0.18
86+
uses: DoozyX/clang-format-lint-action@v0.20
8187
with:
8288
source: ${{ steps.cpp_files.outputs.found_files }}
89+
clangFormatVersion: '20'
8390
extensions: 'c,cpp,h,hpp,m,mm'
8491
style: file
8592
inplace: false
@@ -263,5 +270,4 @@ jobs:
263270

264271
- name: YAML - log
265272
if: always() && steps.yamllint.outcome == 'failure'
266-
run: |
267-
cat "${{ steps.yamllint.outputs.logfile }}" >> $GITHUB_STEP_SUMMARY
273+
run: cat "${{ steps.yamllint.outputs.logfile }}" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)