chore: refactor ci and versioning scheme #815
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
🦙 MegaLinter status: ✅ SUCCESS
See detailed report in MegaLinter reports
|
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
Contributor
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
rjaegers
changed the title
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Ron <[email protected]>
|
Contributor
There was a problem hiding this comment.
Pull Request Overview
Refactors GitHub workflows by separating CI and release concerns, standardizing versioning to use an “edge” base, and strengthening runner security.
- Converts many workflows to
workflow_callwith explicitflavorinputs and removes the now-redundant prime-cache workflow - Updates build & push logic to use
inputs.flavor, pins harden-runner steps, and switches to the “edge” devcontainer tag - Adds
step-security/harden-runnerto applicable workflows and tightens permissions
Reviewed Changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/wc-integration-test.yml | Added runner hardening and updated cache path |
| .github/workflows/wc-build-push.yml | Made build-push a callable workflow; switched to inputs.flavor and “edge” base; cleaned up matrix |
| .github/workflows/wc-build-push-test.yml | New workflow chaining build-push, integration, acceptance tests, and result publishing |
| .github/workflows/vulnerability-scan.yml | Added runner hardening step |
| .github/workflows/update-dependencies.yml | Updated container tag to “edge”; reset permissions; added hardening |
| .github/workflows/social-interaction.yml | Cleared permissions block; added hardening step |
| .github/workflows/release-published.yml | Cleared permissions; added hardening step |
| .github/workflows/release-please.yml | Moved permissions block; added hardening step |
| .github/workflows/release-build.yml | New release-build workflow stitching tests and notes |
| .github/workflows/prime-cache.yml | Removed obsolete prime-cache workflow |
| .github/workflows/pr-report.yml | Cleared permissions; added hardening step |
| .github/workflows/pr-image-cleanup.yml | Cleared permissions; added hardening step |
| .github/workflows/pr-conventional-title.yml | Added runner hardening step |
| .github/workflows/ossf-scorecard.yml | Added runner hardening step |
| .github/workflows/linting-formatting.yml | Added hardening and switched MegaLinter flavor |
| .github/workflows/issue-creation-tool-versions.yml | Added runner hardening step |
| .github/workflows/issue-cleanup.yml | Cleared permissions; added hardening step |
| .github/workflows/continuous-integration.yml | New CI workflow using wc-build-push-test |
| .github/actions/container-size-diff/container-size-diff.sh | Improved formatting and infinite-percentage handling |
Comments suppressed due to low confidence (2)
.github/actions/container-size-diff/container-size-diff.sh:42
- The new branch handling zero base sizes (infinite percentage change) should be covered by automated tests or integration scenarios to ensure the edge case and formatting (
+∞) remain correct.
if [[ ${FROM_SIZE} -eq 0 ]]; then
.github/workflows/wc-integration-test.yml:23
- [nitpick] Consider adding a
name:to this harden-runner step (e.g.,name: Harden runner security) for improved readability and consistency across workflows.
- - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
EkelmansPh
approved these changes
Jun 13, 2025
Contributor
Pull Request Report (#815)Static measures
Time related measures
Status check related measures
|
Contributor
|
🎉 Hooray! The changes in this pull request went live with the release of v6.1.0 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This PR contains a refactoring to the GitHub Workflows, separating concerns for continuous integration and release purposes. This slightly changes the versioning scheme, that is now documented in the readme.
In the process:
✔️ Checklist