From 4f4652575f98697e1fbb5c344fdb82e31657f832 Mon Sep 17 00:00:00 2001 From: Neeraj Jetha Date: Mon, 11 Aug 2025 11:09:25 +0530 Subject: [PATCH] ci: replace Repolinter with centralized compliance checks Replace Repolinter workflow with a centralized set of compliance and security validations. Support project-specific exclusions for non- applicable checks. Add reusable workflow to streamline maintenance and ensure consistency across repositories. Signed-off-by: Neeraj Jetha --- .github/dependabots.yml | 11 +++++++ .github/workflows/qcom-preflight-checks.yml | 24 +++++++++++++++ ...qualcomm-linux-organization-repolinter.yml | 30 ------------------- .github/workflows/stale-issues.yaml | 25 ++++++++++++++++ 4 files changed, 60 insertions(+), 30 deletions(-) create mode 100644 .github/dependabots.yml create mode 100644 .github/workflows/qcom-preflight-checks.yml delete mode 100644 .github/workflows/qualcomm-linux-organization-repolinter.yml create mode 100644 .github/workflows/stale-issues.yaml diff --git a/.github/dependabots.yml b/.github/dependabots.yml new file mode 100644 index 0000000..13150bc --- /dev/null +++ b/.github/dependabots.yml @@ -0,0 +1,11 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + - package-ecosystem: "github-actions" # See documentation for possible values + directory: "/" # This points to .github/workflows + schedule: + interval: "daily" diff --git a/.github/workflows/qcom-preflight-checks.yml b/.github/workflows/qcom-preflight-checks.yml new file mode 100644 index 0000000..d070f0a --- /dev/null +++ b/.github/workflows/qcom-preflight-checks.yml @@ -0,0 +1,24 @@ +name: Qualcomm Preflight Checks +on: + pull_request_target: + branches: [ "main" ] + push: + branches: [ "main" ] + workflow_dispatch: + +permissions: + contents: read + security-events: write + +jobs: + qcom-preflight-checks: + uses: qualcomm/qcom-reusable-workflows/.github/workflows/qcom-preflight-checks-reusable-workflow.yml@v1.1.4 + with: + # ✅ Preflight Checkers + repolinter: true # default: true + semgrep: true # default: true + copyright-license-detector: true # default: true + pr-check-emails: true # default: true + dependency-review: true # default: true + secrets: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} diff --git a/.github/workflows/qualcomm-linux-organization-repolinter.yml b/.github/workflows/qualcomm-linux-organization-repolinter.yml deleted file mode 100644 index 5c37df7..0000000 --- a/.github/workflows/qualcomm-linux-organization-repolinter.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Qualcomm Linux Organization Repolinter - -on: - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] - -jobs: - repolinter: - runs-on: ubuntu-latest - steps: - - name: Checkout Repo - uses: actions/checkout@v4 - - name: Verify repolinter config file is present - id: check_files - uses: andstor/file-existence-action@v3 - with: - files: "repolint.json" - - name: Run Repolinter with local repolint.json - if: steps.check_files.outputs.files_exists == 'true' - uses: todogroup/repolinter-action@v1 - with: - config_file: "repolint.json" - - name: Run Repolinter with default ruleset - if: steps.check_files.outputs.files_exists == 'false' - uses: todogroup/repolinter-action@v1 - with: - config_url: "https://raw.githubusercontent.com/qualcomm/.github/main/repolint.json" - diff --git a/.github/workflows/stale-issues.yaml b/.github/workflows/stale-issues.yaml new file mode 100644 index 0000000..7f119bf --- /dev/null +++ b/.github/workflows/stale-issues.yaml @@ -0,0 +1,25 @@ +name: 'Close stale issues and pull requests with no recent activity' +on: + schedule: + - cron: "30 1 * * *" + +permissions: + issues: write + pull-requests: write + +jobs: + stale: + runs-on: ubuntu-latest + steps: + - uses: actions/stale@v9 + with: + stale-issue-message: 'This issue has been marked as stale due to 30 days of inactivity. To prevent automatic closure in 7 days, remove the stale label or add a comment. You can reopen a closed issue at any time.' + stale-pr-message: 'This pull request has been marked as stale due to 30 days of inactivity. To prevent automatic closure in 7 days, remove the stale label or add a comment. You can reopen a closed pull request at any time.' + exempt-issue-labels: bug,enhancement + exempt-pr-labels: bug,enhancement + days-before-stale: 30 + days-before-close: 7 + days-before-issue-close: -1 + remove-stale-when-updated: true + remove-issue-stale-when-updated: true + remove-pr-stale-when-updated: true