diff --git a/.github/dependabots.yml b/.github/dependabots.yml new file mode 100644 index 00000000..13150bcf --- /dev/null +++ b/.github/dependabots.yml @@ -0,0 +1,11 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + - package-ecosystem: "github-actions" # See documentation for possible values + directory: "/" # This points to .github/workflows + schedule: + interval: "daily" diff --git a/.github/workflows/qcom-preflight-checks.yml b/.github/workflows/qcom-preflight-checks.yml new file mode 100644 index 00000000..d070f0a1 --- /dev/null +++ b/.github/workflows/qcom-preflight-checks.yml @@ -0,0 +1,24 @@ +name: Qualcomm Preflight Checks +on: + pull_request_target: + branches: [ "main" ] + push: + branches: [ "main" ] + workflow_dispatch: + +permissions: + contents: read + security-events: write + +jobs: + qcom-preflight-checks: + uses: qualcomm/qcom-reusable-workflows/.github/workflows/qcom-preflight-checks-reusable-workflow.yml@v1.1.4 + with: + # ✅ Preflight Checkers + repolinter: true # default: true + semgrep: true # default: true + copyright-license-detector: true # default: true + pr-check-emails: true # default: true + dependency-review: true # default: true + secrets: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} diff --git a/.github/workflows/qualcomm-organization-repolinter.yml b/.github/workflows/qualcomm-organization-repolinter.yml deleted file mode 100644 index 7f6378ab..00000000 --- a/.github/workflows/qualcomm-organization-repolinter.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Qualcomm Organization Repolinter - -on: [push, pull_request] - -jobs: - repolinter: - runs-on: ubuntu-latest - steps: - - name: Checkout Repo - uses: actions/checkout@v4 - - name: Verify repolinter config file is present - id: check_files - uses: andstor/file-existence-action@v3 - with: - files: "repolint.json" - - name: Run Repolinter with local repolint.json - if: steps.check_files.outputs.files_exists == 'true' - uses: todogroup/repolinter-action@v1 - with: - config_file: "repolint.json" - - name: Run Repolinter with default ruleset - if: steps.check_files.outputs.files_exists == 'false' - uses: todogroup/repolinter-action@v1 - with: - config_url: "https://raw.githubusercontent.com/qualcomm/.github/main/repolint.json"