Skip to content

Commit b07ad14

Browse files
mrz1836mrz1836
committed
feat: massive upgrade to workflows
1 parent 797cd57 commit b07ad14

36 files changed

Lines changed: 6238 additions & 1571 deletions

‎.github/.env.shared‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# ------------------------------------------------------------------------------------
2+
# Shared Environment Variables for CI/CD Workflows
3+
#
4+
# Purpose: Centralized configuration for all GitHub Actions workflows.
5+
# This file contains static environment variables used across multiple workflows.
6+
#
7+
# Maintainer: @mrz1836
8+
#
9+
# ------------------------------------------------------------------------------------
10+
11+
# ───────────────────────────────────────────────────────────────────────────────
12+
# ENV: Custom Project Variables
13+
# ───────────────────────────────────────────────────────────────────────────────
14+
CUSTOM_VAR=false # Add your own custom variables here for use in workflows
15+
16+
# ───────────────────────────────────────────────────────────────────────────────
17+
# ENV: GitHub Token Configuration
18+
# ───────────────────────────────────────────────────────────────────────────────
19+
# Use 'GH_PAT_TOKEN' for private repos or higher API rate limits (5000/hour).
20+
# The default fallback is 'GITHUB_TOKEN' (rate-limited to 1000/hour).
21+
PREFERRED_GITHUB_TOKEN=GH_PAT_TOKEN # Change this per project as needed
22+
23+
# ───────────────────────────────────────────────────────────────────────────────
24+
# ENV: Go Version Matrix
25+
# ───────────────────────────────────────────────────────────────────────────────
26+
# If you set both primary and secondary versions to the same value, the workflow will only run once for that version.
27+
GO_PRIMARY_VERSION=1.24.x # Main Go version used by primary jobs and runners
28+
GO_SECONDARY_VERSION=1.24.x # Additional version for compatibility testing (or if the go.mod version != GO_PRIMARY_VERSION)
29+
30+
# ───────────────────────────────────────────────────────────────────────────────
31+
# ENV: OS and Runner Configuration
32+
# ───────────────────────────────────────────────────────────────────────────────
33+
# This can only be Linux or Mac (there is no support for Windows at this time).
34+
# Careful using Mac, it's expensive! See: https://docs.github.com/en/billing/managing-billing-for-your-products/about-billing-for-github-actions#minute-multipliers
35+
PRIMARY_RUNNER=ubuntu-24.04 # This is the primary runner and also used for jobs that require Linux (options are: ubuntu-24.04, ubuntu-22.04, macos-15)
36+
SECONDARY_RUNNER=ubuntu-24.04 # Set identical to PRIMARY_RUNNER if you want a single test runner (options are: ubuntu-24.04, ubuntu-22.04, macos-15)
37+
38+
# ───────────────────────────────────────────────────────────────────────────────
39+
# ENV: Feature Flags
40+
# ───────────────────────────────────────────────────────────────────────────────
41+
ENABLE_CODE_COVERAGE=true # Enable code coverage reporting (upload to Codecov)
42+
ENABLE_FUZZ_TESTING=true # Enable fuzz running tests (requires Go 1.18+)
43+
ENABLE_LINT=true # Enable linting steps (golangci-lint)
44+
ENABLE_RACE_DETECTION=true # Enable Go's race detector in tests (-race flag)
45+
ENABLE_SECURITY_SCANS=true # Enable tools like gitleaks, govulncheck, nancy
46+
ENABLE_STATIC_ANALYSIS=true # Enable static analysis jobs (go vet)
47+
ENABLE_VERBOSE_TEST_OUTPUT=true # Enable verbose output for test runs (can slow down CI)
48+
MAKEFILE_REQUIRED=true # Enforce the presence of Makefile for builds (future feature)
49+
50+
# ───────────────────────────────────────────────────────────────────────────────
51+
# ENV: Tool Versions & Config
52+
# ───────────────────────────────────────────────────────────────────────────────
53+
GITLEAKS_NOTIFY_USER_LIST=@mrz1836 # User(s) to notify when gitleaks secrets are found (user,user2)
54+
GITLEAKS_VERSION=8.27.2 # Version of gitleaks to install and use (X.Y.Z)
55+
GORELEASER_VERSION=v2.10.2 # Version of goreleaser to install and use (vX.Y.Z)
56+
GOVULNCHECK_VERSION=v1.1.4 # Version of govulncheck to use for Go vuln scanning (vX.Y.Z)
57+
NANCY_EXCLUDES=CVE-2024-38513,CVE-2022-21698,CVE-2023-45142 # Known acceptable CVEs (cve,cve2,...)
58+
NANCY_VERSION=v1.0.51 # Version of nancy to install and use (vX.Y.Z)
59+
60+
# ───────────────────────────────────────────────────────────────────────────────
61+
# ENV: Stale Workflow Configuration
62+
# ───────────────────────────────────────────────────────────────────────────────
63+
STALE_DAYS_BEFORE_STALE=60 # Days of inactivity before marking as stale
64+
STALE_DAYS_BEFORE_CLOSE=14 # Additional days before closing stale items
65+
STALE_LABEL=stale # Label to apply to stale items
66+
STALE_EXEMPT_ISSUE_LABELS=work-in-progress,security,requires-manual-review # Issues with these labels won't go stale
67+
STALE_EXEMPT_PR_LABELS=work-in-progress,security,requires-manual-review # PRs with these labels won't go stale
68+
STALE_OPERATIONS_PER_RUN=300 # Maximum API operations per workflow run
69+
70+
# ───────────────────────────────────────────────────────────────────────────────
71+
# ENV: Sync Labels Workflow Configuration
72+
# ───────────────────────────────────────────────────────────────────────────────
73+
SYNC_LABELS_FILE=.github/labels.yml # Path to the labels manifest file
74+
75+
# ───────────────────────────────────────────────────────────────────────────────
76+
# ENV: Python Dependencies Workflow Configuration
77+
# ───────────────────────────────────────────────────────────────────────────────
78+
UPDATE_PYTHON_DEPENDENCIES_BRANCH=chore/update-python-dependencies # Branch name for python dependency update PRs
79+
PIP_DIRECTORY=.github/pip # Directory containing all pip requirement files
80+
UPDATE_PYTHON_DEPENDENCIES_SCHEDULE_UPDATE_MAIN=true # Default: Update main requirements on scheduled runs
81+
UPDATE_PYTHON_DEPENDENCIES_SCHEDULE_UPDATE_PIP_TOOLS=true # Default: Update pip-tools requirements on scheduled runs
82+
UPDATE_PYTHON_DEPENDENCIES_SCHEDULE_CREATE_PR=true # Default: Create PR on scheduled runs
83+
UPDATE_PYTHON_DEPENDENCIES_PR_LABELS=dependencies,chore,automated,python # Labels to apply to PRs (comma-separated)
84+
UPDATE_PYTHON_DEPENDENCIES_PR_ASSIGNEE=mrz1836 # Default assignee for PRs
85+
86+
# ───────────────────────────────────────────────────────────────────────────────
87+
# ENV: Pre-commit Hooks Workflow Configuration
88+
# ───────────────────────────────────────────────────────────────────────────────
89+
UPDATE_PRE_COMMIT_HOOKS_BRANCH=chore/update-pre-commit-hooks # Branch name for pre-commit update PRs
90+
PRE_COMMIT_CONFIG_FILE=.pre-commit-config.yaml # Path to the pre-commit config file
91+
UPDATE_PRE_COMMIT_HOOKS_SCHEDULE_CREATE_PR=true # Default: Create PR on scheduled runs
92+
UPDATE_PRE_COMMIT_HOOKS_PR_LABELS=dependencies,chore,automated,pre-commit # Labels to apply to PRs (comma-separated)
93+
UPDATE_PRE_COMMIT_HOOKS_PR_ASSIGNEE=mrz1836 # Default assignee for PRs
94+
UPDATE_PRE_COMMIT_HOOKS_TEST_ON_UPDATE=true # Default: Test hooks after update
95+
96+
# ───────────────────────────────────────────────────────────────────────────────
97+
# ENV: Dependabot Auto-merge Workflow Configuration
98+
# ───────────────────────────────────────────────────────────────────────────────
99+
DEPENDABOT_MAINTAINER_USERNAME=mrz1836 # Username to notify for manual reviews
100+
DEPENDABOT_AUTO_MERGE_PATCH=true # Auto-merge patch updates
101+
DEPENDABOT_AUTO_MERGE_MINOR_DEV=true # Auto-merge minor updates for dev dependencies
102+
DEPENDABOT_AUTO_MERGE_MINOR_PROD=false # Auto-merge minor updates for prod dependencies
103+
DEPENDABOT_AUTO_MERGE_SECURITY_NON_MAJOR=true # Auto-merge security updates (except major)
104+
DEPENDABOT_ALERT_ON_MAJOR=true # Alert maintainer on major updates
105+
DEPENDABOT_ALERT_ON_MINOR_PROD=true # Alert maintainer on minor prod updates
106+
DEPENDABOT_MANUAL_REVIEW_LABEL=requires-manual-review # Label for PRs requiring manual review
107+
DEPENDABOT_AUTO_MERGE_LABELS=automerge,dependabot # Labels for auto-merged PRs (comma-separated)
108+
109+
# ───────────────────────────────────────────────────────────────────────────────
110+
# ENV: Auto-merge on Approval Workflow Configuration
111+
# ───────────────────────────────────────────────────────────────────────────────
112+
AUTO_MERGE_MIN_APPROVALS=1 # Minimum approvals required for auto-merge
113+
AUTO_MERGE_REQUIRE_ALL_REQUESTED_REVIEWS=true # Require all requested reviews to be completed
114+
AUTO_MERGE_ALLOWED_MERGE_TYPES=squash # Allowed merge types (squash,merge,rebase) comma-separated
115+
AUTO_MERGE_DELETE_BRANCH=true # Delete branch after merge
116+
AUTO_MERGE_SKIP_DRAFT=true # Skip draft PRs
117+
AUTO_MERGE_SKIP_WIP=true # Skip WIP PRs (title or label)
118+
AUTO_MERGE_WIP_LABELS=work-in-progress,wip,do-not-merge # Labels that indicate WIP (comma-separated)
119+
AUTO_MERGE_COMMENT_ON_ENABLE=true # Comment when auto-merge is enabled
120+
AUTO_MERGE_COMMENT_ON_DISABLE=true # Comment when auto-merge is disabled
121+
AUTO_MERGE_LABELS_TO_ADD=auto-merge-enabled # Labels to add when auto-merge is enabled
122+
AUTO_MERGE_SKIP_BOT_PRS=true # Skip bot PRs (they have separate workflows)
123+
124+
# ───────────────────────────────────────────────────────────────────────────────
125+
# ENV: Pull Request Management Workflow Configuration
126+
# ───────────────────────────────────────────────────────────────────────────────
127+
PR_MANAGEMENT_DEFAULT_ASSIGNEE=mrz1836 # Default assignee for PRs without one
128+
PR_MANAGEMENT_SKIP_BOT_USERS=dependabot[bot],mergify[bot],copilot[bot] # Bot users to skip (comma-separated)
129+
PR_MANAGEMENT_WELCOME_FIRST_TIME=true # Welcome first-time contributors
130+
PR_MANAGEMENT_APPLY_SIZE_LABELS=true # Apply size labels (XS, S, M, L, XL)
131+
PR_MANAGEMENT_APPLY_TYPE_LABELS=true # Apply type labels based on branch/title
132+
PR_MANAGEMENT_CLEAN_CACHE_ON_CLOSE=true # Clean runner cache when PR closes
133+
PR_MANAGEMENT_DELETE_BRANCH_ON_MERGE=true # Delete source branch after merge
134+
PR_MANAGEMENT_PROTECTED_BRANCHES=master,main,development # Branches that should never be deleted
135+
PR_MANAGEMENT_SIZE_XS_THRESHOLD=10 # Max changes for XS size label
136+
PR_MANAGEMENT_SIZE_S_THRESHOLD=50 # Max changes for S size label
137+
PR_MANAGEMENT_SIZE_M_THRESHOLD=200 # Max changes for M size label
138+
PR_MANAGEMENT_SIZE_L_THRESHOLD=500 # Max changes for L size label

‎.github/AGENTS.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1049,7 +1049,7 @@ CI automatically runs on every PR to verify:
10491049
* Linting (`make lint`)
10501050
* Tests (`make test`)
10511051
* Fuzz tests (if applicable) (`make run-fuzz-tests`)
1052-
* This codebase uses GitHub Actions; test workflows reside in `.github/workflows/run-tests.yml`
1052+
* This codebase uses GitHub Actions; test workflows reside in `.github/workflows/fortress.yml`
10531053
* Pin each external GitHub Action to a **full commit SHA** (e.g., `actions/checkout@2f3b4a2e0e471e13e2ea2bc2a350e888c9cf9b75`) as recommended by GitHub's [security hardening guidance](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-pinned-actions). Dependabot will track and update these pinned versions automatically.
10541054

10551055
Failing PRs will be blocked. AI agents should iterate until CI passes.

‎.github/SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ All official security responses are signed with it.
4545
We regularly scan for known vulnerabilities using:
4646

4747
* [`govulncheck`](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck): Checks Go code and dependencies for known vulnerabilities using the Go vulnerability database.
48-
* [`ask nancy`](https://github.com/sonatype-nexus-community/nancy): As part of our CI (see `run-tests.yml`), we run [nancy](https://github.com/sonatype-nexus-community/nancy) to check Go dependencies for vulnerabilities against the OSS Index. This helps us catch issues in third-party packages early.
48+
* [`ask nancy`](https://github.com/sonatype-nexus-community/nancy): As part of our CI (see `fortress.yml`), we run [nancy](https://github.com/sonatype-nexus-community/nancy) to check Go dependencies for vulnerabilities against the OSS Index. This helps us catch issues in third-party packages early.
4949

5050
Want to run these yourself?
5151

‎.github/actions/load-env/action.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# ------------------------------------------------------------------------------------
2+
# Load Environment Variables Composite Action
3+
#
4+
# Purpose: Loads and parses the .github/.env.shared file into JSON format
5+
# for use across all GitHub Actions workflows
6+
#
7+
# Outputs:
8+
# env-json: JSON object containing all environment variables from .env.shared
9+
#
10+
# Usage:
11+
# - uses: ./.github/actions/load-env
12+
# id: load-env
13+
#
14+
# Maintainer: @mrz1836
15+
#
16+
# ------------------------------------------------------------------------------------
17+
18+
name: 'Load Environment Variables'
19+
description: 'Loads environment variables from .github/.env.shared and outputs as JSON'
20+
21+
outputs:
22+
env-json:
23+
description: 'JSON object containing all environment variables'
24+
value: ${{ steps.load-env.outputs.env-json }}
25+
primary-runner:
26+
description: 'Primary runner OS extracted from environment variables'
27+
value: ${{ steps.load-env.outputs.primary-runner }}
28+
29+
runs:
30+
using: "composite"
31+
steps:
32+
# ————————————————————————————————————————————————————————————————
33+
# Load and parse environment file
34+
# ————————————————————————————————————————————————————————————————
35+
- name: 🔧 Load environment variables
36+
id: load-env
37+
shell: bash
38+
run: |
39+
echo "📋 Loading environment variables from .github/.env.shared..."
40+
41+
# Convert .env file to JSON for easy passing between jobs
42+
# Strip inline comments and process the file
43+
ENV_JSON=$(cat .github/.env.shared | \
44+
grep -v '^#' | \
45+
grep -v '^$' | \
46+
sed 's/#.*$//' | \
47+
sed 's/[[:space:]]*$//' | \
48+
jq -Rs 'split("\n") | map(select(length > 0) | split("=") | select(length == 2) | {(.[0]): .[1]}) | add')
49+
50+
# Check to make sure we have an ENV and it is not empty
51+
if [[ -z "$ENV_JSON" ]]; then
52+
echo "❌ ERROR: Environment variables are empty or not set." >&2
53+
exit 1
54+
fi
55+
56+
# Properly escape the JSON for GitHub Actions output
57+
echo "env-json<<EOF" >> $GITHUB_OUTPUT
58+
echo "$ENV_JSON" >> $GITHUB_OUTPUT
59+
echo "EOF" >> $GITHUB_OUTPUT
60+
echo "✅ Environment variables loaded successfully"
61+
62+
# Log count of variables loaded (for debugging)
63+
VAR_COUNT=$(echo "$ENV_JSON" | jq 'keys | length')
64+
echo "📊 Loaded $VAR_COUNT environment variables"
65+
66+
# Parse env for the primary_runner
67+
PRIMARY_RUNNER=$(echo "$ENV_JSON" | jq -r '.PRIMARY_RUNNER')
68+
if [[ -z "$PRIMARY_RUNNER" ]]; then
69+
echo "❌ PRIMARY_RUNNER is not set in the environment file." >&2
70+
exit 1
71+
fi
72+
echo "primary-runner=$PRIMARY_RUNNER" >> $GITHUB_OUTPUT

0 commit comments

Comments
 (0)