fix copilot findings

Author: kgraeper

.github/workflows/reusable_integration-build.yml

@@ -19,14 +19,18 @@
 #     single label string (e.g., ubuntu-latest) or a JSON string representing a
 #     label or an array of labels (e.g., "\"ubuntu-latest\"" or
 #     "[\"self-hosted\",\"linux\",\"x64\"]").
-#   - ref_int_repo (string, optional, default: eclipse-score/reference_integration):
-#     Reference Integration repository to checkout.
-#   - ref_int_ref (string, optional, default: main): Ref/branch to checkout.
+#   - target_branch (string, optional, default: main): Ref/branch to checkout.
+#
+# Repository Variables:
+#   - reference_integration_repo (optional): Repository to checkout (owner/repo).
+#     Default: eclipse-score/reference_integration
+#
+# Secrets:
 #   - REPO_READ_TOKEN (secret, optional): Token for private module access; falls
 #     back to github.token when not provided.
 #
 # Runner selection:
-#   - Priority: `inputs.repo_runner_labels` > `vars.REPO_RUNNER_LABELS` > 'ubuntu-latest'.
+#   - Priority: `inputs.repo_runner_labels` > 'ubuntu-latest'.
 #   - `repo_runner_labels` can be provided as a single label string or as JSON
 #     (string or array). When JSON is used, it is parsed via fromJSON().
 #
@@ -40,7 +44,7 @@
 #           known_good: |
 #             { "modules": [] }
 #           config: bl-x86_64-linux
-#           repo_runner_labels: '"ubuntu-latest"'
+#           repo_runner_labels: 'ubuntu-latest'
 #         secrets:
 #           REPO_READ_TOKEN: ${{ secrets.REPO_READ_TOKEN }}
 #
@@ -66,21 +70,19 @@ on:
         description: 'Runner label(s) for the job; single label or JSON string/array.'
         required: false
         type: string
-      ref_int_ref:
+      target_branch:
         description: 'Reference Integration repository ref to checkout.'
         required: false
         type: string
         default: 'main'
-      ref_int_repo:
-        description: 'Reference Integration repository repo to checkout.'
-        required: false
-        type: string
-        default: 'eclipse-score/reference_integration'
+
+env:
+  REFERENCE_INTEGRATION_REPO: ${{ vars.reference_integration_repo != '' && vars.reference_integration_repo || 'eclipse-score/reference_integration' }}
 
 jobs:
   integration-test:
     name: Integration Test
-    runs-on: ${{ (inputs.repo_runner_labels && startsWith(inputs.repo_runner_labels, '[') && fromJSON(inputs.repo_runner_labels)) || inputs.repo_runner_labels || (vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS)) || 'ubuntu-latest' }}
+    runs-on: ${{ inputs.repo_runner_labels != '' && (startsWith(inputs.repo_runner_labels, '[') && fromJSON(inputs.repo_runner_labels) || inputs.repo_runner_labels) || 'ubuntu-latest' }}
     steps:
       - name: Show disk space before build
         run: |
@@ -102,8 +104,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4.2.2
         with:
-          repository: ${{ inputs.ref_int_repo || 'eclipse-score/reference_integration' }}
-          ref: ${{ inputs.ref_int_ref || 'main' }}
+          repository: ${{ env.REFERENCE_INTEGRATION_REPO }}
+          ref: ${{ inputs.target_branch || 'main' }}
           token: ${{ secrets.REPO_READ_TOKEN != '' && secrets.REPO_READ_TOKEN || github.token }}
       - name: Setup Bazel
         uses: bazel-contrib/setup-bazel@0.15.0

.github/workflows/reusable_smoke-test.yml

@@ -17,14 +17,15 @@
 # Inputs:
 #   - repo_runner_labels (string, required, default: ubuntu-latest): Runner label.
 #   - module_name (string, required): Module to override (e.g., score_baselibs).
-#   - ref_int_repo (string, optional, default: eclipse-score/reference_integration):
-#     The repository that provides the reusable integration workflows and tools.
-#     Use your private fork/org if you mirror this repo (e.g., my-org/reference_integration).
-#     Format: owner/repo
-#   - ref_int_ref (string, required, default: main):
-#     The ref on ref_int_repo to checkout via actions/checkout — can be a branch
-#     name, tag, or commit SHA. This ensures the workflow uses the exact version
-#     of the integration files you intend.
+#   - target_branch (string, required, default: main):
+#     The ref to checkout via actions/checkout — can be a branch name, tag, or
+#     commit SHA. This ensures the workflow uses the exact version of the
+#     integration files you intend.
+#
+# Repository Variables:
+#   - reference_integration_repo (optional): Repository providing integration
+#     workflows and tools (format: owner/repo). Supports private forks.
+#     Default: eclipse-score/reference_integration
 #
 # Secrets:
 #   - REPO_READ_TOKEN (optional): Token for reading private repos; falls back to
@@ -39,11 +40,13 @@
 #         with:
 #           repo_runner_labels: ubuntu-latest
 #           module_name: score_baselibs
-#           ref_int_ref: main
-#           ref_int_repo: eclipse-score/reference_integration
+#           target_branch: main
 #         secrets:
 #           REPO_READ_TOKEN: ${{ secrets.REPO_READ_TOKEN }}
 #
+#   Note: Set the 'reference_integration_repo' repository variable to use a
+#   private fork (e.g., my-org/reference_integration).
+#
 # Notes:
 #   - Extend the matrix in `integration-test` to cover additional configs.
 
@@ -61,21 +64,19 @@ on:
         description: 'Name of the module to override (e.g., score_baselibs).'
         required: true
         type: string
-      ref_int_ref:
-        description: 'Ref on ref_int_repo to checkout (branch, tag, or commit SHA).'
+      target_branch:
+        description: 'Ref to checkout (branch, tag, or commit SHA).'
         required: true
         type: string
         default: 'main'
-      ref_int_repo:
-        description: 'Repository providing integration workflows (owner/repo). Supports private forks.'
-        required: false
-        type: string
-        default: 'eclipse-score/reference_integration'
     secrets:
       REPO_READ_TOKEN:
         description: 'Token for reading repositories'
         required: false
 
+env:
+  REFERENCE_INTEGRATION_REPO: ${{ vars.reference_integration_repo != '' && vars.reference_integration_repo || 'eclipse-score/reference_integration' }}
+
 jobs:
   preparation:
     name: Preparation
@@ -86,13 +87,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4.2.2
         with:
-          repository: ${{ inputs.ref_int_repo }}
-          ref: ${{ inputs.ref_int_ref }}
+          repository: ${{ env.REFERENCE_INTEGRATION_REPO }}
+          ref: ${{ inputs.target_branch }}
           token: ${{ secrets.REPO_READ_TOKEN != '' && secrets.REPO_READ_TOKEN || github.token }}
       - name: Create updated known_good.json with PR commit
         id: set_known_good
         run: |
-          if [ "${{ github.repository }}" != "${{ inputs.ref_int_repo }}" ]; then
+          if [ "${{ github.repository }}" != "${{ env.REFERENCE_INTEGRATION_REPO }}" ]; then
             echo "Overriding ${{ inputs.module_name }} with current PR"
             python3 tools/override_known_good_repo.py \
               --known known_good.json \
@@ -148,8 +149,7 @@ jobs:
       known_good: ${{ needs.preparation.outputs.known_good_updated }}
       config: ${{ matrix.config }}
       repo_runner_labels: ${{ inputs.repo_runner_labels }}
-      ref_int_ref: ${{ inputs.ref_int_ref }}
-      ref_int_repo: ${{ inputs.ref_int_repo }}
+      target_branch: ${{ inputs.target_branch }}
 
   summary:
     name: Publish Summary

.github/workflows/test_integration.yml

@@ -28,5 +28,4 @@ jobs:
     with:
       repo_runner_labels: 'ubuntu-latest'
       module_name: 'reference_integration'
-      ref_int_ref: ${{ github.ref }}
-      ref_int_repo: ${{ github.repository }}
+      target_branch: ${{ github.ref }}

tools/override_known_good_repo.py

@@ -16,7 +16,7 @@
 import json
 import os
 import re
-from datetime import datetime
+import datetime as dt
 from typing import Dict, Any, List
 import logging
 
@@ -159,7 +159,7 @@ def apply_overrides(data: Dict[str, Any], repo_overrides: List[str]) -> Dict[str
     data["modules"] = {name: module.to_dict() for name, module in modules.items()}
 
     # Update timestamp
-    data["timestamp"] = datetime.now().isoformat() + "Z"
+    data["timestamp"] = dt.datetime.now(dt.timezone.utc).replace(microsecond=0).isoformat() + "Z"
 
     return data
 

tools/update_module_from_known_good.py

@@ -59,7 +59,7 @@ def generate_git_override_blocks(modules: List[Module], repo_commit_dict: Dict[s
                 patches_lines += f'        "{patch}",\n'
             patches_lines += "    ],\n    patch_strip = 1,\n"
 
-        if module.version and not commit:
+        if module.version:
             # If version is provided, use bazel_dep with single_version_override
             block = (
                 f'bazel_dep(name = "{module.name}")\n'