Skip to content

Commit 9dc4c1d

Browse files
zkoppertCopilot
zkoppert
and
Copilot
committed
Add missing workflow files from OSPO actions
Added standard workflows used across OSPO GitHub Actions: - auto-labeler.yml: Automatically labels PRs based on release-drafter config - copilot-setup-steps.yml: Documents Copilot CLI setup for contributors - linter.yaml: Runs super-linter on PRs to enforce code quality - pr-title.yml: Validates PR titles follow conventional commit format - scorecard.yml: Runs OpenSSF Scorecard security analysis - stale.yaml: Closes stale issues after 35 days of inactivity - release-drafter.yml: Configuration for auto-labeler and release notes These workflows provide: - Automated PR labeling for release notes - Code quality enforcement via linting - Security scanning via Scorecard - Stale issue management - PR title validation Brings pr-conflict-detector in line with other OSPO actions like issue-metrics, stale-repos, contributors, etc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent f403f6f commit 9dc4c1d

7 files changed

Lines changed: 256 additions & 0 deletions

File tree

‎.github/release-drafter.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
name-template: "v$RESOLVED_VERSION"
3+
tag-template: "v$RESOLVED_VERSION"
4+
template: |
5+
# Changelog
6+
$CHANGES
7+
8+
See details of [all code changes](https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION) since previous release
9+
10+
categories:
11+
- title: "🚀 Features"
12+
labels:
13+
- "feature"
14+
- "enhancement"
15+
- title: "🐛 Bug Fixes"
16+
labels:
17+
- "fix"
18+
- "bugfix"
19+
- "bug"
20+
- title: "🧰 Maintenance"
21+
labels:
22+
- "infrastructure"
23+
- "automation"
24+
- "documentation"
25+
- "dependencies"
26+
- "maintenance"
27+
- "revert"
28+
- title: "🏎 Performance"
29+
label: "performance"
30+
change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
31+
version-resolver:
32+
major:
33+
labels:
34+
- "breaking"
35+
- "major"
36+
minor:
37+
labels:
38+
- "enhancement"
39+
- "feature"
40+
- "minor"
41+
patch:
42+
labels:
43+
- "documentation"
44+
- "fix"
45+
- "maintenance"
46+
- "patch"
47+
default: patch
48+
autolabeler:
49+
- label: "automation"
50+
title:
51+
- "/^(build|ci|perf|refactor|test).*/i"
52+
- label: "enhancement"
53+
title:
54+
- "/^(style).*/i"
55+
- label: "documentation"
56+
title:
57+
- "/^(docs).*/i"
58+
- label: "feature"
59+
title:
60+
- "/^(feat).*/i"
61+
- label: "fix"
62+
title:
63+
- "/^(fix).*/i"
64+
- label: "infrastructure"
65+
title:
66+
- "/^(infrastructure).*/i"
67+
- label: "maintenance"
68+
title:
69+
- "/^(chore|maintenance).*/i"
70+
- label: "revert"
71+
title:
72+
- "/^(revert).*/i"

‎.github/workflows/auto-labeler.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: Auto Labeler
3+
on:
4+
# pull_request_target event is required for autolabeler to support all PRs including forks
5+
pull_request_target:
6+
types: [opened, reopened, edited, synchronize]
7+
permissions:
8+
contents: read
9+
jobs:
10+
main:
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
uses: github/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
15+
with:
16+
config-name: release-drafter.yml
17+
secrets:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: "Copilot Setup Steps"
2+
3+
# Automatically run the setup steps when they are changed to allow for easy validation, and
4+
# allow manual testing through the repository's "Actions" tab
5+
on:
6+
workflow_dispatch:
7+
push:
8+
paths:
9+
- .github/workflows/copilot-setup-steps.yml
10+
pull_request:
11+
paths:
12+
- .github/workflows/copilot-setup-steps.yml
13+
14+
# Set the permissions to the lowest permissions possible needed for your steps.
15+
# Copilot will be given its own token for its operations.
16+
permissions:
17+
# If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete.
18+
contents: read
19+
20+
jobs:
21+
# The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
22+
copilot-setup-steps:
23+
runs-on: ubuntu-latest
24+
25+
# You can define any steps you want, and they will run before the agent starts.
26+
# If you do not check out your code, Copilot will do this for you.
27+
steps:
28+
- name: Checkout code
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
persist-credentials: false
32+
33+
- name: Set up Python
34+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
35+
with:
36+
python-version: 3.12
37+
38+
- name: Install dependencies
39+
run: |
40+
pip install -r requirements.txt -r requirements-test.txt

‎.github/workflows/linter.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
name: Lint Code Base
3+
4+
on:
5+
pull_request:
6+
branches: [main]
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
lint:
13+
name: Lint Code Base
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
packages: read
18+
statuses: write
19+
steps:
20+
- name: Checkout Code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
# Full git history is needed to get a proper
24+
# list of changed files within `super-linter`
25+
fetch-depth: 0
26+
persist-credentials: false
27+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
28+
with:
29+
python-version: "3.12"
30+
- name: Install dependencies
31+
run: |
32+
pip install -r requirements.txt -r requirements-test.txt
33+
- name: Lint Code Base
34+
uses: super-linter/super-linter@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
35+
env:
36+
DEFAULT_BRANCH: main
37+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
GITHUB_ACTIONS_COMMAND_ARGS: -shellcheck=
39+
VALIDATE_BIOME_FORMAT: false
40+
VALIDATE_BIOME_LINT: false
41+
VALIDATE_PYTHON_RUFF_FORMAT: false

‎.github/workflows/pr-title.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## Reference: https://github.com/amannn/action-semantic-pull-request
2+
---
3+
name: "Lint PR Title"
4+
on:
5+
pull_request_target:
6+
types: [opened, reopened, edited, synchronize]
7+
permissions:
8+
contents: read
9+
jobs:
10+
main:
11+
permissions:
12+
contents: read
13+
pull-requests: read
14+
statuses: write
15+
uses: github/ospo-reusable-workflows/.github/workflows/pr-title.yaml@3b691dff6b68489c8548e1295d125c93c9c29a4e
16+
secrets:
17+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/scorecard.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: Scorecard supply-chain security
3+
on:
4+
workflow_dispatch:
5+
# For Branch-Protection check (for repo branch protection or rules).
6+
# Only the default branch is supported. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
8+
branch_protection_rule:
9+
# To guarantee Maintained check is occasionally updated. See
10+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
11+
schedule:
12+
- cron: "29 11 * * 6"
13+
push:
14+
branches: [main]
15+
16+
permissions: read-all
17+
18+
jobs:
19+
analysis:
20+
name: Merge to Main Scorecard analysis
21+
runs-on: ubuntu-latest
22+
permissions:
23+
security-events: write
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
publish_results: true
38+
- name: "Upload artifact"
39+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
40+
with:
41+
name: SARIF file
42+
path: results.sarif
43+
retention-days: 5
44+
- name: "Upload to code-scanning"
45+
uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7
46+
with:
47+
sarif_file: results.sarif

‎.github/workflows/stale.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: "Close stale issues"
2+
on:
3+
schedule:
4+
- cron: "30 1 * * *"
5+
6+
permissions:
7+
issues: write
8+
pull-requests: read
9+
10+
jobs:
11+
stale:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
15+
with:
16+
stale-issue-message: "This issue is stale because it has been open 21 days with no activity. Remove stale label or comment or this will be closed in 14 days."
17+
close-issue-message: "This issue was closed because it has been stalled for 35 days with no activity."
18+
days-before-stale: 21
19+
days-before-close: 14
20+
days-before-pr-close: -1
21+
exempt-issue-labels: keep

0 commit comments

Comments
 (0)