Skip to content

Commit d58808f

Browse files
hyperpolymathhyperpolymath
committed
fix(ci): format gleam files and sync standard workflows
1 parent 26c5478 commit d58808f

28 files changed

Lines changed: 2329 additions & 66 deletions

‎.github/workflows/container-build.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: container build
3+
on:
4+
pull_request:
5+
paths:
6+
- 'container/**'
7+
- 'build/just/container.just'
8+
- '.github/workflows/container-build.yml'
9+
push:
10+
tags: ['v*']
11+
workflow_dispatch:
12+
13+
# Scope + cancel superseded runs (estate guardrail).
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
container:
23+
# OFF by default — costs nothing in derived repos. A repo opts in by setting
24+
# the repository/organisation variable CONTAINER_CI=true. When enabled it
25+
# runs on OWNED self-hosted runners (no metered GitHub Actions minutes);
26+
# override the labels with the CONTAINER_RUNNER variable (a JSON array).
27+
if: vars.CONTAINER_CI == 'true'
28+
runs-on: ${{ fromJSON(vars.CONTAINER_RUNNER || '["self-hosted","owned","container"]') }}
29+
timeout-minutes: 30
30+
permissions:
31+
contents: read
32+
steps:
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
35+
- name: Tooling check
36+
run: |
37+
command -v just >/dev/null 2>&1 || { echo "::error::just not found on this runner"; exit 1; }
38+
# The container recipes auto-detect the engine (podman | nerdctl | docker).
39+
for e in podman nerdctl docker; do command -v "$e" >/dev/null 2>&1 && { echo "engine: $e"; break; }; done
40+
41+
- name: Build image
42+
run: just container-build
43+
44+
- name: Verify compose configuration
45+
run: just container-verify
46+
47+
- name: Scan image (trivy, best-effort)
48+
run: |
49+
if command -v trivy >/dev/null 2>&1; then
50+
trivy image --severity HIGH,CRITICAL --exit-code 0 "${{ github.event.repository.name }}:latest" || true
51+
else
52+
echo "trivy not installed on this runner — skipping image scan"
53+
fi
54+
55+
- name: Sign & verify .ctp bundle (tags only)
56+
if: startsWith(github.ref, 'refs/tags/v')
57+
run: just container-sign # cerro-torre: build + pack + Ed25519 sign + verify

‎.github/workflows/dependabot-automerge.yml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
#
3+
# dependabot-automerge.yml — enable GitHub's native auto-merge on
4+
# Dependabot pull requests that match a declared severity / ecosystem
5+
# policy. Pairs with `.github/dependabot.yml`'s
6+
# `open-pull-requests-limit: 0` + security-only pattern (see the
7+
# cargo block there).
8+
#
9+
# What this does:
10+
# - Triggers on every Dependabot PR.
11+
# - Reads the PR's update-type metadata via the dependabot/fetch-metadata
12+
# action (no free-text parsing).
13+
# - Requires CI to be green before merge (GitHub's auto-merge enforces
14+
# required status checks).
15+
# - Gates merge behind a severity+ecosystem policy table. Default is
16+
# low+medium security updates only.
17+
#
18+
# Why auto-merge on GitHub (not via a bot like rhodibot) is the right
19+
# layer: GitHub enforces branch protection + required checks natively,
20+
# and the PR author is already `dependabot[bot]`. Rhodibot doesn't need
21+
# to know anything about ecosystems — GitHub handles the merge mechanics
22+
# once we approve.
23+
#
24+
# Threat model:
25+
# - A compromised upstream package with a bogus security advisory
26+
# could propose a malicious version bump. Mitigation: require at
27+
# least one non-automated reviewer for HIGH+CRITICAL severity
28+
# (done below — we explicitly refuse to auto-approve those).
29+
# - A compromised Dependabot itself is an Akerlof claim-grounder
30+
# problem. Not in scope here; track under
31+
# `project_claim_grounders_dual_use_akerlof.md`.
32+
#
33+
# Dogfooding: this workflow template is itself subject to the same
34+
# Dependabot config via the github-actions ecosystem block, so SHA
35+
# bumps for dependabot/fetch-metadata flow through the same path.
36+
37+
name: Dependabot Auto-Merge
38+
on:
39+
pull_request:
40+
types: [opened, reopened, synchronize]
41+
concurrency:
42+
group: ${{ github.workflow }}-${{ github.ref }}
43+
cancel-in-progress: false
44+
permissions:
45+
contents: write # needed to enable auto-merge
46+
pull-requests: write # needed to approve
47+
# NB: keep narrow — do NOT add secrets: read or id-token: write here.
48+
jobs:
49+
automerge:
50+
# Only run for PRs actually authored by Dependabot.
51+
if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
52+
runs-on: ubuntu-latest
53+
timeout-minutes: 15
54+
steps:
55+
- name: Fetch Dependabot metadata
56+
id: meta
57+
uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
58+
with:
59+
github-token: ${{ secrets.GITHUB_TOKEN }}
60+
# --- Policy gate -------------------------------------------------------
61+
# Outputs from fetch-metadata we care about:
62+
# update-type → version-update:semver-{patch,minor,major}
63+
# dependency-type → direct:{development,production} | indirect
64+
# alert-state → AUTO_DISMISSED | DISMISSED | FIXED | OPEN
65+
# ghsa-id → GHSA-... if this is a security PR
66+
# --- Policy -------------------------------------------------------------
67+
# AUTO-APPROVE + AUTO-MERGE when:
68+
# 1. This is a SECURITY update (ghsa-id present), AND
69+
# 2. Update is patch or minor, AND
70+
# 3. Severity ≤ moderate (Dependabot doesn't expose severity
71+
# directly in fetch-metadata; infer from the absence of
72+
# HIGH/CRITICAL labels added by Dependabot).
73+
# Otherwise: do nothing. Human reviews HIGH+CRITICAL security
74+
# updates and all non-security bumps.
75+
- name: Decide policy outcome
76+
id: policy
77+
env:
78+
GHSA_ID: ${{ steps.meta.outputs.ghsa-id }}
79+
UPDATE_TYPE: ${{ steps.meta.outputs.update-type }}
80+
PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
81+
run: |
82+
set -euo pipefail
83+
84+
is_security=false
85+
[ -n "$GHSA_ID" ] && is_security=true
86+
87+
# Owner policy (deliberate: velocity over caution). Auto-merge EVERY
88+
# Dependabot update — patch, minor AND major, security or routine.
89+
# Safe because GitHub's auto-merge only COMPLETES once the required
90+
# checks (secret-scanner, codeql, hypatia-scan, openssf-compliance,
91+
# build/test) are green: a bump that breaks fails CI and the PR stays
92+
# OPEN with an email ("oi, it broke") instead of landing on a red
93+
# main; a bump that passes lands within minutes with no chasing.
94+
# This is preferred over making Dependabot a ruleset BYPASS actor,
95+
# which would let bumps skip those very checks (no gate, no signal).
96+
echo "action=automerge" >> "$GITHUB_OUTPUT"
97+
echo "security=$is_security" >> "$GITHUB_OUTPUT"
98+
echo "update_type=$UPDATE_TYPE" >> "$GITHUB_OUTPUT"
99+
echo "ghsa=$GHSA_ID" >> "$GITHUB_OUTPUT"
100+
- name: Approve PR (if policy allows)
101+
if: steps.policy.outputs.action == 'automerge'
102+
env:
103+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
104+
PR_URL: ${{ github.event.pull_request.html_url }}
105+
run: |
106+
gh pr review --approve "$PR_URL" \
107+
--body "Auto-approving Dependabot security update (${{ steps.policy.outputs.ghsa }}, ${{ steps.policy.outputs.update_type }}). Policy: low/moderate security patches/minors only."
108+
- name: Enable auto-merge (if policy allows)
109+
if: steps.policy.outputs.action == 'automerge'
110+
env:
111+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
112+
PR_URL: ${{ github.event.pull_request.html_url }}
113+
run: |
114+
gh pr merge --auto --squash "$PR_URL"
115+
- name: Write decision to step summary
116+
env:
117+
ACTION: ${{ steps.policy.outputs.action }}
118+
IS_SECURITY: ${{ steps.policy.outputs.security }}
119+
UPDATE_TYPE: ${{ steps.policy.outputs.update_type }}
120+
GHSA: ${{ steps.policy.outputs.ghsa }}
121+
run: |
122+
{
123+
echo "## Dependabot Auto-Merge Decision"
124+
echo ""
125+
echo "| Field | Value |"
126+
echo "|-------|-------|"
127+
echo "| Policy action | \`$ACTION\` |"
128+
echo "| Security update | \`$IS_SECURITY\` |"
129+
echo "| Update type | \`$UPDATE_TYPE\` |"
130+
echo "| GHSA ID | \`${GHSA:-n/a}\` |"
131+
} >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)