| Age | Commit message (Collapse) | Author | Files |
|---|
|
The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
|
|
Set `persist-credentials: false` for all uses of `actions/checkout`.
This prevents git credentials from being stored on disk, and fixes the
following Zizmor audit:
https://docs.zizmor.sh/audits/#artipacked
|
|
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
|
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
|
Since lintcommit is a required check, it will always need to be run.
However, the lintcommit script is not designed to work on PRs that
doesn't target master branch (and it's not clear whether it's even
desirable).
To circumvent this we create a "dummy" lintcommit check that is run on
release branches that always passes, thus fulfilling the condition of
the required check.
|
|
Github doesn't allow workflows to be run from the `github-actions`
account, which is the default account. This caused the CI on backport
PRs to not be run. The way to circumvent this is to use a token that
essentially "pretends" to be another user, which in turn triggers the CI
as desired.
Also run lintcommit on release branches as that is now a required check,
meaning it must always be run.
|
|
Mostly rename file and variable names to be more consistent. This makes
it easier to locate them in the "Actions" tab on github.
|
|
This deduplicates common operations.
|
|
- adjust reviewers
- add workflow as cache key
- install attr only when tesitng
- fix s390x workflow by checking out the merge PR instead of master
|
|
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
|
This increases CI time, but prevents situations where it works on CI but
not locally.
|
|
Using print() alone doesn't work properly, toggling the verbose option
is still required.
|
|
|
|
|
|
As the trigger type is no longer pull_request_target there is no longer
any risk of using the lintcommit script directly from the user PR.
|
|
The default output is too verbose and messy for someone not already
familiar with lintcommit, which defeats it purpose.
|
|
|
