32bfe1d186
* fix(workflows): standardize runner configuration for security jobs * ci(actionlint): add Blacksmith runner label to config Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config to suppress "unknown label" warnings during workflow linting. This label is used across all workflows after the Blacksmith migration. * fix(actionlint): adjust indentation for self-hosted runner labels * feat(security): enhance security workflow with CodeQL analysis steps * fix(security): update CodeQL action to version 4 for improved analysis * fix(security): remove duplicate permissions in security workflow * fix(security): revert CodeQL action to v3 for stability The v4 version was causing workflow file validation failures. Reverting to proven v3 version that is working on main branch. * fix(security): remove duplicate permissions causing workflow validation failure The permissions block had duplicate security-events and actions keys, which caused YAML validation errors and prevented workflow execution. Fixes: workflow file validation failures on main branch * fix(security): remove pull_request trigger to reduce costs * fix(security): restore PR trigger but skip codeql on PRs * fix(security): resolve YAML syntax error in security workflow * refactor(security): split CodeQL into dedicated scheduled workflow * fix(security): update workflow name to Rust Package Security Audit * fix(codeql): remove push trigger, keep schedule and on-demand only * feat(codeql): add CodeQL configuration file to ignore specific paths * Potential fix for code scanning alert no. 39: Hard-coded cryptographic value Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(ci): resolve auto-response workflow merge markers * fix(build): restore ChannelMessage reply_target usage * ci(workflows): run workflow sanity on workflow pushes for all branches * ci(workflows): rename auto-response workflow to PR Auto Responder * ci(workflows): require owner approval for workflow file changes * ci: add lint-first PR feedback gate * ci(workflows): split label policy checks from workflow sanity * ci(workflows): consolidate policy and rust workflow setup --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
74 lines
3.1 KiB
YAML
74 lines
3.1 KiB
YAML
name: Label Policy Sanity
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- ".github/label-policy.json"
|
|
- ".github/workflows/labeler.yml"
|
|
- ".github/workflows/auto-response.yml"
|
|
push:
|
|
paths:
|
|
- ".github/label-policy.json"
|
|
- ".github/workflows/labeler.yml"
|
|
- ".github/workflows/auto-response.yml"
|
|
|
|
concurrency:
|
|
group: label-policy-sanity-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
contributor-tier-consistency:
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Verify shared label policy and workflow wiring
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
python3 - <<'PY'
|
|
import json
|
|
import re
|
|
from pathlib import Path
|
|
|
|
policy_path = Path('.github/label-policy.json')
|
|
policy = json.loads(policy_path.read_text(encoding='utf-8'))
|
|
color = str(policy.get('contributor_tier_color', '')).upper()
|
|
rules = policy.get('contributor_tiers', [])
|
|
if not re.fullmatch(r'[0-9A-F]{6}', color):
|
|
raise SystemExit('invalid contributor_tier_color in .github/label-policy.json')
|
|
if not rules:
|
|
raise SystemExit('contributor_tiers must not be empty in .github/label-policy.json')
|
|
|
|
labels = set()
|
|
prev_min = None
|
|
for entry in rules:
|
|
label = str(entry.get('label', '')).strip().lower()
|
|
min_merged = int(entry.get('min_merged_prs', 0))
|
|
if not label.endswith('contributor'):
|
|
raise SystemExit(f'invalid contributor tier label: {label}')
|
|
if label in labels:
|
|
raise SystemExit(f'duplicate contributor tier label: {label}')
|
|
if prev_min is not None and min_merged > prev_min:
|
|
raise SystemExit('contributor_tiers must be sorted descending by min_merged_prs')
|
|
labels.add(label)
|
|
prev_min = min_merged
|
|
|
|
workflow_paths = [
|
|
Path('.github/workflows/labeler.yml'),
|
|
Path('.github/workflows/auto-response.yml'),
|
|
]
|
|
for workflow in workflow_paths:
|
|
text = workflow.read_text(encoding='utf-8')
|
|
if '.github/label-policy.json' not in text:
|
|
raise SystemExit(f'{workflow} must load .github/label-policy.json')
|
|
if re.search(r'contributorTierColor\s*=\s*"[0-9A-Fa-f]{6}"', text):
|
|
raise SystemExit(f'{workflow} contains hardcoded contributorTierColor')
|
|
|
|
print('label policy file is valid and workflow consumers are wired to shared policy')
|
|
PY
|