From 0a8b9f9c38dab8e7bb74c9c7b38ad26f70052334 Mon Sep 17 00:00:00 2001 From: Gabriel Bernal Date: Fri, 1 Aug 2025 15:46:44 +0200 Subject: [PATCH] [IGNORE] add snyk workflow to regenerate lockfile Signed-off-by: Gabriel Bernal --- .github/workflows/ci.yml | 55 ++++++++++++++++++++++---------------- .github/workflows/doc.yml | 16 +++-------- .github/workflows/main.yml | 35 ++++++++++++++++++++++++ .github/workflows/snyk.yml | 49 +++++++++++++++++++++++++++++++++ 4 files changed, 120 insertions(+), 35 deletions(-) create mode 100644 .github/workflows/main.yml create mode 100644 .github/workflows/snyk.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 21ce681b0..c3088558b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,32 +1,27 @@ name: ci on: - push: - branches: - - main - pull_request: - merge_group: - release: - types: - - published + workflow_call: jobs: build: - name: "build" + name: 'build' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: enable_npm: true enable_go: true enable_cue: true - cue_version: "v0.12.0" + cue_version: 'v0.12.0' - name: install percli uses: perses/cli-actions/actions/install_percli@v0.2.0 with: - cli-version: "v0.51.1" + cli-version: 'v0.51.1' - name: cache cue deps uses: actions/cache@v4 with: @@ -52,11 +47,13 @@ jobs: !node_modules lint-npm: - name: "lint-npm" + name: 'lint-npm' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: @@ -65,11 +62,13 @@ jobs: - run: npm run lint test-npm: - name: "test-npm" + name: 'test-npm' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: @@ -78,11 +77,13 @@ jobs: - run: npm run test type-check: - name: "type-check" + name: 'type-check' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: @@ -91,21 +92,23 @@ jobs: - run: npm run type-check lint-schemas: - name: "Validate plugin schemas" + name: 'Validate plugin schemas' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: enable_go: true enable_cue: true - cue_version: "v0.12.0" + cue_version: 'v0.12.0' - name: Install percli uses: perses/cli-actions/actions/install_percli@v0.2.0 with: - cli-version: "v0.51.1" + cli-version: 'v0.51.1' - uses: actions/cache@v4 id: cache with: @@ -120,6 +123,8 @@ jobs: steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: @@ -133,17 +138,19 @@ jobs: version: v2.3.0 - run: make golangci-lint module-check: - name: "Check plugin modules" + name: 'Check plugin modules' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: enable_go: true enable_cue: true - cue_version: "v0.12.0" + cue_version: 'v0.12.0' - uses: actions/cache@v4 id: cache with: @@ -157,8 +164,8 @@ jobs: run: git diff --exit-code -- */cue.mod release: - name: "release" - needs: "build" + name: 'release' + needs: 'build' runs-on: ubuntu-latest permissions: contents: write @@ -168,14 +175,16 @@ jobs: steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: enable_npm: true enable_go: true enable_cue: true - cue_version: "v0.12.0" - nvmrc_path: "./.nvmrc" + cue_version: 'v0.12.0' + nvmrc_path: './.nvmrc' - name: Download archive uses: actions/download-artifact@v4 with: diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml index 4e0c2cef9..1a84abb21 100644 --- a/.github/workflows/doc.yml +++ b/.github/workflows/doc.yml @@ -1,22 +1,16 @@ name: doc on: - push: - branches: - - main - - release/* - - snapshot/* - tags: - - v* - pull_request: - merge_group: + workflow_call: jobs: docs-fmt: - name: "Check docs format" + name: 'Check docs format' runs-on: ubuntu-latest steps: - name: checkout uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} - uses: perses/github-actions@v0.10.0 - uses: ./.github/perses-ci/actions/setup_environment with: @@ -25,5 +19,3 @@ jobs: run: go install github.com/bwplotka/mdox@latest - name: check docs run: make checkdocs - - diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 000000000..5f93a6e0a --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,35 @@ +name: main +on: + push: + branches: + - main + - release/* + - snapshot/* + tags: + - v* + pull_request: + merge_group: + release: + types: + - published + +jobs: + snyk: + name: 'snyk workflow' + if: ${{ startsWith(github.head_ref, 'snyk-') || startsWith(github.ref_name, 'snyk-') }} + uses: ./.github/workflows/snyk.yml + secrets: inherit + + docs: + name: 'docs workflow' + needs: [snyk] + if: ${{ always() && (needs.snyk.result == 'success' || needs.snyk.result == 'skipped') }} + uses: ./.github/workflows/doc.yml + secrets: inherit + + ci: + name: 'ci workflow' + needs: [snyk] + if: ${{ always() && (needs.snyk.result == 'success' || needs.snyk.result == 'skipped') }} + uses: ./.github/workflows/ci.yml + secrets: inherit diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml new file mode 100644 index 000000000..7ee7820b5 --- /dev/null +++ b/.github/workflows/snyk.yml @@ -0,0 +1,49 @@ +name: snyk +on: + workflow_call: + +jobs: + lockfile-update: + name: 'regenerate lockfile' + runs-on: ubuntu-latest + permissions: + contents: write + if: startsWith(github.head_ref, 'snyk-') + outputs: + lockfile-updated: ${{ steps.lockfile-changes.outputs.has_changes }} + steps: + - name: checkout + uses: actions/checkout@v4 + with: + token: ${{ secrets.GITHUB_TOKEN }} + ref: ${{ github.head_ref }} + fetch-depth: 2 + + - uses: perses/github-actions@v0.10.0 + - uses: ./.github/perses-ci/actions/setup_environment + with: + enable_npm: true + - name: install dependencies + run: npm install + + - name: check for lockfile changes + id: lockfile-changes + run: | + if git diff --quiet package-lock.json; then + echo "has_changes=false" >> $GITHUB_OUTPUT + else + echo "has_changes=true" >> $GITHUB_OUTPUT + fi + + - name: Get last commit message + id: last-commit + run: | + echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT + + - uses: stefanzweifel/git-auto-commit-action@v6 + if: steps.lockfile-changes.outputs.has_changes == 'true' + with: + commit_message: '[IGNORE] ${{ steps.last-commit.outputs.message }}' + file_pattern: 'package-lock.json' + commit_options: '--no-verify --signoff --amend' + push_options: '--force-with-lease'