From a609a0181e84fc66bf9070c185fba01a505ca1c5 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Fri, 8 May 2026 15:19:10 +0300 Subject: [PATCH 1/2] Hopefully final check PR: https://github.com/urunc-dev/urunc_test/pull/58 Signed-off-by: Charalampos Mainas Reviewed-by: Panagiotis Mavrikos Approved-by: Panagiotis Mavrikos --- .github/workflows/add-git-trailers.yml | 43 +++++++++----------------- .github/workflows/pr-merge.yml | 21 +++++++------ .github/workflows/pr-trailers.yml | 16 ---------- 3 files changed, 26 insertions(+), 54 deletions(-) delete mode 100644 .github/workflows/pr-trailers.yml diff --git a/.github/workflows/add-git-trailers.yml b/.github/workflows/add-git-trailers.yml index 73d5f5f..59d8b51 100644 --- a/.github/workflows/add-git-trailers.yml +++ b/.github/workflows/add-git-trailers.yml @@ -1,12 +1,12 @@ name: Add Git Trailers to PR commits on: - workflow_call: - secrets: - GIT_CLONE_PAT: - required: false - URUNC_BOT_PRIVATE_KEY: - required: true + pull_request_review: + types: [submitted] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true permissions: contents: read @@ -14,16 +14,12 @@ permissions: jobs: git-trailers: name: Add Git Trailers - runs-on: ${{ matrix.runner }} - strategy: - matrix: - include: - - arch: amd64 - runner: ubuntu-22.04 - continue-on-error: true + if: >- + github.event.pull_request.base.ref == 'main' && + github.event.review.state == 'approved' + runs-on: ubuntu-22.04 permissions: contents: write - pull-requests: write steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0 @@ -40,11 +36,6 @@ jobs: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - - name: Append git trailers - uses: nubificus/git-trailers@8e08c91bb4c1fd9cb1ccbd9cc8029c31acf8da66 # feat_use_rebase - with: - user_info: .github/contributors.yaml - - name: Generate urunc-bot token id: generate-token uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 @@ -52,20 +43,16 @@ jobs: app-id: ${{ vars.URUNC_BOT_APP_ID }} private-key: ${{ secrets.URUNC_BOT_PRIVATE_KEY }} - - name: Set up Git - run: | - git config --global user.name "urunc-bot[bot]" - git config --global user.email "urunc-bot[bot]@users.noreply.github.com" - - name: Append git trailers - uses: nubificus/git-trailers@18fd322f3fbfd505b4de728974a4ac1f32f758a7 # feat_auto_merge + uses: nubificus/git-trailers@1d1595aacfd9239ae69d773cb895606daa17e538 with: - user_info: .github/contributors.yaml + token: ${{ steps.generate-token.outputs.token }} + user-info: .github/contributors.yaml - name: Merge PR env: GH_TOKEN: ${{ steps.generate-token.outputs.token }} + PR_URL: ${{ github.event.pull_request.html_url }} run: | - PR_URL=${{ github.event.pull_request.html_url }} - + sleep 5 # Wait for github to get updated with the push. Otherwise merge will fail gh pr merge "$PR_URL" --rebase --admin diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml index 1b57dfd..fa66f2f 100644 --- a/.github/workflows/pr-merge.yml +++ b/.github/workflows/pr-merge.yml @@ -4,6 +4,8 @@ on: pull_request_target: types: - closed + branches: + - 'main-pr*' permissions: contents: read @@ -11,22 +13,19 @@ permissions: jobs: add-trailers-and-merge: if: | - github.event.pull_request.merged == true && - startsWith(github.event.pull_request.base.ref, 'main-pr') + github.event.pull_request.merged == true runs-on: ubuntu-latest permissions: contents: write - steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0 with: egress-policy: audit - - name: Set up Git - run: | - git config --global user.name "urunc-bot[bot]" - git config --global user.email "urunc-bot[bot]@users.noreply.github.com" + - name: Exit if PR is not rebaseable + if: ${{ github.event.pull_request.rebaseable != null && github.event.pull_request.rebaseable == false }} + run: exit 1 - name: Check out repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -42,16 +41,18 @@ jobs: private-key: ${{ secrets.URUNC_BOT_PRIVATE_KEY }} - name: Append git trailers - uses: nubificus/git-trailers@18fd322f3fbfd505b4de728974a4ac1f32f758a7 # feat_auto_merge + uses: nubificus/git-trailers@1d1595aacfd9239ae69d773cb895606daa17e538 with: - user_info: .github/contributors.yaml + token: ${{ steps.generate-token.outputs.token }} + user-info: .github/contributors.yaml - name: Create a Pull Request from PR_BRANCH to main and merge it env: GH_TOKEN: ${{ steps.generate-token.outputs.token }} + PR_BRANCH: ${{ github.event.pull_request.base.ref }} run: | PR_BRANCH=${{ github.event.pull_request.base.ref }} - + # Create the pull request PR_URL=$(gh pr create \ --head "$PR_BRANCH" \ diff --git a/.github/workflows/pr-trailers.yml b/.github/workflows/pr-trailers.yml deleted file mode 100644 index 82fbcde..0000000 --- a/.github/workflows/pr-trailers.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: Add Git Trailers to PR commits - -on: - pull_request_review: - types: [submitted] - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - git-trailers: - name: Add Git Trailers to PR commits - if: ${{ github.event.pull_request.base.ref == 'main' && github.event.review.state == 'approved' }} - uses: ./.github/workflows/add-git-trailers.yml - secrets: inherit From 071587c976f22a04ef72af7fad17e0d5de11c1d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 12:26:08 +0000 Subject: [PATCH 2/2] chore(deps): Bump github/codeql-action from 4.32.4 to 4.35.4 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.4 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 6 +++--- .github/workflows/scorecard.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e54d214..81b44de 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -50,7 +50,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5 + uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -60,7 +60,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5 + uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -73,6 +73,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5 + uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4e964f7..eb059c0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -78,6 +78,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5 + uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5 with: sarif_file: results.sarif