-
Notifications
You must be signed in to change notification settings - Fork 2k
Consolidate CI workflows into a single entry point #836
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,37 @@ | ||||||||||||
| # Orchestrates all CI workflows - runs on PRs, pushes to main, and manual dispatch | ||||||||||||
| # Individual test workflows are called as reusable workflows | ||||||||||||
| name: CI All | ||||||||||||
|
|
||||||||||||
| on: | ||||||||||||
| push: | ||||||||||||
| branches: | ||||||||||||
| - main | ||||||||||||
| pull_request: | ||||||||||||
| workflow_dispatch: | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SECURITY: Missing explicit permission declarations. When no permissions are declared, workflows get default read-all permissions for GITHUB_TOKEN. Recommendation: Add explicit minimal permissions:
Suggested change
This follows the principle of least privilege and ensures called workflows don't have more permissions than necessary. |
||||||||||||
|
|
||||||||||||
| permissions: | ||||||||||||
| contents: read | ||||||||||||
|
|
||||||||||||
| jobs: | ||||||||||||
| ci: | ||||||||||||
| uses: ./.github/workflows/ci.yml | ||||||||||||
|
|
||||||||||||
| test-base-action: | ||||||||||||
| uses: ./.github/workflows/test-base-action.yml | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding a brief comment explaining why
Suggested change
This clarifies the security implications and dependencies. |
||||||||||||
| secrets: inherit # Required for ANTHROPIC_API_KEY | ||||||||||||
|
|
||||||||||||
| test-custom-executables: | ||||||||||||
| uses: ./.github/workflows/test-custom-executables.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-mcp-servers: | ||||||||||||
| uses: ./.github/workflows/test-mcp-servers.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-settings: | ||||||||||||
| uses: ./.github/workflows/test-settings.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-structured-output: | ||||||||||||
| uses: ./.github/workflows/test-structured-output.yml | ||||||||||||
| secrets: inherit | ||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,8 @@ | ||
| name: CI | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| test: | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -8,10 +8,23 @@ on: | |||||||||||||||||||||
| required: false | ||||||||||||||||||||||
| type: boolean | ||||||||||||||||||||||
| default: false | ||||||||||||||||||||||
| workflow_run: | ||||||||||||||||||||||
| workflows: ["CI All"] | ||||||||||||||||||||||
| types: | ||||||||||||||||||||||
| - completed | ||||||||||||||||||||||
| branches: | ||||||||||||||||||||||
| - main | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||
| create-release: | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| # Run if: manual dispatch OR (CI All succeeded AND commit is a version bump) | ||||||||||||||||||||||
| if: | | ||||||||||||||||||||||
| github.event_name == 'workflow_dispatch' || | ||||||||||||||||||||||
| (github.event.workflow_run.conclusion == 'success' && | ||||||||||||||||||||||
| github.event.workflow_run.head_branch == 'main' && | ||||||||||||||||||||||
| github.event.workflow_run.event == 'push' && | ||||||||||||||||||||||
| startsWith(github.event.workflow_run.head_commit.message, 'chore: bump Claude Code to')) | ||||||||||||||||||||||
|
Comment on lines
+22
to
+27
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SECURITY: The Attack vector: A malicious PR could craft a commit message starting with "chore: bump Claude Code to" and potentially trigger a release if the branch filter is bypassed. Recommendation: Add explicit branch and event type verification:
Suggested change
This adds defense-in-depth by verifying:
|
||||||||||||||||||||||
| environment: production | ||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||
| contents: write | ||||||||||||||||||||||
|
|
@@ -84,7 +97,8 @@ jobs: | |||||||||||||||||||||
|
|
||||||||||||||||||||||
| update-major-tag: | ||||||||||||||||||||||
| needs: create-release | ||||||||||||||||||||||
| if: ${{ !inputs.dry_run }} | ||||||||||||||||||||||
| # Skip for dry runs (workflow_run events are never dry runs) | ||||||||||||||||||||||
| if: github.event_name == 'workflow_run' || !inputs.dry_run | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| environment: production | ||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider adding a brief header comment explaining the orchestrator role:
This helps future maintainers understand the purpose of this workflow at a glance.