diff --git a/.github/workflows/bzlmod-lock-check.yml b/.github/workflows/bzlmod-lock-check.yml deleted file mode 100644 index 9282aea..0000000 --- a/.github/workflows/bzlmod-lock-check.yml +++ /dev/null @@ -1,131 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -# Verifies that MODULE.bazel and MODULE.bazel.lock are consistent and up to date. -# -# Two checks run in parallel: -# bzlmod-tidy-check — runs `bazel mod tidy` and fails if it would change any file -# bzlmod-lockfile-check — runs `bazel mod deps --lockfile_mode=error` and fails if the -# lockfile does not match the resolved dependency graph -# -# Recommended alternative: run these checks locally via pre-commit so issues are caught -# before they reach CI. Add the following to your .pre-commit-config.yaml: -# -# - repo: local -# hooks: -# - id: bzlmod-tidy -# name: bazel mod tidy -# entry: bazel mod tidy -# language: system -# pass_filenames: false -# - id: bzlmod-lockfile -# name: bazel mod deps lockfile check -# entry: bazel mod deps --lockfile_mode=error -# language: system -# pass_filenames: false -# -# Security note: this workflow refuses to run on pull_request_target. That event has -# write access to repository secrets while checking out fork code, making it unsafe -# to execute Bazel on untrusted input. Use pull_request or schedule instead. - -name: Bazel Bzlmod Lockfile Check - -on: - workflow_call: - inputs: - working-directory: - description: "Directory containing MODULE.bazel and MODULE.bazel.lock" - required: false - default: "." - type: string - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - -jobs: - bzlmod-tidy-check: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - steps: - - name: Refuse to run on pull_request_target - if: github.event_name == 'pull_request_target' - run: | - echo "This workflow must not be called from pull_request_target." - echo "That event has write access to repo secrets while checking out fork code," - echo "making it unsafe to run bazel on untrusted input." - echo "Use pull_request or schedule instead." - exit 1 - - - uses: eclipse-score/more-disk-space@beee38c3b4426a7c43fdfeb2495d1af812179c3e # v1.3.0 - - - name: Checkout repository - uses: actions/checkout@v4.2.2 - with: - lfs: true - - - name: Setup Bazel with shared caching - uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 - with: - unique-cache-name: ${{ github.job }} - - - name: Check MODULE.bazel formatting - working-directory: ${{ inputs.working-directory }} - run: | - bazel mod tidy - git diff --exit-code - - bzlmod-lockfile-check: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - - steps: - - name: Refuse to run on pull_request_target - if: github.event_name == 'pull_request_target' - run: | - echo "This workflow must not be called from pull_request_target." - echo "That event has write access to repo secrets while checking out fork code," - echo "making it unsafe to run bazel on untrusted input." - echo "Use pull_request or schedule instead." - exit 1 - - - uses: eclipse-score/more-disk-space@beee38c3b4426a7c43fdfeb2495d1af812179c3e # v1.3.0 - - - name: Checkout repository - uses: actions/checkout@v4.2.2 - with: - lfs: true - - - name: Setup Bazel with shared caching - uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 - with: - unique-cache-name: ${{ github.job }} - - - name: Verify MODULE.bazel and MODULE.bazel.lock exist - working-directory: ${{ inputs.working-directory }} - run: | - if [ ! -f "MODULE.bazel" ]; then - echo "MODULE.bazel not found in $PWD" - exit 1 - fi - - if [ ! -f "MODULE.bazel.lock" ]; then - echo "MODULE.bazel.lock is missing. Run: bazel mod tidy" - exit 1 - fi - - - name: Check lockfile is up to date - working-directory: ${{ inputs.working-directory }} - run: bazel mod deps --lockfile_mode=error diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml deleted file mode 100644 index dc7e76f..0000000 --- a/.github/workflows/copyright.yml +++ /dev/null @@ -1,50 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -name: Copyright Check - -on: - workflow_call: - inputs: - bazel-target: - description: "Custom Bazel target to run (e.g.: 'run //:copyright-check')" - required: false - default: "run //:copyright-check" - type: string - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - -jobs: - copyright-check: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - steps: - - name: Checkout repository - uses: actions/checkout@v4.2.2 - with: - lfs: true - - - name: Setup Bazel with shared caching - uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 - with: - unique-cache-name: ${{ github.job }} - - - name: Run Copyright Check - run: | - echo "Running: bazel ${{ inputs.bazel-target }}" - bazel ${{ inputs.bazel-target }} diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 161c1b7..53396ab 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -88,12 +88,79 @@ jobs: name: Cleanup old documentation needs: detect-repo-capabilities if: needs.detect-repo-capabilities.outputs.should_run_docs_cleanup == 'true' - uses: ./.github/workflows/docs-cleanup.yml + runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} permissions: contents: write pull-requests: read pages: write id-token: write + steps: + - name: Checkout repository root for deploy context + uses: actions/checkout@v4 + with: + repository: ${{ github.repository }} + ref: gh-pages + fetch-depth: 0 + + - name: Checkout gh-pages branch + uses: actions/checkout@v4 + with: + repository: ${{ github.repository }} + ref: gh-pages + fetch-depth: 0 + path: gh-pages-cleanup + + - name: Install GitHub CLI + run: sudo apt-get update && sudo apt-get install -y gh jq + + - name: Cleanup old documentation + working-directory: gh-pages-cleanup + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + + gh auth status + + ACTIVE_BRANCHES=$(gh api --paginate repos/${{ github.repository }}/branches --jq '.[].name') + OPEN_PRS=$(gh api --paginate repos/${{ github.repository }}/pulls --jq '.[] | "pr-\(.number)"') + TAGS=$(gh api --paginate repos/${{ github.repository }}/tags --jq '.[].name') + VALID_ENTRIES=$(echo -e "$ACTIVE_BRANCHES\n$OPEN_PRS\n$TAGS") + CURRENT_FOLDERS=$(find . -maxdepth 1 -type d -not -name '.' -not -path './.*' -exec basename {} \;) + + if [[ -f versions.json ]]; then + jq '.' versions.json > versions_tmp.json + else + echo "[]" > versions_tmp.json + fi + + for FOLDER in $CURRENT_FOLDERS; do + if ! echo "$VALID_ENTRIES" | grep -Fxq "$FOLDER"; then + echo "Removing $FOLDER" + rm -rf "$FOLDER" + jq --arg ver "$FOLDER" 'map(select(.version != $ver))' versions_tmp.json > tmp.json && mv tmp.json versions_tmp.json + fi + done + + jq '[.[] | select((.version | IN($folders[])))]' --argjson folders "$(ls -1 | jq -R -s -c 'split("\n")[:-1]')" versions_tmp.json > versions_tmp_clean.json + + jq --arg repo "${{ github.repository }}" \ + --arg owner "${{ github.repository_owner }}" \ + '[.[] | select(.version != "main")] + | sort_by(.version) + | [{"version":"main", + "url":("https://" + $owner + ".github.io/" + ($repo | split("/")[1]) + "/main/")}] + + .' \ + versions_tmp_clean.json > versions.json + + rm versions_tmp.json versions_tmp_clean.json + + - name: Commit and Push Changes + uses: JamesIves/github-pages-deploy-action@v4 + with: + branch: gh-pages + folder: gh-pages-cleanup + commit-message: "Daily cleanup of outdated documentation" cache-cleanup: name: Cleanup old caches diff --git a/.github/workflows/docs-cleanup.yml b/.github/workflows/docs-cleanup.yml deleted file mode 100644 index 8cdd1b0..0000000 --- a/.github/workflows/docs-cleanup.yml +++ /dev/null @@ -1,118 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -name: Daily Documentation Cleanup - -permissions: - contents: write - pull-requests: read - pages: write - id-token: write - -on: - workflow_call: - inputs: - deployment_type: - description: "Type of deployment: legacy or workflow" - type: string - required: false - default: "workflow" - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - secrets: - token: - description: "deprecated, not used." - required: false - -jobs: - docs-cleanup: - name: Cleanup old documentation - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - permissions: - pages: write - contents: write - pull-requests: read - id-token: write - steps: - - name: Checkout repository root for deploy context - uses: actions/checkout@v4 - with: - repository: ${{ github.repository }} - ref: gh-pages - fetch-depth: 0 - - - name: Checkout gh-pages branch - uses: actions/checkout@v4 - with: - repository: ${{ github.repository }} - ref: gh-pages - fetch-depth: 0 - path: gh-pages-cleanup - - - name: Install GitHub CLI - run: sudo apt-get update && sudo apt-get install -y gh jq - - - name: Cleanup old documentation - working-directory: gh-pages-cleanup - env: - GH_TOKEN: ${{ github.token }} - run: | - set -euo pipefail - - gh auth status - - ACTIVE_BRANCHES=$(gh api --paginate repos/${{ github.repository }}/branches --jq '.[].name') - OPEN_PRS=$(gh api --paginate repos/${{ github.repository }}/pulls --jq '.[] | "pr-\(.number)"') - TAGS=$(gh api --paginate repos/${{ github.repository }}/tags --jq '.[].name') - VALID_ENTRIES=$(echo -e "$ACTIVE_BRANCHES\n$OPEN_PRS\n$TAGS") - CURRENT_FOLDERS=$(find . -maxdepth 1 -type d -not -name '.' -not -path './.*' -exec basename {} \;) - - if [[ -f versions.json ]]; then - jq '.' versions.json > versions_tmp.json - else - echo "[]" > versions_tmp.json - fi - - for FOLDER in $CURRENT_FOLDERS; do - if ! echo "$VALID_ENTRIES" | grep -Fxq "$FOLDER"; then - echo "Removing $FOLDER" - rm -rf "$FOLDER" - jq --arg ver "$FOLDER" 'map(select(.version != $ver))' versions_tmp.json > tmp.json && mv tmp.json versions_tmp.json - fi - done - - jq '[.[] | select((.version | IN($folders[])))]' --argjson folders "$(ls -1 | jq -R -s -c 'split("\n")[:-1]')" versions_tmp.json > versions_tmp_clean.json - - jq --arg repo "${{ github.repository }}" \ - --arg owner "${{ github.repository_owner }}" \ - '[.[] | select(.version != "main")] - | sort_by(.version) - | [{"version":"main", - "url":("https://" + $owner + ".github.io/" + ($repo | split("/")[1]) + "/main/")}] - + .' \ - versions_tmp_clean.json > versions.json - - rm versions_tmp.json versions_tmp_clean.json - - - name: Commit and Push Changes - uses: JamesIves/github-pages-deploy-action@v4 - with: - branch: gh-pages - folder: gh-pages-cleanup - commit-message: "Daily cleanup of outdated documentation" diff --git a/.github/workflows/docs-verify.yml b/.github/workflows/docs-verify.yml deleted file mode 100644 index bfbcbc9..0000000 --- a/.github/workflows/docs-verify.yml +++ /dev/null @@ -1,74 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -name: Documentation Verification - -on: - workflow_call: - inputs: - bazel-docs-verify-target: - description: "Bazel target for docs verification" - required: false - type: string - default: "//:docs_check" - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - outputs: - verification-result: - description: "Result of the docs verification" - value: ${{ jobs.docs-verify.outputs.verification-result }} - -env: - CACHE_KEY_PREFIX: bazel-cache - -jobs: - docs-verify: - name: Docs Verification - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - outputs: - verification-result: ${{ steps.verify.outcome }} - permissions: - contents: read - steps: - - uses: eclipse-score/more-disk-space@beee38c3b4426a7c43fdfeb2495d1af812179c3e # v1.3.0 - with: - level: 3 - - - name: Checkout repository (Handle all events) - uses: actions/checkout@v4.2.2 - with: - lfs: true - ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} - - - name: Setup Bazel - uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 - with: - unique-cache-name: ${{ github.job }} - - - name: Install Graphviz - uses: eclipse-score/apt-install@main - with: - packages: graphviz - cache: false - - - name: Run docs verification - id: verify - run: | - bazel run ${{ inputs.bazel-docs-verify-target }} diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml deleted file mode 100644 index 122cd50..0000000 --- a/.github/workflows/format.yml +++ /dev/null @@ -1,51 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* -name: Formatting Check - -on: - workflow_call: - inputs: - bazel-target: - description: "Custom Bazel target to run (e.g.: 'test //:format.check')" - required: false - default: "test --test_output=errors //:format.check" - type: string - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - -jobs: - format-check: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - steps: - - uses: eclipse-score/more-disk-space@beee38c3b4426a7c43fdfeb2495d1af812179c3e # v1.3.0 - - - name: Checkout repository - uses: actions/checkout@v4.2.2 - with: - lfs: true - - - name: Setup Bazel with shared caching - uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 - with: - unique-cache-name: ${{ github.job }} - - - name: Run Formatting Check - run: | - echo "Running: bazel ${{ inputs.bazel-target }}" - bazel ${{ inputs.bazel-target }} diff --git a/.github/workflows/score-pr-checks.yml b/.github/workflows/score-pr-checks.yml deleted file mode 100644 index cce3ffa..0000000 --- a/.github/workflows/score-pr-checks.yml +++ /dev/null @@ -1,73 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -name: SCORE PR Checks - -on: - workflow_call: - inputs: - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - -jobs: - bazel-module-name-check: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - lfs: true - - - name: Check MODULE.bazel and validate module name - run: | - # Check if MODULE.bazel exists - if [ ! -f "MODULE.bazel" ]; then - echo "ℹ️ MODULE.bazel file not found in repository root - skipping Bazel module validation" - exit 0 - fi - - echo "✅ MODULE.bazel file found" - - # Extract module name from MODULE.bazel - if ! MODULE_LINE=$(grep '^module(' MODULE.bazel | head -1); then - echo "❌ No module declaration found in MODULE.bazel" - exit 1 - fi - - # Extract the module name from the module() declaration - MODULE_NAME=$(echo "$MODULE_LINE" | sed 's/^module([[:space:]]*name[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/' | sed 's/^module([[:space:]]*"\([^"]*\)".*/\1/') - - # Alternative extraction method if the above doesn't work - if [[ -z "$MODULE_NAME" || "$MODULE_NAME" == "$MODULE_LINE" ]]; then - MODULE_NAME=$(echo "$MODULE_LINE" | grep -o '"[^"]*"' | head -1 | tr -d '"') - fi - - echo "Found module name: $MODULE_NAME" - - # Validate against the required regex pattern - if [[ ! "$MODULE_NAME" =~ ^score_[[:lower:]_]+$ ]]; then - echo "❌ Invalid module name: $MODULE_NAME" - echo "Module name must match the pattern: ^score_[[:lower:]_]+$" - echo " - Must start with 'score_'" - echo " - Must contain only lowercase letters and underscores after 'score_'" - echo "Examples of valid names: score_cli, score_compose, score_web_api" - exit 1 - fi - - echo "✅ Module name is valid: $MODULE_NAME" diff --git a/.github/workflows/template-sync.yml b/.github/workflows/template-sync.yml deleted file mode 100644 index 40ea444..0000000 --- a/.github/workflows/template-sync.yml +++ /dev/null @@ -1,62 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -name: Sync with eclipse-score/module_template repository -on: - workflow_call: - inputs: - pr_title: - description: "Title for the template sync pull request" - type: string - default: "[Template Sync] Upstream template update" - pr_commit_msg: - description: "Commit message for the template sync" - type: string - default: "chore(template): upstream template update" - template_sync_ignore_file_path: - description: "Path to the template sync ignore file" - type: string - default: ".github/.templatesyncignore" - runner-labels: - description: >- - Runner label(s) for this workflow's jobs, overriding the repository/organization runner - variables. Must be a JSON-encoded string: a single label as a JSON string (e.g. - '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]'). - required: false - default: "" - type: string - -jobs: - repo-sync: - runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }} - permissions: - contents: write - pull-requests: write - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - token: ${{ secrets.GITHUB_TOKEN }} - persist-credentials: false # - - name: Sync Template Changes - uses: AndreasAugustin/actions-template-sync@v2.5.3 - with: - source_gh_token: ${{ secrets.SCORE_APPROVALS_PAT}} - target_gh_token: ${{ secrets.SCORE_APPROVALS_PAT}} - source_repo_path: "eclipse-score/module_template" - upstream_branch: "main" - pr_title: ${{ inputs.pr_title }} - pr_commit_msg: ${{ inputs.pr_commit_msg }} - git_user_name: eclipse-score-bot - git_user_email: 187756813+eclipse-score-bot@users.noreply.github.com - template_sync_ignore_file_path: ${{ inputs.template_sync_ignore_file_path }} diff --git a/README.md b/README.md index f8b1a6c..6eddb77 100644 --- a/README.md +++ b/README.md @@ -12,68 +12,43 @@ These workflows integrate with **Bazel** and provide a consistent way to run **d | **[Bazel Cache Maintenance](.github/workflows/cache-maintenance.md)** | Maintains lockfile-keyed repository and job-specific Bazel caches | | **[Documentation](.github/workflows/docs.md)** | Builds and securely publishes documentation to GitHub Pages | | **[Daily Maintenance](.github/workflows/daily.md)** | Handles stale pull requests, cleans old documentation, and prunes obsolete caches | -| **Documentation Cleanup** | Cleans up old documentation versions from the `gh-pages` branch | | **License Check** | Verifies OSS licenses and compliance | | **Static Code Analysis** | Runs Clang-Tidy, Clippy, Pylint, and other linters | | **Tests** | Executes tests using GoogleTest, Rust test, or pytest | | **Rust Coverage** | Computes Rust code coverage and uploads HTML reports | | **C++ Coverage** | Computes C++ code coverage using LCOV and uploads HTML reports | -| **Formatting Check** | Verifies code formatting using Bazel-based tools | -| **Copyright Check** | Ensures all source files have the required copyright headers | | **Required Approvals** | Enforces stricter CODEOWNERS rules for multi-team approvals | | **QNX Build (Gated)** | Builds QNX Bazel targets with environment-gated secrets for forks | -| **Documentation Verification** | Verifies documentation builds correctly and uploads results | | **CodeQL Scan** | Performs security and quality analysis using GitHub CodeQL | -| **SCORE PR Checks** | Validates Bazel module naming conventions in pull requests | -| **Bzlmod Lockfile Check** | Enforces `MODULE.bazel.lock` consistency via `bazel mod tidy` | -| **Template Sync** | Synchronizes repository with eclipse-score/module_template | --- -## Using the Workflows in Your Repository - -To use a reusable workflow, create a workflow file inside **your repository** (e.g., `.github/workflows/ci.yml`) and reference the appropriate workflow from this repository. - -See the [Documentation workflows](.github/workflows/docs.md) guide for the -separate build and publishing workflows. +## Removed Workflows -### **1. Documentation Cleanup Workflow - DEPRECATED** -*Deprecated: This workflow is now integrated into the `Daily Maintenance` workflow. Use that workflow instead.* +The following standalone workflows were removed because their functionality is now +covered by `on-pr.yml` or `daily.yml`. Existing callers must migrate to the +replacement workflow. -**Usage Example** -```yaml -name: Documentation Cleanup +| Removed workflow | Covered by | Notes | +| ------------------------ | ------------------------------ | --------------------------------------------------------------------------------------------------------- | +| `bzlmod-lock-check.yml` | `on-pr.yml` | Runs the same `bazel mod tidy` + `bazel mod deps --lockfile_mode=error` checks whenever `MODULE.bazel.lock` exists. | +| `copyright.yml` | `on-pr.yml` | Runs `bazel run //:copyright.check` whenever that target exists. | +| `docs-cleanup.yml` | `daily.yml` | Already deprecated; `daily.yml` performs the cleanup itself when GitHub Pages is enabled. | +| `docs-verify.yml` | `docs.yml` | `docs.yml`'s build step (`bazel run //:docs`) already fails the job if the documentation does not build. | +| `format.yml` | `on-pr.yml` | Runs `bazel test //:format.check` whenever that target exists. | +| `score-pr-checks.yml` | `on-pr.yml` | Same module-name validation logic; currently disabled in `on-pr.yml` pending a fix to the detection script. | +| `template-sync.yml` | _none_ | No longer needed; removed without replacement. | -on: - schedule: - - cron: '0 2 * * *' # every day at 2am UTC - -permissions: - contents: write - pull-requests: read - pages: write - id-token: write - -jobs: - docs-cleanup: - # Pin a version via vX.Y.Z tag or even better via a commit SHA for immutability. - # Treat @main as experimental! - uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@vX.Y.Z - with: - workflow-version: main - secrets: - token: ${{ secrets.GITHUB_TOKEN }} -``` +--- -This workflow: +## Using the Workflows in Your Repository -✅ Cleans up old documentation versions from the `gh-pages` branch -✅ Runs daily at 2am UTC -✅ Is intended for repositories with GitHub Pages enabled +To use a reusable workflow, create a workflow file inside **your repository** (e.g., `.github/workflows/ci.yml`) and reference the appropriate workflow from this repository. ---- +See the [Documentation workflows](.github/workflows/docs.md) guide for the +separate build and publishing workflows. -### **2. License Check Workflow** +### **1. License Check Workflow** **Usage Example** ```yaml name: License Check CI @@ -105,7 +80,7 @@ This workflow: --- -### **3. Static Code Analysis Workflow** +### **2. Static Code Analysis Workflow** **Usage Example** ```yaml name: Static Analysis CI @@ -138,7 +113,7 @@ Inputs: --- -### **4. Tests Workflow** +### **3. Tests Workflow** **Usage Example** ```yaml name: Test CI @@ -161,7 +136,7 @@ This workflow: --- -### **5. Rust Coverage Workflow** +### **4. Rust Coverage Workflow** **Usage Example** ```yaml name: Rust Coverage CI @@ -190,7 +165,7 @@ This workflow: --- -### **6. C++ Coverage Workflow** +### **5. C++ Coverage Workflow** **Usage Example** ```yaml name: C++ Coverage CI @@ -213,60 +188,7 @@ jobs: --- -### **7. Copyright Check Workflow** -**Usage Example** -```yaml -name: Copyright Check CI - -on: - pull_request: - push: - branches: - - main - -jobs: - copyright-check: - uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@main - with: - bazel-target: "run //:copyright-check" # optional, this is the default -``` - -This workflow: -✅ Runs a **Bazel-based copyright** -✅ Ensures all source files have **Eclipse Foundation** headers - -> ℹ️ **Note:** You can override the Bazel command using the `bazel-target` input. -> **Default:** `run //:copyright-check` - ---- - -### **8. Formatting Check Workflow** -**Usage Example** -```yaml -name: Formatting Check CI - -on: - pull_request: - merge_group: - types: [checks_requested] - -jobs: - formatting-check: - uses: eclipse-score/cicd-workflows/.github/workflows/format-check.yml@main - with: - bazel-target: "test //:format.check" # optional, this is the default -``` - -This workflow: -✅ Runs a **Bazel-based formatting check** (e.g., `buildifier`, `clang-format`, etc.) -✅ Can be integrated into Pull Requests and Merge Queues -✅ Ensures code adheres to formatting rules before merge - -> ℹ️ **Note:** You can override the Bazel command using the `bazel-target` input. -> **Default:** `test //:format.check` - ---- -### **9. Required Approvals Workflow** +### **6. Required Approvals Workflow** This workflow enforces **stricter CODEOWNERS checks** than GitHub’s defaults. Normally, GitHub requires approval from *any one* codeowner when multiple are listed. @@ -309,7 +231,7 @@ jobs: --- -### **10. QNX Build (Gated) Workflow** +### **7. QNX Build (Gated) Workflow** Use this workflow when you need QNX secrets for forked PRs and want a manual approval gate via an environment. @@ -347,38 +269,7 @@ jobs: --- -### **11. Documentation Verification Workflow** - -This workflow verifies that documentation builds correctly and can be used to validate documentation changes in pull requests. - -**Usage Example** - -```yaml -name: Documentation Verification - -on: - pull_request: - types: [opened, reopened, synchronize] - -jobs: - docs-verify: - uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@main - with: - bazel-docs-verify-target: "//:docs_check" # optional, default shown -``` - -**Defaults** -- `bazel-docs-verify-target`: `//:docs_check` - -**Key Features** -✅ Verifies documentation builds successfully -✅ Uses Bazel-based documentation checks -✅ Provides verification result as output -✅ Integrates with Bazel shared caching for performance - ---- - -### **12. CodeQL Security Scan Workflow** +### **8. CodeQL Security Scan Workflow** This workflow performs security and quality analysis using GitHub's CodeQL with MISRA C++ coding standards. @@ -414,136 +305,6 @@ jobs: --- -### **13. SCORE PR Checks Workflow** - -This workflow enforces SCORE-specific standards, particularly Bazel module naming conventions. - -**Usage Example** - -```yaml -name: PR Checks - -on: - pull_request: - branches: [main] - -jobs: - score-checks: - uses: eclipse-score/cicd-workflows/.github/workflows/score-pr-checks.yml@main -``` - -**No inputs required** - -**Key Features** -✅ Validates Bazel module names follow the pattern `^score_[[:lower:]_]+$` -✅ Ensures module names start with `score_` -✅ Allows only lowercase letters and underscores -✅ Skips validation if no `MODULE.bazel` file exists - -**Examples of valid module names:** -- `score_cli` -- `score_compose` -- `score_web_api` - ---- - -### **14. Template Sync Workflow** - -This workflow automatically synchronizes your repository with the latest changes from `eclipse-score/module_template`. - -**Usage Example** - -```yaml -name: Template Sync - -on: - schedule: - - cron: '0 0 * * 0' # Weekly on Sunday - workflow_dispatch: - -jobs: - template-sync: - uses: eclipse-score/cicd-workflows/.github/workflows/template-sync.yml@main - with: - pr_title: "[Template Sync] Upstream template update" # optional, default shown - pr_commit_msg: "chore(template): upstream template update" # optional, default shown - template_sync_ignore_file_path: ".github/.templatesyncignore" # optional, default shown - secrets: - SCORE_APPROVALS_PAT: ${{ secrets.SCORE_APPROVALS_PAT }} -``` - -**Defaults** -- `pr_title`: `[Template Sync] Upstream template update` -- `pr_commit_msg`: `chore(template): upstream template update` -- `template_sync_ignore_file_path`: `.github/.templatesyncignore` - -**Key Features** -✅ Automatically creates PRs with template updates -✅ Respects `.templatesyncignore` file to exclude specific files -✅ Uses `SCORE_APPROVALS_PAT` secret for authentication -✅ Configurable PR titles and commit messages -✅ Can be triggered on schedule or manually - -> ℹ️ **Note:** This workflow requires the `SCORE_APPROVALS_PAT` secret with appropriate permissions to create pull requests. - ---- - -### **15. Bzlmod Lockfile Check Workflow** - -This workflow keeps `MODULE.bazel` and `MODULE.bazel.lock` consistent and reproducible. Two checks run in parallel: - -- **`bzlmod-tidy-check`** — runs `bazel mod tidy` and fails if it would change any file, meaning `MODULE.bazel` has formatting or dependency declarations that are not normalized -- **`bzlmod-lockfile-check`** — runs `bazel mod deps --lockfile_mode=error` and fails if the committed lockfile does not match the resolved dependency graph, meaning the lockfile is stale - -> ⚠️ **Security:** this workflow refuses to run when called from `pull_request_target`. That event has write access to repository secrets while checking out fork code, making it unsafe to execute Bazel on untrusted input. Use `pull_request` or `schedule` instead. - -> 💡 **Recommendation:** run these checks locally via [pre-commit](https://pre-commit.com/) so issues are caught before they reach CI: -> -> ```yaml -> - repo: local -> hooks: -> - id: bzlmod-tidy -> name: bazel mod tidy -> entry: bazel mod tidy -> language: system -> pass_filenames: false -> - id: bzlmod-lockfile -> name: bazel mod deps lockfile check -> entry: bazel mod deps --lockfile_mode=error -> language: system -> pass_filenames: false -> ``` - -**Usage Example** - -```yaml -name: Bzlmod Lockfile Check - -on: - pull_request: - push: - branches: - - main - -jobs: - bzlmod-lock: - uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main - with: - working-directory: . # optional, this is the default -``` - -**Defaults** -- `working-directory`: `.` - -This workflow: -✅ Fails if `MODULE.bazel.lock` is missing -✅ Fails if `bazel mod tidy` would change `MODULE.bazel` or `MODULE.bazel.lock` -✅ Fails if `bazel mod deps --lockfile_mode=error` reports a stale or inconsistent lockfile -✅ Reports both failures independently in the PR checks UI - ---- - - ## How to Update Workflows Since these workflows are centralized, updates in the `cicd-workflows` repository will **automatically apply to all repositories using them**. If you need a specific version, reference a **tagged release** instead of `main`: ```yaml