From b4d50b583a5b768317e8b50ccbde68c16ecd0ea3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Sun, 20 Sep 2026 22:18:23 +0000 Subject: [PATCH 1/2] chore(ci): remove dead Codecov upload steps + lock pins Line-exact removal of dead-app CI references. --- .../examples/enterprise-service/.github/workflows/ci.yml | 2 -- .../satellites/rsr-certifier/.github/workflows/rust-ci.yml | 3 --- 2 files changed, 5 deletions(-) diff --git a/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/ci.yml b/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/ci.yml index ad148c4ac..48381a51f 100644 --- a/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/ci.yml +++ b/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/ci.yml @@ -58,5 +58,3 @@ jobs: run: cargo install cargo-tarpaulin - name: Generate coverage run: cargo tarpaulin --out Xml - - name: Upload coverage - uses: codecov/codecov-action@v3 diff --git a/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/rust-ci.yml b/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/rust-ci.yml index dff0f752d..bf09c109e 100644 --- a/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/rust-ci.yml +++ b/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/rust-ci.yml @@ -51,6 +51,3 @@ jobs: run: cargo install cargo-tarpaulin - name: Generate coverage run: cargo tarpaulin --out Xml - - uses: codecov/codecov-action@v5 - with: - files: cobertura.xml From 801642fc77c834f961a3a4e7541b5d6d35a4b07c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Sun, 20 Sep 2026 22:21:15 +0000 Subject: [PATCH 2/2] chore(ci): prune dead apps from canon allowlists; add Tailscale reusable --- .../workflows/tailscale-connect-reusable.yml | 52 +++++++++++++++++++ config/settings/actions-allowlist.json | 3 +- .../actions-allowlist/allowed-actions.json | 3 +- 3 files changed, 55 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/tailscale-connect-reusable.yml diff --git a/.github/workflows/tailscale-connect-reusable.yml b/.github/workflows/tailscale-connect-reusable.yml new file mode 100644 index 000000000..87ea31dbc --- /dev/null +++ b/.github/workflows/tailscale-connect-reusable.yml @@ -0,0 +1,52 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# tailscale-connect-reusable.yml — shared "join the tailnet" step for CI jobs that +# must reach private endpoints (internal servers, staging DBs, self-hosted +# registries) from a GitHub-hosted runner. +# +# Tailscale has no GitHub App; its GitHub integration is this Action plus a +# Tailscale OAuth client. The two secrets below must exist on the repo, org or +# environment that calls this workflow: +# TS_OAUTH_CLIENT_ID, TS_OAUTH_SECRET (Tailscale admin -> OAuth clients, scope auth_keys) +# +# Callers opt in per job; nothing here changes CI unless a workflow calls it. +name: Tailscale connect (reusable) + +on: + workflow_call: + inputs: + tags: + description: 'Tailscale tags to apply to the ephemeral CI node' + required: false + type: string + default: 'tag:ci' + ping: + description: 'Comma-separated tailnet hosts to ping for readiness' + required: false + type: string + default: '' + version: + description: 'Tailscale client version pin (empty = action default)' + required: false + type: string + default: '' + +permissions: + contents: read + +jobs: + connect: + name: Join tailnet + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + # Pinned per estate policy (SHA pins everywhere); refresh with actions-lock. + - name: Connect to Tailscale + uses: tailscale/github-action@v4 + with: + oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} + oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} + tags: ${{ inputs.tags }} + version: ${{ inputs.version }} + ping: ${{ inputs.ping }} diff --git a/config/settings/actions-allowlist.json b/config/settings/actions-allowlist.json index 8f00d2040..6cf44cfdd 100644 --- a/config/settings/actions-allowlist.json +++ b/config/settings/actions-allowlist.json @@ -28,6 +28,7 @@ "github_owned_allowed": true, "verified_allowed": true, "patterns_allowed": [ + "tailscale/github-action@*", "8398a7/action-slack@*", "actions-rust-lang/setup-rust-toolchain@*", "ad-m/github-push-action@*", @@ -121,5 +122,5 @@ "trufflesecurity/trufflehog@*", "webfactory/ssh-agent@*" ], - "enforcement_note": "verified_allowed is TRUE, so Marketplace-verified creators (Snyk, Codecov, SonarSource, Semgrep, ...) run whether or not they appear in patterns_allowed. The 118→92 prune is therefore HYGIENE: R1 is enforced by deleting the workflows in the sweep, not by this list. Flipping verified_allowed to false is a separate decision (O12) taken only after a uses: census proves every verified-creator action still in use is on patterns_allowed." + "enforcement_note": "[2026-09-20 sweep] Workflow-side Codecov/Snyk references are now deleted across both estates, so the prune recorded above is safe to apply. Caveat unchanged: verified_allowed is TRUE, so Marketplace-verified creators (Snyk, Codecov, SonarSource, Semgrep, ...) run whether or not they appear in patterns_allowed. The 118→92 prune is therefore HYGIENE: R1 is enforced by deleting the workflows in the sweep, not by this list. Flipping verified_allowed to false is a separate decision (O12) taken only after a uses: census proves every verified-creator action still in use is on patterns_allowed." } diff --git a/rhodium-standard-repositories/actions-allowlist/allowed-actions.json b/rhodium-standard-repositories/actions-allowlist/allowed-actions.json index eea64d35c..268d4ee2d 100644 --- a/rhodium-standard-repositories/actions-allowlist/allowed-actions.json +++ b/rhodium-standard-repositories/actions-allowlist/allowed-actions.json @@ -2,6 +2,7 @@ "github_owned_allowed": true, "verified_allowed": true, "patterns_allowed": [ + "tailscale/github-action@*", "8398a7/action-slack@*", "actions-rust-lang/setup-rust-toolchain@*", "ad-m/github-push-action@*", @@ -18,7 +19,6 @@ "Bogdanp/setup-racket@*", "cachix/install-nix-action@*", "cbrgm/cleanup-stale-branches-action@*", - "codecov/codecov-action@*", "cometkim/rclone-actions@*", "DavidAnson/markdownlint-cli2-action@*", "dawidd6/action-download-artifact@*", @@ -83,7 +83,6 @@ "rustsec/audit-check@*", "shivammathur/setup-php@*", "slsa-framework/slsa-github-generator@*", - "snyk/actions@*", "softprops/action-gh-release@*", "SonarSource/sonarcloud-github-action@*", "SonarSource/sonarqube-scan-action@*",