Weekly release: staging → main

.github/actionlint.yaml

@@ -0,0 +1,8 @@
+# actionlint needs to be told about self-hosted runner labels, or every
+# `runs-on:` referring to one is an error and the real findings drown in noise.
+#
+#   mdb-dev, mdb-prod  the org's self-hosted runner pools
+self-hosted-runner:
+  labels:
+    - mdb-dev
+    - mdb-prod

.github/workflows/cla.yml

@@ -14,15 +14,7 @@ on:
 
 jobs:
   CLAssistant:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "CLA Assistant"
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          path-to-signatures: 'assets/contributions-agreement/signatures/cla.json'
-          path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md'
-          branch: 'cla'
-          allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, hamishfagg, MinuraPunchihewa, martyna-mindsdb, tino097, lucas-koontz
+    uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main
+    with:
+      path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md'
+      allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, hamishfagg, MinuraPunchihewa, martyna-mindsdb, tino097, lucas-koontz

.github/workflows/docs.yml

@@ -47,3 +47,20 @@ jobs:
     steps:
       - id: deployment
         uses: actions/deploy-pages@v4
+
+  notify:
+    # Alert the eng channel if the docs build or Pages deploy fails.
+    # One job covers both outcomes: a `uses:` job cannot branch on status, so
+    # the aggregate result picks the failed or recovered message, and a
+    # cancelled run stays silent.
+    needs: [build, deploy]
+    if: ${{ !cancelled() && !contains(needs.*.result, 'cancelled') }}
+    permissions:
+      contents: read
+      actions: read  # the prior-run lookup behind the recovery message
+    uses: mindsdb/github-actions/.github/workflows/notify-main-failure.yml@main
+    with:
+      env-name: "docs deploy"
+      status: ${{ contains(needs.*.result, 'failure') && 'failed' || 'recovered' }}
+      runs-on: ubuntu-latest
+    secrets: inherit

.github/workflows/pipeline-watchdog.yml

@@ -0,0 +1,46 @@
+# Alert when a deploy pipeline concluded WITHOUT EVER STARTING.
+#
+# The panic-alert job in each pipeline is a job inside that pipeline, so it covers
+# every failure where the run exists. It cannot cover
+# `conclusion: startup_failure` — GitHub rejecting the run at load time, with zero
+# jobs — because there is no job to put the alert in. The run appears in the
+# Actions tab and nowhere else, and the branch is not deployed.
+#
+# It is not hypothetical. In mindsdb/auth a caller job granted narrower
+# `permissions:` than a called workflow's jobs declared, two pushes to `staging`
+# were rejected before scheduling, and staging served the previous image for ten
+# hours with nothing said. The shared `workflow-lint.yml` gate stops that
+# particular cause reaching a deploy branch; this watchdog notices the next one,
+# whatever it is.
+#
+# Alerts repeat by design — roughly three per failing push at this cadence and
+# window, then silence. A stateless sweep cannot be exactly-once, and a missed
+# alert is the failure being fixed.
+#
+# Note it only runs once merged to `main`: GitHub runs `schedule` triggers from the
+# default branch alone. `workflow_dispatch` is how to prove it before then, and
+# widening the window on a dispatch replays a past incident.
+
+name: Pipeline watchdog
+
+on:
+  schedule:
+    - cron: "*/30 * * * *"
+  workflow_dispatch:
+    inputs:
+      lookback-minutes:
+        description: "Widen to replay a past incident"
+        type: number
+        default: 90
+
+jobs:
+  startup-failures:
+    permissions:
+      contents: read
+      actions: read # run + job history for the sweep
+    uses: mindsdb/github-actions/.github/workflows/notify-startup-failure.yml@main
+    with:
+      branches: "main staging"
+      lookback-minutes: ${{ inputs.lookback-minutes && fromJson(inputs.lookback-minutes) || 90 }}
+      runs-on: ubuntu-latest
+    secrets: inherit

.github/workflows/release.yml

@@ -12,54 +12,12 @@ concurrency:
   group: auto-release-${{ github.ref }}
   cancel-in-progress: false
 
-env:
-  CALVER_MAJOR: 2
-
 jobs:
   auto-release:
-    runs-on: ubuntu-latest
-    outputs:
-      tag: ${{ steps.version.outputs.tag }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # need tags for sequence calculation
-
-      - name: Compute CalVer version
-        id: version
-        run: |
-          set -euo pipefail
-
-          MAJOR=${{ env.CALVER_MAJOR }}
-          YY=$(date -u +%y)    # e.g. 26
-          M=$(date -u +%-m)    # e.g. 6 (no zero-pad)
-          DD=$(date -u +%-d)   # e.g. 23 (no zero-pad)
-
-          # Find the highest sequence for today's date
-          PREFIX="v${MAJOR}.${YY}.${M}.${DD}."
-          SEQ=0
-          for tag in $(git tag -l "${PREFIX}*" | sort -t. -k5 -n); do
-            N="${tag##*.}"
-            if [[ "$N" =~ ^[0-9]+$ ]] && [ "$N" -gt "$SEQ" ]; then
-              SEQ="$N"
-            fi
-          done
-          SEQ=$((SEQ + 1))
-
-          VERSION="${MAJOR}.${YY}.${M}.${DD}.${SEQ}"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Computed version: ${VERSION}"
-
-      - name: Create tag and GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git tag "${{ steps.version.outputs.tag }}"
-          git push origin "${{ steps.version.outputs.tag }}"
-          gh release create "${{ steps.version.outputs.tag }}" \
-            --generate-notes \
-            --title "${{ steps.version.outputs.tag }}"
+    uses: mindsdb/github-actions/.github/workflows/calver-release.yml@main
+    with:
+      calver-major: "2"
+      runs-on: ubuntu-latest
 
   publish:
     name: Publish to PyPI
@@ -93,3 +51,21 @@ jobs:
     with:
       tag: ${{ needs.auto-release.outputs.tag }}
     secrets: inherit
+
+  notify:
+    # Alert the eng channel if ANY job in the release pipeline fails (tag, PyPI
+    # publish, or release e2e).
+    # One job covers both outcomes: a `uses:` job cannot branch on status, so
+    # the aggregate result picks the failed or recovered message, and a
+    # cancelled run stays silent.
+    needs: [auto-release, publish, e2e]
+    if: ${{ !cancelled() && !contains(needs.*.result, 'cancelled') }}
+    permissions:
+      contents: read
+      actions: read  # the prior-run lookup behind the recovery message
+    uses: mindsdb/github-actions/.github/workflows/notify-main-failure.yml@main
+    with:
+      env-name: "release"
+      status: ${{ contains(needs.*.result, 'failure') && 'failed' || 'recovered' }}
+      runs-on: ubuntu-latest
+    secrets: inherit

.github/workflows/staging-freeze.yml

@@ -13,3 +13,22 @@ jobs:
   freeze:
     uses: mindsdb/github-actions/.github/workflows/release-freeze.yml@75df118f3b003625052c4f14e7b90817fb8b2784 # v1
     secrets: inherit
+
+  notify:
+    # Alert the eng channel if the freeze fails (e.g. missing ruleset) — otherwise
+    # a broken freeze is silent and the code-freeze window never opens.
+    needs: [freeze]
+    if: failure()
+    permissions:
+      contents: read
+      # Declared even though this caller never runs the prior-run lookup: a
+      # reusable workflow's requested permissions are validated when the file
+      # is parsed, not when the step that needs them runs, so a caller that
+      # grants less than the reusable asks for is INVALID rather than merely
+      # degraded, and the whole workflow fails to load.
+      actions: read
+    uses: mindsdb/github-actions/.github/workflows/notify-main-failure.yml@main
+    with:
+      env-name: "staging freeze"
+      runs-on: ubuntu-latest
+    secrets: inherit

.github/workflows/staging-unfreeze.yml

@@ -17,3 +17,22 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     uses: mindsdb/github-actions/.github/workflows/release-unfreeze.yml@75df118f3b003625052c4f14e7b90817fb8b2784 # v1
     secrets: inherit
+
+  notify:
+    # Alert the eng channel if the unfreeze or main->staging sync-back fails —
+    # otherwise staging stays frozen (or drifts from main) with no signal.
+    needs: [unfreeze]
+    if: failure()
+    permissions:
+      contents: read
+      # Declared even though this caller never runs the prior-run lookup: a
+      # reusable workflow's requested permissions are validated when the file
+      # is parsed, not when the step that needs them runs, so a caller that
+      # grants less than the reusable asks for is INVALID rather than merely
+      # degraded, and the whole workflow fails to load.
+      actions: read
+    uses: mindsdb/github-actions/.github/workflows/notify-main-failure.yml@main
+    with:
+      env-name: "staging unfreeze"
+      runs-on: ubuntu-latest
+    secrets: inherit

.github/workflows/tests.yml

@@ -26,3 +26,21 @@ jobs:
 
       - name: Run E2E tests (stub)
         run: uv run --extra dev pytest tests/e2e/ -v
+
+  notify:
+    # Alert the eng channel if CI fails on a direct push to main/staging. PR runs
+    # are skipped — the author sees those directly.
+    # One job covers both outcomes: a `uses:` job cannot branch on status, so
+    # the aggregate result picks the failed or recovered message, and a
+    # cancelled run stays silent.
+    needs: [run-tests]
+    if: ${{ !cancelled() && !contains(needs.*.result, 'cancelled') && github.event_name == 'push' }}
+    permissions:
+      contents: read
+      actions: read  # the prior-run lookup behind the recovery message
+    uses: mindsdb/github-actions/.github/workflows/notify-main-failure.yml@main
+    with:
+      env-name: "CI"
+      status: ${{ contains(needs.*.result, 'failure') && 'failed' || 'recovered' }}
+      runs-on: ubuntu-latest
+    secrets: inherit

README.md

@@ -317,6 +317,11 @@ Anton uses an automated release flow. The single source of truth for the package
    - Publishes a GitHub release with auto-generated notes.
    - Triggers [`tests_e2e_release.yml`](.github/workflows/tests_e2e_release.yml) to run live e2e tests against the released version.
 
+The version computation, tag push, and release creation are shared with the other
+service repos through the `calver-release.yml` reusable workflow in
+[mindsdb/github-actions](https://github.com/mindsdb/github-actions); this repo's
+workflow supplies the major component and consumes the resulting `tag` output.
+
 ### What you should NOT do
 
 - **Don't create GitHub releases manually.** The `v*` tag namespace is locked via a repo ruleset — only the release workflow can create them. Manual attempts will be rejected by GitHub.