From 79fd5a8f7ea6123a90fb6c5aa1f673fc8d0c9988 Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Thu, 29 Oct 2026 23:16:21 +0100 Subject: [PATCH] ci: fix every finding of jactionlint with the pedantic profile - pull_request_target and workflow_run stay, these workflows run no code of the pull request --- .github/jactionlint.yaml | 1 + ...lock-closed-issues-discussions-and-prs.yml | 17 +++++++++---- .github/workflows/chore-manage-pr-branch.yaml | 13 ++++++---- .../chore-manage-stale-issues-and-prs.yml | 15 ++++++++---- .github/workflows/chore-pr-comments.yml | 24 +++++++++++++++---- .github/workflows/pr-quality.yaml | 21 +++++++++++----- 6 files changed, 67 insertions(+), 24 deletions(-) create mode 100644 .github/jactionlint.yaml diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml new file mode 100644 index 0000000000..07d42f9c26 --- /dev/null +++ b/.github/jactionlint.yaml @@ -0,0 +1 @@ +profile: pedantic diff --git a/.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml b/.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml index 2ce86310e0..8420f54689 100644 --- a/.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml +++ b/.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml @@ -4,14 +4,21 @@ on: schedule: - cron: '0 1 * * *' -permissions: - issues: write - discussions: write - pull-requests: write +permissions: {} + +concurrency: + group: lock-threads + cancel-in-progress: false jobs: lock-threads: - runs-on: ubuntu-latest + name: Lock inactive threads + permissions: + issues: write # lock the inactive issues + discussions: write # lock the inactive discussions + pull-requests: write # lock the inactive pull requests + runs-on: ubuntu-26.04 # https://github.com/actions/runner-images + timeout-minutes: 10 steps: - name: Lock threads after 30 days of inactivity uses: dessant/lock-threads@v6.0.2 diff --git a/.github/workflows/chore-manage-pr-branch.yaml b/.github/workflows/chore-manage-pr-branch.yaml index f9c0392934..c66ede6f5e 100644 --- a/.github/workflows/chore-manage-pr-branch.yaml +++ b/.github/workflows/chore-manage-pr-branch.yaml @@ -4,14 +4,14 @@ name: Manage PR Branch # PR Quality may close a PR that fails its checks, so we must wait for it to # complete before deciding whether to retarget the PR's base branch. on: + # Only reads the PR Quality run and the pull request through the API, it checks out and runs no code of the pull request + # jactionlint ignore=dangerous-triggers workflow_run: workflows: ["PR Quality"] types: - completed -permissions: - contents: read - pull-requests: write +permissions: {} concurrency: group: manage-pr-branch-${{ github.event.workflow_run.head_sha }} @@ -19,7 +19,12 @@ concurrency: jobs: manage-branch: - runs-on: ubuntu-latest + name: Retarget the pull request + permissions: + contents: read # read the branches of the repository + pull-requests: write # change the base branch of the pull request and comment on it + runs-on: ubuntu-26.04 # https://github.com/actions/runner-images + timeout-minutes: 10 steps: - name: Retarget PR base branch based on category uses: actions/github-script@v9.0.0 diff --git a/.github/workflows/chore-manage-stale-issues-and-prs.yml b/.github/workflows/chore-manage-stale-issues-and-prs.yml index 86c22cfece..58efa69e3a 100644 --- a/.github/workflows/chore-manage-stale-issues-and-prs.yml +++ b/.github/workflows/chore-manage-stale-issues-and-prs.yml @@ -4,13 +4,20 @@ on: schedule: - cron: '0 2 * * *' -permissions: - issues: write - pull-requests: write +permissions: {} + +concurrency: + group: manage-stale + cancel-in-progress: false jobs: manage-stale: - runs-on: ubuntu-latest + name: Manage stale issues and PRs + permissions: + issues: write # label, comment on and close the stale issues + pull-requests: write # label, comment on and close the stale pull requests + runs-on: ubuntu-26.04 # https://github.com/actions/runner-images + timeout-minutes: 10 steps: - name: Manage stale issues and PRs uses: actions/stale@v11.0.0 diff --git a/.github/workflows/chore-pr-comments.yml b/.github/workflows/chore-pr-comments.yml index 821fef1778..43b5b65682 100644 --- a/.github/workflows/chore-pr-comments.yml +++ b/.github/workflows/chore-pr-comments.yml @@ -1,15 +1,29 @@ name: Add comment based on label + on: + # Comments on pull requests from forks too, it checks out and runs no code of the pull request + # jactionlint ignore=dangerous-triggers pull_request_target: types: - labeled -permissions: - pull-requests: write +permissions: {} + +concurrency: + group: pr-comments-${{ github.event.pull_request.number }} + cancel-in-progress: false + +defaults: + run: + shell: bash jobs: add-comment: - runs-on: ubuntu-latest + name: Ask for the docs of ${{ matrix.label }} + permissions: + pull-requests: write # comment on the pull request + runs-on: ubuntu-26.04 # https://github.com/actions/runner-images + timeout-minutes: 10 strategy: matrix: include: @@ -41,9 +55,9 @@ jobs: steps: - name: Add comment if: >- - (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR') + ${{ (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR') && contains(github.event.pull_request.labels.*.name, matrix.label) - && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR') + && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR') }} run: gh pr comment "$NUMBER" --body "$BODY" env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-quality.yaml b/.github/workflows/pr-quality.yaml index b61bf8d86c..9b7ba14224 100644 --- a/.github/workflows/pr-quality.yaml +++ b/.github/workflows/pr-quality.yaml @@ -1,17 +1,26 @@ name: PR Quality -permissions: - contents: read - issues: read - pull-requests: write - on: + # Checks pull requests from forks too, it checks out and runs no code of the pull request + # jactionlint ignore=dangerous-triggers pull_request_target: types: [opened, reopened] +permissions: {} + +concurrency: + group: pr-quality-${{ github.event.pull_request.number }} + cancel-in-progress: false + jobs: pr-quality: - runs-on: ubuntu-latest + name: Check the pull request + permissions: + contents: read # read the commits and files of the pull request + issues: read # read the linked issues + pull-requests: write # comment on, label and close the pull request + runs-on: ubuntu-26.04 # https://github.com/actions/runner-images + timeout-minutes: 10 steps: - uses: peakoss/anti-slop@v0.3.0 with: