Skip to content

Commit 651aa81

Browse files
lucarliglucarlig
committed
chore: skip full CI for secrets baseline commits
Signed-off-by: lucarlig <luca.carlig@ibm.com>
1 parent c441de9 commit 651aa81

19 files changed

Lines changed: 325 additions & 42 deletions

‎.github/workflows/alembic-upgrade-validation.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,14 @@ permissions:
4747
actions: read
4848

4949
jobs:
50+
ci-decision:
51+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
52+
with:
53+
workflow-file: alembic-upgrade-validation.yml
54+
5055
upgrade-validation:
51-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
56+
needs: ci-decision
57+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
5258
name: SQLite + PostgreSQL Fresh/Upgrade
5359
runs-on: ubuntu-latest
5460
timeout-minutes: 50

‎.github/workflows/dependency-review.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,20 @@ concurrency:
4545
# Minimal permissions - principle of least privilege
4646
# -----------------------------------------------------------------
4747
permissions:
48+
actions: read
4849
contents: read # for actions/checkout
4950
security-events: write # upload SARIF results
5051
pull-requests: write # post / overwrite PR comment
5152

5253
jobs:
54+
ci-decision:
55+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
56+
with:
57+
workflow-file: dependency-review.yml
58+
5359
dependency-review:
54-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
60+
needs: ci-decision
61+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
5562
runs-on: ubuntu-slim
5663
timeout-minutes: 15
5764

‎.github/workflows/docker-multiplatform.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,18 +45,22 @@ concurrency:
4545
cancel-in-progress: true
4646

4747
permissions:
48+
actions: read
4849
contents: read
4950

5051
env:
5152
REGISTRY: ghcr.io
5253
IMAGE_NAME: ${{ github.repository }}
5354

5455
jobs:
55-
# ---------------------------------------------------------------
56-
# Build each platform in parallel
57-
# ---------------------------------------------------------------
56+
ci-decision:
57+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
58+
with:
59+
workflow-file: docker-multiplatform.yml
60+
5861
build:
59-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
62+
needs: ci-decision
63+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
6064
name: Build ${{ matrix.suffix }}
6165
strategy:
6266
fail-fast: false

‎.github/workflows/docker-scan.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,21 @@ concurrency:
3939
cancel-in-progress: true
4040

4141
permissions:
42+
actions: read
4243
contents: read
4344

4445
env:
4546
IMAGE_NAME: mcp-context-forge-scan
4647

4748
jobs:
49+
ci-decision:
50+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
51+
with:
52+
workflow-file: docker-scan.yml
53+
4854
container-smoke:
49-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
55+
needs: ci-decision
56+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
5057
name: Container Smoke (${{ matrix.name }})
5158
runs-on: ubuntu-latest
5259
timeout-minutes: 30
@@ -86,7 +93,8 @@ jobs:
8693
# Build image and generate SBOM
8794
# ---------------------------------------------------------------
8895
scan:
89-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
96+
needs: ci-decision
97+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
9098
name: Security Scan
9199
runs-on: ubuntu-latest
92100
timeout-minutes: 30
@@ -152,7 +160,8 @@ jobs:
152160
retention-days: 30
153161

154162
rust-enabled-build:
155-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
163+
needs: ci-decision
164+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
156165
name: Rust-enabled container smoke
157166
runs-on: ubuntu-latest
158167
timeout-minutes: 60

‎.github/workflows/helm-publish.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,19 @@ concurrency:
4242
cancel-in-progress: true
4343

4444
permissions:
45+
actions: read
4546
contents: read
4647

4748
jobs:
48-
# -----------------------------------------------------------------------
49-
# Lint – always runs to catch chart issues early
50-
# -----------------------------------------------------------------------
49+
ci-decision:
50+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
51+
with:
52+
workflow-file: helm-publish.yml
53+
5154
lint:
5255
name: Lint chart
53-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
56+
needs: ci-decision
57+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
5458
runs-on: ubuntu-slim
5559
timeout-minutes: 10
5660

‎.github/workflows/license-check.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,18 @@ concurrency:
2121
cancel-in-progress: true
2222

2323
permissions:
24+
actions: read
2425
contents: read
2526

2627
jobs:
28+
ci-decision:
29+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
30+
with:
31+
workflow-file: license-check.yml
32+
2733
license-check:
28-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
34+
needs: ci-decision
35+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
2936
runs-on: ubuntu-latest
3037
timeout-minutes: 20
3138
steps:

‎.github/workflows/lint-web.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,18 @@ concurrency:
2525
cancel-in-progress: true
2626

2727
permissions:
28+
actions: read
2829
contents: read
2930

3031
jobs:
32+
ci-decision:
33+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
34+
with:
35+
workflow-file: lint-web.yml
36+
3137
lint-web:
32-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
38+
needs: ci-decision
39+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
3340
strategy:
3441
fail-fast: false
3542
matrix:
@@ -139,7 +146,8 @@ jobs:
139146
# 🐍 Python-based JS Security Scanner (separate job)
140147
# -------------------------------------------------------
141148
nodejsscan:
142-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
149+
needs: ci-decision
150+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
143151
name: nodejsscan
144152
runs-on: ubuntu-latest
145153
timeout-minutes: 20

‎.github/workflows/lint.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ concurrency:
2424
cancel-in-progress: true
2525

2626
permissions:
27+
actions: read
2728
contents: read
2829

2930
# Keep these pins in lockstep with the *_VERSION variables in the Makefile.
@@ -40,11 +41,14 @@ env:
4041
TOMLCHECK_VERSION: "0.2.3"
4142

4243
jobs:
43-
# ---------------------------------------------------------------
44-
# Python linters - run on both mcpgateway/ and plugins/
45-
# ---------------------------------------------------------------
44+
ci-decision:
45+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
46+
with:
47+
workflow-file: lint.yml
48+
4649
python-lint:
47-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
50+
needs: ci-decision
51+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
4852
strategy:
4953
fail-fast: false
5054
matrix:
@@ -97,7 +101,8 @@ jobs:
97101
# Repo-wide syntax/format checkers (run once, not per-target)
98102
# ---------------------------------------------------------------
99103
syntax-check:
100-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
104+
needs: ci-decision
105+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
101106
strategy:
102107
fail-fast: false
103108
matrix:

‎.github/workflows/linting-full.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,18 @@ concurrency:
2020
cancel-in-progress: true
2121

2222
permissions:
23+
actions: read
2324
contents: read
2425

2526
jobs:
27+
ci-decision:
28+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
29+
with:
30+
workflow-file: linting-full.yml
31+
2632
linting-full:
27-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
33+
needs: ci-decision
34+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
2835
name: linting-full
2936
runs-on: ubuntu-slim
3037
timeout-minutes: 30

‎.github/workflows/playwright.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,22 @@ on:
1212
workflow_dispatch:
1313

1414
permissions:
15+
actions: read
1516
contents: read
1617

1718
concurrency:
1819
group: ${{ github.workflow }}-${{ github.ref }}
1920
cancel-in-progress: true
2021

2122
jobs:
23+
ci-decision:
24+
uses: ./.github/workflows/secret-baseline-ci-decision.yml
25+
with:
26+
workflow-file: playwright.yml
27+
2228
playwright-ci-smoke:
23-
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
29+
needs: ci-decision
30+
if: needs.ci-decision.outputs.run-full-ci == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
2431
name: playwright-ci-smoke
2532
runs-on: ubuntu-24.04
2633
timeout-minutes: 40

0 commit comments

Comments
 (0)