ci: drop unused scheduled workflows (security-scan, template-sync) - #74
Merged
Conversation
The weekly security-scan and template-sync workflows generated churn no one acts on: - security-scan.yaml ran pip-audit on a schedule and dumped a JSON report into the Actions tab that nobody monitors. It is redundant with GitHub's native Dependabot security alerts. The on-demand `tox -e security` env is kept for local CVE scans. - template-sync.yaml is a no-op in the template repo itself and does a whole-tree merge into forks that conflicts on pyproject.toml/README for any customized plugin. Pulling template changes is now a deliberate manual step. Also moves Dependabot version updates from weekly to monthly to cut the patch-bump PR noise that fights the 7-day `exclude-newer` resolver window. Docs updated to match (github-workflows.md, github-repository-settings.md).
Review of #74 found the workflow doc undercounted: there are three workflow files (test, scaffold-test, release), not two. The scaffold-rename job was never documented even under the old count. - github-workflows.md: correct "two" -> "three" and add a Scaffold Rename Workflow section. - github-repository-settings.md: note the per-PR `scaffold` check so it can be added to required status checks.
Revert the weekly -> monthly change. The grouped weekly cadence is at most one PR per week and keeps dev deps current; the noise it adds is acceptable. Security updates are unaffected by the interval either way.
TKaltofen
changed the title
Two completeness fixes flagged in #74 review: - github-workflows.md: scaffold-test.yml has a workflow_dispatch trigger; add the missing Manual dispatch bullet. - github-repository-settings.md: scaffold-test.yml also runs on the default GITHUB_TOKEN with no secrets; widen the sentence that only named test.yml so the no-secrets bucket is complete.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the tk-437 question: which template checks churn without value, and how security/sync updates should reach forks.
What changes
security-scan.yaml(weeklypip-audit). It dumped a JSON report into the Actions tab that nobody monitors on a template repo, and it is redundant with GitHub's native Dependabot security alerts. Thetox -e securityenv stays for on-demand local CVE scans.template-sync.yaml(weekly). It is a no-op in the template repo itself (template is always its own ancestor) and does a whole-tree merge into forks that conflicts onpyproject.toml/README/package dirs for any customized plugin. Pulling later template changes is now a deliberate manual step.github-workflows.md,github-repository-settings.md), including documenting the previously-undocumentedscaffold-test.ymlworkflow and its per-PRscaffoldcheck.Dependabot stays on its existing weekly grouped cadence (a monthly change was considered and reverted).
What stays (the value, not the noise)
test.ymltox gate across Python 3.10-3.13 (pytest, ruff, mypy --strict, bandit) + placeholder check.scaffold-test.ymlend-to-end template-rename validation.release.yamlsemantic-release.tox -e security(pip-audit) on demand.Security note
Removing the scheduled
security-scan.yamldoes not open a gap: native Dependabot security alerts scan the dependency graph continuously and fire regardless of update cadence, bandit SAST still runs on every PR, andtox -e securityis available on demand.