diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml deleted file mode 100644 index 8ebd338..0000000 --- a/.github/workflows/security-scan.yaml +++ /dev/null @@ -1,32 +0,0 @@ -name: Weekly Security Scan - -on: - schedule: - # Run every Monday at 9:00 AM UTC - - cron: '0 9 * * 1' - workflow_dispatch: # Allow manual triggering from any branch - -permissions: - contents: read - -jobs: - security-scan: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v4 - - - name: Set up Python 3.10 - uses: actions/setup-python@v5 - with: - python-version: "3.10" - - - name: Install tox - run: | - python -m pip install --upgrade pip - python -m pip install uv - uv tool install tox --with tox-uv - - - name: Run security scan with tox - run: tox -e security - timeout-minutes: 2 diff --git a/.github/workflows/template-sync.yaml b/.github/workflows/template-sync.yaml deleted file mode 100644 index 7b55ec9..0000000 --- a/.github/workflows/template-sync.yaml +++ /dev/null @@ -1,99 +0,0 @@ -name: Weekly Template Sync - -on: - schedule: - # Run every Thursday at 9:00 AM UTC - - cron: '0 9 * * 4' - workflow_dispatch: # Allow manual triggering - -permissions: - contents: write - pull-requests: write - -jobs: - template-sync: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 # Full history needed for merge - - - name: Check and sync with template - env: - GH_TOKEN: ${{ github.token }} - run: | - set -e - - TEMPLATE_REPO="https://github.com/mloda-ai/mloda-plugin-template.git" - TEMPLATE_BRANCH="main" - TARGET_BRANCH="main" - SYNC_BRANCH="chore/template-sync-$(date +%Y-%m-%d)" - - echo "Adding template remote..." - git remote add template "$TEMPLATE_REPO" - git fetch template - - TEMPLATE_HEAD=$(git rev-parse template/$TEMPLATE_BRANCH) - echo "Template HEAD: $TEMPLATE_HEAD" - - # Check if template is already merged - if git merge-base --is-ancestor "$TEMPLATE_HEAD" origin/$TARGET_BRANCH; then - echo "✅ Already in sync with template. Nothing to do." - exit 0 - fi - - echo "⚠️ Template has new commits. Creating sync PR..." - - # Check if a sync PR already exists - EXISTING_PR=$(gh pr list --head "chore/template-sync-" --state open --json number --jq '.[0].number // empty') - if [ -n "$EXISTING_PR" ]; then - echo "ℹ️ Sync PR #$EXISTING_PR already exists. Skipping." - exit 0 - fi - - # Configure git for commit - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - - # Create sync branch from main - git checkout -b "$SYNC_BRANCH" origin/$TARGET_BRANCH - - # Merge template changes - if ! git merge template/$TEMPLATE_BRANCH --no-edit -m "chore: sync with template repository"; then - echo "❌ Merge conflict detected. Manual resolution required." - echo "Run locally:" - echo " git fetch template" - echo " git merge template/$TEMPLATE_BRANCH" - exit 1 - fi - - # Push the branch - git push origin "$SYNC_BRANCH" - - # Get list of new commits for PR body - NEW_COMMITS=$(git log --oneline origin/$TARGET_BRANCH..template/$TEMPLATE_BRANCH) - - # Create PR - gh pr create \ - --title "chore: sync with template repository" \ - --body "$(cat < Code security**), with `tox -e security` (`pip-audit`) available for on-demand local scans. Pulling later template changes into a scaffolded repo is a deliberate, manual step (fetch the template remote and cherry-pick), not an automated job. ## Test Workflow @@ -14,40 +16,18 @@ This project uses four GitHub Actions workflows to automate testing, security sc **Requirements:** None. This workflow uses only public GitHub Actions and requires no secrets. -## Security Scan Workflow +## Scaffold Rename Workflow -**File:** `.github/workflows/security-scan.yaml` +**File:** `.github/workflows/scaffold-test.yml` **Triggers:** -- Scheduled: Every Monday at 9:00 AM UTC -- Manual dispatch (can be triggered from any branch) - -**Purpose:** Performs CVE vulnerability scanning on the local package using pip-audit via tox. The workflow builds the package and scans its dependencies for known vulnerabilities. - -**Requirements:** None. Uses only the default `GITHUB_TOKEN` with read permissions. - -## Template Sync Workflow +- Push to `main` +- Pull request to `main` +- Manual dispatch -**File:** `.github/workflows/template-sync.yaml` +**Purpose:** Copies the template to a scratch directory, runs `bin/customize.sh` against the copy, and runs tox on the renamed scaffold. This proves the customize step still produces a green plugin end to end. It emits a per-PR check named `scaffold`. -**Triggers:** -- Scheduled: Every Thursday at 9:00 AM UTC -- Manual dispatch (can be triggered from any branch) - -**Purpose:** Keeps this repository in sync with the upstream template repository ([mloda-plugin-template](https://github.com/mloda-ai/mloda-plugin-template)). The workflow: -1. Checks if there are new commits in the template repository -2. If new commits exist, creates a branch `chore/template-sync-YYYY-MM-DD` -3. Merges template changes into the branch -4. Opens a pull request for review - -**Requirements:** None. Uses only the default `GITHUB_TOKEN` with write permissions for contents and pull-requests. - -**Note:** If merge conflicts occur, the workflow will fail and manual resolution is required. Run locally: -```bash -git remote add template https://github.com/mloda-ai/mloda-plugin-template.git -git fetch template -git merge template/main -``` +**Requirements:** None. Uses only public GitHub Actions and requires no secrets. ## Release Workflow