ci: sync with netresearch/.github templates/go-app - #568
Conversation
Auto-generated by scripts/sync-template.sh. Any changes you want to keep must be declared in .github/template.yaml's intentional-drift: list — the check-template-drift.yml job will otherwise revert them on next sync. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency ReviewThe following issues were found:
License Issues.github/workflows/gitleaks.yml
.github/workflows/scorecard.yml
OpenSSF Scorecard
Scanned Files
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Post-template-sync cleanup: - Delete `auto-merge.yml` — superseded by `auto-merge-deps.yml` from the template (caller of netresearch/.github's org-level reusable). - Delete `cleanup-containers.yml` — superseded by `container-retention.yml` (caller of ghcr-retention.yml reusable). - Add `integration.yml` — not part of the go-app template because integration tests are ofelia-specific (Docker build + buildx requirement + integration build tag). Drift-check permits extra consumer files not present in the template, so no intentional-drift entry is needed. Known follow-ups (not in this PR): - Coverage threshold jumps 60% → 80% via template. Tests need to be expanded OR ci.yml added to intentional-drift with a lower threshold. - workflow-lint job lost in the ci.yml overwrite; add back via a tiny lint-workflows.yml caller if desired. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Dependabot configuration to include Docker updates and dependency grouping, adds a labeler configuration for automated PR labeling, and introduces a template tracking file. A suggestion was made to include the Dockerfile in the dependencies label configuration to ensure that Docker-related dependency updates are correctly categorized.
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #568 +/- ##
==========================================
- Coverage 84.11% 83.77% -0.34%
==========================================
Files 83 87 +4
Lines 10259 10622 +363
==========================================
+ Hits 8629 8899 +270
- Misses 1435 1519 +84
- Partials 195 204 +9
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Syncs this repository’s GitHub Actions configuration back to the canonical netresearch/.github go-app template by replacing in-repo workflow logic with org-level reusable workflows and adding the template’s standard security/automation workflows.
Changes:
- Replace large in-repo CI/release/quality/mutation/scorecard workflows with calls to
netresearch/.githubreusable workflows. - Add template-managed workflows for CodeQL, gitleaks, dependency review, container build, labeler, template-drift checking, and dependency auto-merge.
- Update Dependabot configuration (grouping, ecosystems) and add template management marker files (
.github/template.yaml, labeler config).
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/scorecard.yml | Switch Scorecard to reusable workflow. |
| .github/workflows/release.yml | Replace release pipeline with reusable create + build jobs. |
| .github/workflows/pr-quality.yml | Delegate PR quality gate/auto-approve to reusable workflow. |
| .github/workflows/mutation.yml | Delegate mutation testing to reusable workflow. |
| .github/workflows/labeler.yml | Add labeler workflow using reusable implementation. |
| .github/workflows/gitleaks.yml | Add gitleaks scanning via reusable workflow. |
| .github/workflows/dependency-review.yml | Add dependency review via reusable workflow. |
| .github/workflows/container.yml | Add container build workflow via reusable workflow. |
| .github/workflows/container-retention.yml | Add GHCR retention workflow via reusable workflow. |
| .github/workflows/codeql.yml | Add CodeQL workflow via reusable workflow. |
| .github/workflows/ci.yml | Replace detailed CI with go-check reusable workflow and new options. |
| .github/workflows/check-template-drift.yml | Add CI check to block unrecorded template drift. |
| .github/workflows/auto-merge-deps.yml | Add dependency auto-merge workflow via reusable workflow. |
| .github/template.yaml | Add template metadata + intentional drift list. |
| .github/labeler.yml | Add label definitions used by labeler workflow. |
| .github/dependabot.yml | Update Dependabot ecosystems, grouping, and scheduling. |
…entity
Template default `image-name: ${{ github.repository }}` would produce
`ghcr.io/netresearch/ofelia` (full owner/repo), but the existing GHCR
package for this repo has been `ghcr.io/netresearch/ofelia` published
as just `ofelia` for years — renaming would orphan all existing image
pulls.
Override image-name to `ofelia` and record it as intentional-drift.
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Auto-opened by sync-template.sh. Brings this repo back into alignment with the canonical
go-apptemplate innetresearch/.github.To keep any diverging files, add their paths to
.github/template.yaml'sintentional-drift:list before merging — otherwise the next sync run will revert them.