Conversation
AkihiroSuda
approved these changes
Sep 14, 2026
Member
|
Needs rebasing |
This is mostly shellcheck complaining about missing quotes (SC2046 and SC2086). Issues found by actionlint (which runs shellcheck for all run: statements in GHA workflows. (cherry picked from commit a752f49) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Debugging GHA yaml is not fun -- usually when there is an issue with a workflow file, it just doesn't run. Let's add a separate actionlint job to catch workflow issues. (cherry picked from commit 614303b) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Bumps [devops-actions/actionlint](https://github.com/devops-actions/actionlint) from 0.1.12 to 0.1.13. - [Release notes](https://github.com/devops-actions/actionlint/releases) - [Commits](devops-actions/actionlint@9fb9c19...ec02b36) --- updated-dependencies: - dependency-name: devops-actions/actionlint dependency-version: 0.1.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit cda8b69) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Use the actively maintained fork of rhysd/actionlint, which contains a lot of fixes and knows about the newer GitHub-hosted runner images. It ships its own action, so devops-actions/actionlint is no longer needed. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> (cherry picked from commit 2b8c56a) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
A version tag (even a "full" one like v7.0.1) is mutable: whoever controls the action's repository can move it to point to any other commit. Pinning to a full commit hash is the only way to get the exact same action code on every run. Found by zizmor's unpinned-uses audit. Dependabot is already enabled for the github-actions ecosystem and knows how to update hash pins together with their version comments, so this should not add maintenance burden. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit 16f9604) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Set persist-credentials: false for actions/checkout, as applied by "zizmor --fix". By default checkout leaves the credentials it used in .git/config, where any later step (or anything that archives the workspace) can pick them up. Nothing here pushes back to the repository, so they are not needed. The remaining findings are all cache-poisoning, and are ignored via .github/zizmor.yml, which explains why they do not apply to us. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit b3ae9b4) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Cancel CI runs that are already superseded, rather than letting them run to completion and waste runner time. This is most of what our CI queue is spent on when a pull request is force-pushed a few times in a row. For the three workflows that run on pull requests, the concurrency group is keyed by PR number, so only runs of the same pull request cancel each other. For anything else -- in particular pushes to main, to release-*, and to a v* tag, the latter also producing the release binaries -- there is no PR number, so the group falls back to the unique run_id and no run is ever cancelled. Keying by github.head_ref instead would be wrong, as two pull requests from different forks can use the same branch name. scheduled.yml only triggers other workflows, so a single group for the whole workflow is enough there. It does not cancel in progress runs, though: a workflow_dispatch arriving while a scheduled run is halfway through its matrix would leave some of the branches untriggered. Found by zizmor's concurrency-limits audit (--persona=pedantic). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> (cherry picked from commit 5f980ea) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 213b152) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport to release-1.5 of the following PRs:
(only the "ci: switch to the kjanat/actionlint fork" commit; Ubuntu 26.04
is not added here)
(only the parts touching
.github/workflows/actionlint.yml, which weredropped from [1.5] ci: add zizmor, fix found issues #5443 as that file did not exist in release-1.5 back then)
Commits are in the same order as in main. The resulting
.github/workflows/actionlint.ymlis identical to the one in #5462.Conflicts resolved:
validate.yml, release-1.5already has
lumaxis/shellcheck-problem-matcherspinned (from [1.5] ci: add zizmor, fix found issues #5443),--strictfor conmon tests (from [1.5] ci: fix conmon job #5407), and thezizmorjob; keptthose and applied the quoting fixes on top.
actionlint.ymlare already inrelease-1.5 (via [1.5] ci: add zizmor, fix found issues #5443), so only the
actionlint.ymlchanges remain.