Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions .github/workflows/bot-changelog-runner.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
name: Changelog Bot Runner

on:
workflow_run:
workflows: ["Changelog Bot Trigger"]
types:
- completed

permissions:
actions: read

jobs:
fetch-metadata:
runs-on: ubuntu-latest
if: github.event.workflow_run.conclusion == 'success'
permissions:
actions: read
outputs:
pr_number: ${{ steps.metadata.outputs.pr_number }}
steps:
- name: Download PR metadata
id: download
uses: actions/download-artifact@v8
with:
name: changelog-metadata
github-token: ${{ secrets.GITHUB_TOKEN }}
run-id: ${{ github.event.workflow_run.id }}
continue-on-error: true

- name: Read PR metadata
if: steps.download.outcome == 'success'
id: metadata
run: |
PR_NUMBER=$(cat pr_number)
if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
echo "::error::Invalid PR number: $PR_NUMBER"
exit 1
fi
echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT

changelog:
needs: fetch-metadata
if: needs.fetch-metadata.outputs.pr_number != ''
permissions:
contents: read
pull-requests: write
issues: write
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master
with:
pr_number: ${{ needs.fetch-metadata.outputs.pr_number }}
secrets:
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
38 changes: 38 additions & 0 deletions .github/workflows/bot-changelog-trigger.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Changelog Bot Trigger

on:
pull_request_review:
types: [submitted]

permissions: {}

jobs:
check:
if: |
github.event.review.state == 'approved' &&
(github.event.review.author_association == 'OWNER' ||
github.event.review.author_association == 'MEMBER' ||
github.event.review.author_association == 'COLLABORATOR')
runs-on: ubuntu-latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🌐 Web query:

What are GitHub’s current recommendations for pinning runs-on runner images in GitHub Actions workflows?

💡 Result:

GitHub does not recommend or support directly pinning runs-on runner images to specific versions (e.g., ubuntu-24.04-20250915.62.1) in standard GitHub-hosted runners. Instead, the current recommendation is to use specific OS version labels like ubuntu-24.04, ubuntu-22.04, windows-2025, or macos-15 to avoid unexpected changes from -latest aliases, which roll forward to newer OS versions (e.g., ubuntu-latest now points to ubuntu-24.04 as of early 2025).

Citations:


Use a fixed runner image instead of ubuntu-latest.

ubuntu-latest is mutable and can introduce non-reproducible CI behavior. Pin to a specific OS version label like ubuntu-24.04 to ensure consistency.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/bot-changelog-trigger.yml at line 17, Replace the mutable
runner label used by the runs-on key to a fixed OS version: change the runs-on
value from "ubuntu-latest" to a specific pinned label such as "ubuntu-24.04"
(i.e., update the runs-on: "ubuntu-latest" line to runs-on: "ubuntu-24.04") so
the workflow uses a stable, reproducible runner image.

steps:
- name: Check for noteworthy PR
id: check
env:
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
if echo "$PR_TITLE" | grep -qiE '^\[(feature|fix|change)\]'; then
echo "has_noteworthy=true" >> $GITHUB_OUTPUT
fi

- name: Save PR metadata
if: steps.check.outputs.has_noteworthy == 'true'
env:
PR_NUMBER: ${{ github.event.pull_request.number }}
run: echo "$PR_NUMBER" > pr_number

- name: Upload PR metadata
if: steps.check.outputs.has_noteworthy == 'true'
uses: actions/upload-artifact@v7
with:
name: changelog-metadata
path: pr_number
Loading