Skip to content

chore(ci): migrate promote-testing-to-main to reusable-promote-squash #811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
castrojo merged 1 commit into from
Jun 12, 2026
Merged

chore(ci): migrate promote-testing-to-main to reusable-promote-squash #811

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions .github/workflows/promote-testing-to-main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
name: Promote testing to main

# Thin caller — logic lives in projectbluefin/actions/reusable-promote.yml
# Replaces the previous 183-line promote-testing-to-main.yml.
# Thin caller — logic lives in projectbluefin/actions/reusable-promote-squash.yml
#
# Migrated from reusable-promote.yml which is now deleted.
# Key improvement: squash branch is always rebuilt fresh on every run —
# no staleness, no conflict drift, no merge friction.

on:
push:
Expand All @@ -16,13 +18,15 @@ concurrency:
cancel-in-progress: false

permissions:
contents: read
contents: write
pull-requests: write
issues: write
Comment on lines 20 to +23

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Examine the reusable workflow to verify required permissions

# Check out the pinned commit and examine the workflow
git clone --depth 1 https://github.com/projectbluefin/actions.git /tmp/bluefin-actions 2>/dev/null || true
cd /tmp/bluefin-actions
git fetch origin 6c2278adfcde0818079173b40f6c0f07a68c7198 2>/dev/null || true
git checkout 6c2278adfcde0818079173b40f6c0f07a68c7198 2>/dev/null || true

# Extract the permissions section and any permission-related comments
if [ -f .github/workflows/reusable-promote-squash.yml ]; then
  echo "=== Checking reusable-promote-squash.yml permissions ==="
  rg -A 10 '^permissions:' .github/workflows/reusable-promote-squash.yml || echo "No explicit permissions found"
  
  echo -e "\n=== Checking for permission-related comments or documentation ==="
  rg -i 'permission|require.*write' .github/workflows/reusable-promote-squash.yml | head -20
else
  echo "Workflow file not found at expected path"
fi

Repository: projectbluefin/dakota

Length of output: 505

Tighten GHA token permissions in promote-testing-to-main

reusable-promote-squash.yml declares only permissions: contents: read, so pull-requests: write and issues: write are not requested by the reusable workflow itself. Confirm whether .github/workflows/promote-testing-to-main.yml needs pull-requests: write / issues: write for steps or jobs outside the reusable workflow; otherwise reduce the caller’s token scopes.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/promote-testing-to-main.yml around lines 20 - 23, The
workflow currently requests broad token scopes (permissions: contents: write,
pull-requests: write, issues: write); verify whether any jobs or steps in this
file (the permissions: block) outside the reusable workflow call
(reusable-promote-squash.yml) actually require pull-requests: write or issues:
write; if not, reduce the caller scopes to match the reusable workflow (e.g.,
set pull-requests and issues to read or remove them entirely) by editing the
permissions: keys (contents, pull-requests, issues) to the minimal required
values and run the workflow locally/CI to ensure no step fails.


jobs:
promote:
uses: projectbluefin/actions/.github/workflows/reusable-promote.yml@v1
uses: projectbluefin/actions/.github/workflows/reusable-promote-squash.yml@6c2278adfcde0818079173b40f6c0f07a68c7198 # v1
with:
variants: '["dakota","dakota-nvidia"]'
variants: '[{"image":"dakota"},{"image":"dakota-nvidia"}]'
cosign_identity_regexp: >-
^https://github\.com/projectbluefin/(dakota|actions)/\.github/workflows/
run_e2e: false
Expand Down
Loading