Skip to content

Commit f43d153

Browse files
authored
Merge branch 'main' into release-please--branches--main--components--reponomics-dashboard-action
2 parents 9e32c9e + 637b679 commit f43d153

10 files changed

Lines changed: 1125 additions & 22 deletions

File tree

.github/workflows/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ This directory contains the repository's CI, release, dependency, and supply-cha
2424

2525
- [`pre-release-validation.yml`](pre-release-validation.yml) is a manual, non-publishing validation pass for candidate refs. It builds the template from the candidate source, runs template smoke checks, runs generated-template consumer e2e against the same candidate action runtime, dry-runs template publication, and uploads the generated template for inspection.
2626

27+
- [`staging-smoke.yml`](staging-smoke.yml) validates and optionally publishes the one copied-repository staging smoke scenario described in [`../../docs/STAGING_SMOKE.md`](../../docs/STAGING_SMOKE.md). Pull requests and pushes that touch the staging/template surface run `make staging-smoke` in dry-run mode and upload evidence. Manual dispatch can publish `reponomics/reponomics-dashboard-staging` using a scoped GitHub App token for the staging repository.
28+
2729
- [`sbom-provenance.yml`](sbom-provenance.yml) generates a repository SPDX SBOM and creates release source/SBOM attestations for release and manual runs. Release asset upload is explicitly disabled because immutable releases cannot be mutated after publication, and dependency snapshot upload is disabled so the third-party SBOM action runs with a read-only job token.
2830

2931
- [`scorecard.yml`](scorecard.yml) runs OpenSSF Scorecard and publishes SARIF/results for supply-chain posture visibility. It also supports the public Scorecard badge and keeps checks such as Maintained refreshed on a schedule.

.github/workflows/osv-scanner.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353

5454
- name: Upload SARIF to code scanning
5555
if: ${{ !cancelled() }}
56-
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
56+
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
5757
with:
5858
sarif_file: osv-scanner.sarif
5959

.github/workflows/scorecard.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,6 @@ jobs:
7373
# Upload the results to GitHub's code scanning dashboard (optional).
7474
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7575
- name: "Upload to code-scanning"
76-
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
76+
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
7777
with:
7878
sarif_file: results.sarif
Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: Staging Smoke
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
paths:
7+
- ".github/workflows/staging-smoke.yml"
8+
- "Makefile"
9+
- "docs/STAGING_SMOKE.md"
10+
- "docs/VERSIONING_AND_RELEASE.md"
11+
- "scripts/staging_smoke.py"
12+
- "tests/test_staging_smoke.py"
13+
- "template/**"
14+
- "template-contract.yml"
15+
- "template-manifest.yml"
16+
- "dashboard_action/runtime/managed_docs/**"
17+
push:
18+
branches: [main]
19+
paths:
20+
- ".github/workflows/staging-smoke.yml"
21+
- "Makefile"
22+
- "docs/STAGING_SMOKE.md"
23+
- "docs/VERSIONING_AND_RELEASE.md"
24+
- "scripts/staging_smoke.py"
25+
- "tests/test_staging_smoke.py"
26+
- "template/**"
27+
- "template-contract.yml"
28+
- "template-manifest.yml"
29+
- "dashboard_action/runtime/managed_docs/**"
30+
workflow_dispatch:
31+
inputs:
32+
source_ref:
33+
description: "Git ref to build the staging smoke tree from"
34+
required: true
35+
type: string
36+
default: main
37+
repositories:
38+
description: "Space- or comma-separated public repos for collect.repositories"
39+
required: true
40+
type: string
41+
default: reponomics/reponomics-dashboard-action
42+
publish_repositories:
43+
description: "Optional space- or comma-separated publish.repositories subset"
44+
required: false
45+
type: string
46+
default: ""
47+
publish:
48+
description: "Replace the copied staging repository branch"
49+
required: true
50+
type: boolean
51+
default: false
52+
53+
permissions:
54+
contents: read
55+
56+
concurrency:
57+
group: staging-smoke-${{ github.event.inputs.source_ref || github.ref }}
58+
cancel-in-progress: false
59+
60+
env:
61+
PYTHON_VERSION: "3.11"
62+
STAGING_SMOKE_EXPECTED_REPO: reponomics/reponomics-dashboard-staging
63+
STAGING_SMOKE_BRANCH: main
64+
STAGING_SMOKE_OUTPUT: dist/staging-smoke
65+
STAGING_SMOKE_EVIDENCE: dist/staging-smoke-evidence.md
66+
STAGING_SMOKE_MESSAGE: "chore: publish staging smoke dashboard"
67+
68+
jobs:
69+
validate-staging-smoke:
70+
name: Validate staging smoke tree
71+
if: ${{ github.event_name != 'workflow_dispatch' || !inputs.publish }}
72+
runs-on: ubuntu-24.04
73+
permissions:
74+
contents: read
75+
env:
76+
STAGING_SMOKE_REPOSITORIES: ${{ inputs.repositories || 'reponomics/reponomics-dashboard-action' }}
77+
STAGING_SMOKE_PUBLISH_REPOSITORIES: ${{ inputs.publish_repositories || '' }}
78+
steps:
79+
- name: Checkout source
80+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
81+
with:
82+
ref: ${{ github.event_name == 'workflow_dispatch' && inputs.source_ref || github.ref }}
83+
84+
- name: Set up Python
85+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
86+
with:
87+
python-version: ${{ env.PYTHON_VERSION }}
88+
cache: pip
89+
cache-dependency-path: pyproject.toml
90+
91+
- name: Build staging smoke tree
92+
run: |
93+
set -euo pipefail
94+
make staging-smoke
95+
96+
- name: Test staging smoke harness
97+
run: |
98+
set -euo pipefail
99+
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 venv/bin/python -m pytest tests/test_staging_smoke.py -v
100+
101+
- name: Upload staging smoke evidence
102+
if: always()
103+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
104+
with:
105+
name: staging-smoke-evidence-${{ github.run_id }}
106+
path: |
107+
dist/staging-smoke-evidence.md
108+
dist/staging-smoke/.reponomics/staging-smoke.json
109+
if-no-files-found: warn
110+
retention-days: 7
111+
112+
publish-staging-smoke:
113+
name: Publish staging smoke repository
114+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
115+
runs-on: ubuntu-24.04
116+
permissions:
117+
contents: read
118+
steps:
119+
- name: Resolve publication source
120+
id: source-ref
121+
env:
122+
SOURCE_REF: ${{ inputs.source_ref }}
123+
run: |
124+
set -euo pipefail
125+
126+
if [[ -z "$SOURCE_REF" ]]; then
127+
echo "Staging smoke source ref is empty." >&2
128+
exit 1
129+
fi
130+
131+
case "$SOURCE_REF" in
132+
main|refs/heads/main|reponomics-dashboard-v*|refs/tags/reponomics-dashboard-v*|v*|refs/tags/v*) ;;
133+
*)
134+
echo "Staging smoke publication is restricted to main or release tags; got $SOURCE_REF." >&2
135+
exit 1
136+
;;
137+
esac
138+
139+
echo "source_ref=$SOURCE_REF" >> "$GITHUB_OUTPUT"
140+
141+
- name: Checkout source
142+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
143+
with:
144+
ref: ${{ steps.source-ref.outputs.source_ref }}
145+
146+
- name: Set up Python
147+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
148+
with:
149+
python-version: ${{ env.PYTHON_VERSION }}
150+
cache: pip
151+
cache-dependency-path: pyproject.toml
152+
153+
- name: Create staging publication app token
154+
id: app-token
155+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
156+
with:
157+
client-id: ${{ vars.STAGING_SMOKE_APP_CLIENT_ID }}
158+
private-key: ${{ secrets.STAGING_SMOKE_APP_PRIVATE_KEY }}
159+
owner: ${{ github.repository_owner }}
160+
repositories: reponomics-dashboard-staging
161+
permission-contents: write
162+
permission-workflows: write
163+
164+
- name: Publish staging smoke tree
165+
shell: bash
166+
env:
167+
STAGING_TOKEN: ${{ steps.app-token.outputs.token }}
168+
STAGING_SMOKE_REPOSITORIES: ${{ inputs.repositories }}
169+
STAGING_SMOKE_PUBLISH_REPOSITORIES: ${{ inputs.publish_repositories }}
170+
run: |
171+
set -euo pipefail
172+
173+
make install
174+
remote="https://x-access-token:${STAGING_TOKEN}@github.com/${STAGING_SMOKE_EXPECTED_REPO}.git"
175+
args=(
176+
--output "$STAGING_SMOKE_OUTPUT"
177+
--remote "$remote"
178+
--expected-repo "$STAGING_SMOKE_EXPECTED_REPO"
179+
--branch "$STAGING_SMOKE_BRANCH"
180+
--message "$STAGING_SMOKE_MESSAGE"
181+
--evidence "$STAGING_SMOKE_EVIDENCE"
182+
--repository "$STAGING_SMOKE_REPOSITORIES"
183+
--push
184+
)
185+
if [[ -n "$STAGING_SMOKE_PUBLISH_REPOSITORIES" ]]; then
186+
args+=(--publish-repository "$STAGING_SMOKE_PUBLISH_REPOSITORIES")
187+
fi
188+
189+
venv/bin/python scripts/staging_smoke.py "${args[@]}"
190+
191+
- name: Add staging smoke evidence to summary
192+
if: always()
193+
run: |
194+
set -euo pipefail
195+
if [[ -f "$STAGING_SMOKE_EVIDENCE" ]]; then
196+
cat "$STAGING_SMOKE_EVIDENCE" >> "$GITHUB_STEP_SUMMARY"
197+
fi
198+
199+
- name: Upload staging smoke evidence
200+
if: always()
201+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
202+
with:
203+
name: staging-smoke-published-${{ github.run_id }}
204+
path: |
205+
dist/staging-smoke-evidence.md
206+
dist/staging-smoke/.reponomics/staging-smoke.json
207+
if-no-files-found: error
208+
retention-days: 14

Makefile

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
.PHONY: test js-test js-coverage js-smoke coverage complexity security security-audit audit-runtime-lock lock-runtime validate-runtime-lock lock-guide-tooling validate-guide-tooling-lock update-vendored-assets
55
.PHONY: lint type-check markdown-format
66
.PHONY: validate validate-action validate-workflows validate-vendored-assets
7-
.PHONY: build-template verify-template build-and-verify-generated verify-workflow-classification validate-template-action-ref validate-template-accepted-action template-smoke template-consumer-e2e template-action-boundary-e2e template-compat-e2e template-public-action-e2e template-accepted-action-e2e template-release-gates package-template-release publish-template-dry-run publish-template build-demo verify-demo render-demo-preview preview-demo preview-demo-site publish-demo-dry-run publish-demo
7+
.PHONY: build-template verify-template build-and-verify-generated verify-workflow-classification validate-template-action-ref validate-template-accepted-action template-smoke template-consumer-e2e template-action-boundary-e2e template-compat-e2e template-public-action-e2e template-accepted-action-e2e template-release-gates package-template-release publish-template-dry-run publish-template staging-smoke build-demo verify-demo render-demo-preview preview-demo preview-demo-site publish-demo-dry-run publish-demo
88
.PHONY: fixtures fixture-collect fixture-publish fixture-rotate-key preview-collection-quality-dashboard dashboard-scenario-snapshots update-dashboard-scenario-snapshots dashboard-guide-assets dashboard-guide dashboard-guide-refresh clean
99

1010
VENV := venv
@@ -42,6 +42,15 @@ TEMPLATE_REMOTE ?= https://github.com/reponomics/reponomics-dashboard.git
4242
TEMPLATE_EXPECTED_REPO ?= reponomics/reponomics-dashboard
4343
TEMPLATE_PUBLISH_MESSAGE ?= chore: publish generated template
4444
TEMPLATE_RELEASE_ARTIFACTS_DIR ?= dist/template-release
45+
STAGING_SMOKE_REMOTE ?= https://github.com/reponomics/reponomics-dashboard-staging.git
46+
STAGING_SMOKE_EXPECTED_REPO ?= reponomics/reponomics-dashboard-staging
47+
STAGING_SMOKE_BRANCH ?= main
48+
STAGING_SMOKE_OUTPUT ?= dist/staging-smoke
49+
STAGING_SMOKE_EVIDENCE ?= dist/staging-smoke-evidence.md
50+
STAGING_SMOKE_MESSAGE ?= chore: publish staging smoke dashboard
51+
STAGING_SMOKE_REPOSITORIES ?= reponomics/reponomics-dashboard-action
52+
STAGING_SMOKE_PUBLISH_REPOSITORIES ?=
53+
STAGING_SMOKE_PUSH ?=
4554
DEMO_REMOTE ?= https://github.com/reponomics/reponomics-dashboard-demo.git
4655
DEMO_EXPECTED_REPO ?= reponomics/reponomics-dashboard-demo
4756
DEMO_PUBLISH_MESSAGE ?= chore: publish generated demo
@@ -214,6 +223,18 @@ publish-template-dry-run: build-template ## Show the generated template publish
214223
publish-template: build-template ## Publish dist/template/ to the template repository main branch
215224
$(PYTHON) scripts/publish_generated_repo.py --output dist/template --remote $(TEMPLATE_REMOTE) --branch main --expected-repo $(TEMPLATE_EXPECTED_REPO) --message "$(TEMPLATE_PUBLISH_MESSAGE)" --push
216225

226+
staging-smoke: install ## Prepare or publish the copied staging dashboard smoke tree
227+
$(PYTHON) scripts/staging_smoke.py \
228+
--output $(STAGING_SMOKE_OUTPUT) \
229+
--remote $(STAGING_SMOKE_REMOTE) \
230+
--expected-repo $(STAGING_SMOKE_EXPECTED_REPO) \
231+
--branch $(STAGING_SMOKE_BRANCH) \
232+
--message "$(STAGING_SMOKE_MESSAGE)" \
233+
--evidence $(STAGING_SMOKE_EVIDENCE) \
234+
$(foreach repository,$(STAGING_SMOKE_REPOSITORIES),--repository $(repository)) \
235+
$(foreach repository,$(STAGING_SMOKE_PUBLISH_REPOSITORIES),--publish-repository $(repository)) \
236+
$(STAGING_SMOKE_PUSH)
237+
217238
build-demo: build-template ## Build the public demo repository tree in dist/demo/
218239
$(PYTHON) scripts/build_demo_repo.py --output dist/demo
219240

0 commit comments

Comments
 (0)