Skip to content

Commit f434a01

Browse files
sarg3ntsarg3nt
committed
feat: Add monthly release workflow and PR labeler
- Implemented `monthly-release.yml` for automated monthly releases with versioning and changelog generation. - Created `labeler.yml` to automatically label PRs based on changed paths. - Updated `release.yml` to enhance security and build processes, including: - Renaming jobs and binaries for consistency. - Pinning action versions to specific SHAs for stability. - Adding build provenance attestation and SBOM generation. - Enhanced security workflows (`security.yml`) with hardened runners and updated action versions. - Introduced `scorecard.yml` for OpenSSF Scorecard analysis to improve supply chain security. - Cleaned up workflows by removing unused configurations and ensuring consistent permissions.
1 parent 2510a91 commit f434a01

15 files changed

Lines changed: 843 additions & 360 deletions

‎.github/dependabot.yml‎

Lines changed: 87 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -3,56 +3,92 @@
33

44
version: 2
55
updates:
6-
# Go modules for HAProxy monitoring application
7-
- package-ecosystem: "gomod"
8-
directory: "/gearbox"
9-
schedule:
10-
interval: "monthly"
11-
time: "09:00"
12-
open-pull-requests-limit: 5
13-
labels:
14-
- "dependencies"
15-
- "go"
16-
commit-message:
17-
prefix: "chore(deps)"
18-
include: "scope"
19-
groups:
20-
go-dependencies:
21-
patterns:
22-
- "*"
6+
# Go modules for gearbox dashboard
7+
- package-ecosystem: "gomod"
8+
directory: "/gearbox"
9+
schedule:
10+
interval: "monthly"
11+
time: "09:00"
12+
open-pull-requests-limit: 5
13+
labels:
14+
- "dependencies"
15+
- "go"
16+
commit-message:
17+
prefix: "chore(deps)"
18+
include: "scope"
19+
groups:
20+
go-dependencies:
21+
patterns:
22+
- "*"
2323

24-
# GitHub Actions
25-
- package-ecosystem: "github-actions"
26-
directory: "/"
27-
schedule:
28-
interval: "monthly"
29-
time: "09:00"
30-
open-pull-requests-limit: 5
31-
labels:
32-
- "dependencies"
33-
- "github-actions"
34-
commit-message:
35-
prefix: "chore(deps)"
36-
include: "scope"
37-
groups:
38-
github-actions:
39-
patterns:
40-
- "*"
24+
# Go modules for gearbox-agent
25+
- package-ecosystem: "gomod"
26+
directory: "/gearbox-agent"
27+
schedule:
28+
interval: "monthly"
29+
time: "09:00"
30+
open-pull-requests-limit: 5
31+
labels:
32+
- "dependencies"
33+
- "go"
34+
commit-message:
35+
prefix: "chore(deps)"
36+
include: "scope"
37+
groups:
38+
go-dependencies:
39+
patterns:
40+
- "*"
4141

42-
# Docker base images
43-
- package-ecosystem: "docker"
44-
directory: "/gearbox"
45-
schedule:
46-
interval: "monthly"
47-
time: "09:00"
48-
open-pull-requests-limit: 3
49-
labels:
50-
- "dependencies"
51-
- "docker"
52-
commit-message:
53-
prefix: "chore(deps)"
54-
include: "scope"
55-
groups:
56-
docker-images:
57-
patterns:
58-
- "*"
42+
# GitHub Actions
43+
- package-ecosystem: "github-actions"
44+
directory: "/"
45+
schedule:
46+
interval: "monthly"
47+
time: "09:00"
48+
open-pull-requests-limit: 5
49+
labels:
50+
- "dependencies"
51+
- "github-actions"
52+
commit-message:
53+
prefix: "chore(deps)"
54+
include: "scope"
55+
groups:
56+
github-actions:
57+
patterns:
58+
- "*"
59+
60+
# Docker base images for gearbox
61+
- package-ecosystem: "docker"
62+
directory: "/gearbox"
63+
schedule:
64+
interval: "monthly"
65+
time: "09:00"
66+
open-pull-requests-limit: 3
67+
labels:
68+
- "dependencies"
69+
- "docker"
70+
commit-message:
71+
prefix: "chore(deps)"
72+
include: "scope"
73+
groups:
74+
docker-images:
75+
patterns:
76+
- "*"
77+
78+
# Docker base images for gearbox-agent
79+
- package-ecosystem: "docker"
80+
directory: "/gearbox-agent"
81+
schedule:
82+
interval: "monthly"
83+
time: "09:00"
84+
open-pull-requests-limit: 3
85+
labels:
86+
- "dependencies"
87+
- "docker"
88+
commit-message:
89+
prefix: "chore(deps)"
90+
include: "scope"
91+
groups:
92+
docker-images:
93+
patterns:
94+
- "*"

‎.github/labeler.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
dashboard:
2+
- changed-files:
3+
- any-glob-to-any-file: 'gearbox/**'
4+
5+
agent:
6+
- changed-files:
7+
- any-glob-to-any-file: 'gearbox-agent/**'
8+
9+
docs:
10+
- changed-files:
11+
- any-glob-to-any-file:
12+
- 'docs/**'
13+
- '**/*.md'
14+
15+
ci:
16+
- changed-files:
17+
- any-glob-to-any-file: '.github/**'
18+
19+
dependencies:
20+
- changed-files:
21+
- any-glob-to-any-file:
22+
- '**/go.mod'
23+
- '**/go.sum'
24+
- '**/package.json'
25+
- '**/package-lock.json'
26+
- '.github/dependabot.yml'

‎.github/renovate.json‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎.github/workflows/ci-agent.yml‎

Lines changed: 38 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,41 @@ name: CI - Agent
22

33
on:
44
push:
5-
branches: [main, develop]
5+
branches: [main]
66
paths:
77
- 'gearbox-agent/**'
88
- '.github/workflows/ci-agent.yml'
99
pull_request:
10-
branches: [main, develop]
10+
branches: [main]
1111
paths:
1212
- 'gearbox-agent/**'
1313
- '.github/workflows/ci-agent.yml'
1414

15-
permissions:
16-
contents: read
15+
permissions: {}
1716

1817
jobs:
1918
test:
2019
name: Test
2120
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
2223
defaults:
2324
run:
2425
working-directory: ./gearbox-agent
2526

2627
steps:
28+
- name: Harden runner
29+
uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2
30+
with:
31+
egress-policy: audit
32+
2733
- name: Checkout code
28-
uses: actions/checkout@v6
34+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
2935

3036
- name: Set up Go
31-
uses: actions/setup-go@v6
37+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
3238
with:
33-
go-version: '1.25'
34-
cache-dependency-path: gearbox-agent/go.sum
39+
go-version-file: gearbox-agent/go.mod
3540

3641
- name: Download dependencies
3742
run: go mod download
@@ -40,7 +45,7 @@ jobs:
4045
run: go test -v -race -coverprofile=coverage.out ./...
4146

4247
- name: Upload coverage to Codecov
43-
uses: codecov/codecov-action@v5
48+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
4449
with:
4550
files: ./gearbox-agent/coverage.out
4651
flags: agent-unittests
@@ -51,43 +56,56 @@ jobs:
5156
lint:
5257
name: Lint
5358
runs-on: ubuntu-latest
59+
permissions:
60+
contents: read
5461
defaults:
5562
run:
5663
working-directory: ./gearbox-agent
5764

5865
steps:
66+
- name: Harden runner
67+
uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2
68+
with:
69+
egress-policy: audit
70+
5971
- name: Checkout code
60-
uses: actions/checkout@v6
72+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
6173

6274
- name: Set up Go
63-
uses: actions/setup-go@v6
75+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
6476
with:
65-
go-version: '1.25'
66-
cache-dependency-path: gearbox-agent/go.sum
77+
go-version-file: gearbox-agent/go.mod
6778

6879
- name: Run golangci-lint
69-
uses: golangci/golangci-lint-action@v9
80+
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
7081
with:
71-
version: latest
82+
version: v2.8.0
7283
working-directory: ./gearbox-agent
7384
args: --timeout=5m
7485

7586
build:
7687
name: Build
88+
needs: [test, lint]
7789
runs-on: ubuntu-latest
90+
permissions:
91+
contents: read
7892
defaults:
7993
run:
8094
working-directory: ./gearbox-agent
8195

8296
steps:
97+
- name: Harden runner
98+
uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2
99+
with:
100+
egress-policy: audit
101+
83102
- name: Checkout code
84-
uses: actions/checkout@v6
103+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
85104

86105
- name: Set up Go
87-
uses: actions/setup-go@v6
106+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
88107
with:
89-
go-version: '1.25'
90-
cache-dependency-path: gearbox-agent/go.sum
108+
go-version-file: gearbox-agent/go.mod
91109

92110
- name: Download dependencies
93111
run: go mod download
@@ -100,7 +118,7 @@ jobs:
100118
./cmd/gearbox-agent
101119
102120
- name: Upload binary artifact
103-
uses: actions/upload-artifact@v6
121+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
104122
with:
105123
name: gearbox-agent-${{ github.sha }}
106124
path: gearbox-agent/bin/gearbox-agent

0 commit comments

Comments
 (0)