Repository navigation
ci: self-explanatory workflows and a separate workflow audit - #10
Merged
Merged
Conversation
…ction v2 - Move the zizmor job out of ci.yml into workflow-audit.yml (workflow "Workflow audit", job "Audit workflows"). The first-party @main exceptions move from inline ignores to .github/zizmor.yml. - Give every workflow a header comment and every job and step a name that says what it does. - Upgrade changesets/action to v2.1.2. The version commit, tags and releases are now created through the GitHub API with the vland-bot token, so GitHub signs the commit and CI runs on the version PR. - changesets/action v2 refuses to run with @changesets/cli v2, so bump @changesets/cli to ^3.0.3 and @changesets/changelog-github to ^1.0.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MrWogBto4w6eFAaVEkczQf
|
- Shorten header comments, job names and step names. - Keep changesets/action v1.9.0 and @changesets/cli v2. Pass the vland-bot token as github-token and set commitMode: github-api, so GitHub signs the version commit and tags and attributes them to vland-bot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MrWogBto4w6eFAaVEkczQf
rqbazan
changed the title
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MrWogBto4w6eFAaVEkczQf
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MrWogBto4w6eFAaVEkczQf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
Workflow audit
ci.ymlinto.github/workflows/workflow-audit.yml: workflowWorkflow audit, jobaudit-workflowsnamedAudit workflows, step🔒 Scan workflows. Triggers, permissions, pins, thepipxcommand and theGH_TOKENenv are unchanged..github/zizmor.ymlholds the reviewed exception: first-partywithvariablelab/*is tracked at@main, everything else must be hash-pinned. It replaces the inline# zizmor: ignore[unpinned-uses]comments.Version PR runs CI
changesets/actionstays at v1.9.0 (@changesets/clistays at v2). It now getsgithub-token: ${{ steps.app-token.outputs.token }}andcommitMode: github-api, so the version commit and tags are created through the GitHub API with the vland-bot token. GitHub signs them and attributes them to vland-bot, so CI runs on the version PR.env.GITHUB_TOKENstays set to the same token.Configure git userstays:.changeset/config.jsonsets"commit": true, sochangeset versioncommits locally first.id-token: write).Names
Job and step names are short.
Required status checks: old -> new
testtestTestaudit-workflows(waszizmor)zizmorAudit workflowsreleasereleaseReleasepreviewpreviewPublish previewpreview-commentpreview-comment / Comment preview releaseComment preview / Comment preview releaseThe "Require PR and checks" ruleset requires
testandzizmor. It must requireTestandAudit workflowsbefore this PR can merge.Verification
actionlint: clean.zizmor==1.30.1 --offline: no findings before or after. Running it with--no-configshows the 5@mainuses, which confirms that.github/zizmor.ymlis picked up.Can't be tested on this PR
The
releasejob only runs on push to main, socommitMode: github-apiruns for real for the first time after merge, when it updates #9.🤖 Generated with Claude Code
https://claude.ai/code/session_01MrWogBto4w6eFAaVEkczQf