Skip to content

feat(workflows): add optional per-job runner_type overrides #636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fredcamaral merged 5 commits into from
Jul 31, 2026
Merged

feat(workflows): add optional per-job runner_type overrides #636

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d4ab4d6
chore: clean up testing apps from deployment matrix and add streaming…
ferr3ira-gabriel Jul 31, 2026
51e9519
chore: register severino-testing-final in the deployment matrix
severino-provisioning[bot] Jul 31, 2026
c0214b5
chore: remove severino-testing-final from the deployment matrix
severino-provisioning[bot] Jul 31, 2026
5513648
feat(workflows): add optional per-job runner_type overrides
fredcamaral Jul 31, 2026
b1f9add
fix(workflows): address review feedback on runner override docs and j…
fredcamaral Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,10 @@ on:
description: 'Runner to use for the workflow'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
build_runner_type:
description: 'Optional runner override for the Build jobs only (prepare/notify stay on runner_type). Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
filter_paths:
description: 'Newline-separated list of path prefixes to filter. If not provided, builds from root.'
type: string
Expand Down Expand Up @@ -277,7 +281,7 @@ jobs:
build:
needs: prepare
if: needs.prepare.outputs.has_builds == 'true'
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.build_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C 12 \
  'pull_request|uses:.*build\.yml|checkout_ref|build_runner_type|id-token: write|packages: write' \
  .github/workflows

Repository: LerianStudio/github-actions-shared-workflows

Length of output: 50401

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- build.yml structure ---'
ast-grep outline .github/workflows/build.yml

printf '%s\n' '--- build.yml inputs, triggers, checkout, runner, and job conditions ---'
rg -n -C 8 \
  'workflow_call|workflow_dispatch|checkout_ref|build_runner_type|runs-on:|actions/checkout|if:' \
  .github/workflows/build.yml

printf '%s\n' '--- all build.yml callers ---'
rg -n -C 10 \
  'uses:\s+(\./)?\.github/workflows/build\.yml|uses:.*build\.yml' \
  .github/workflows

printf '%s\n' '--- caller trigger declarations ---'
python3 - <<'PY'
from pathlib import Path
import re

for path in Path(".github/workflows").glob("*.yml"):
    text = path.read_text()
    if re.search(r'uses:\s+.*build\.yml', text):
        print(f"\n### {path}")
        for i, line in enumerate(text.splitlines(), 1):
            if re.match(r'\s*(on:|workflow_call:|workflow_dispatch:|pull_request(?:_target)?:|push:|workflow_run:)', line):
                print(f"{i}:{line}")
PY

Repository: LerianStudio/github-actions-shared-workflows

Length of output: 19991

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- build.yml trigger and input definitions ---'
sed -n '1,205p' .github/workflows/build.yml

printf '%s\n' '--- go-release trigger and build caller conditions ---'
sed -n '1,80p' .github/workflows/go-release.yml
sed -n '400,470p' .github/workflows/go-release.yml
sed -n '610,655p' .github/workflows/go-release.yml

printf '%s\n' '--- every repository reference to build.yml ---'
rg -n -C 4 \
  'build\.yml|checkout_ref|build_runner_type|runner_type' \
  --glob '!*.log' \
  --glob '!node_modules/**' \
  .

printf '%s\n' '--- pull-request triggers in workflows that call reusable workflows ---'
python3 - <<'PY'
from pathlib import Path

for path in Path(".github/workflows").glob("*.yml"):
    lines = path.read_text().splitlines()
    has_build_call = any("build.yml" in line for line in lines)
    if not has_build_call:
        continue
    print(f"\n### {path}")
    for i, line in enumerate(lines, 1):
        if any(token in line for token in (
            "pull_request:", "pull_request_target:", "workflow_call:",
            "workflow_dispatch:", "push:", "workflow_run:"
        )):
            print(f"{i}:{line}")
PY

Repository: LerianStudio/github-actions-shared-workflows

Length of output: 50403

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- build workflow documentation and examples ---'
sed -n '1,125p' docs/build-workflow.md
sed -n '200,240p' docs/build-workflow.md

printf '%s\n' '--- repository guidance for pull_request runners and reusable callers ---'
rg -n -C 5 \
  'pull_request|self-hosted|workflow_call|external|build_runner_type|checkout_ref' \
  AGENTS.md docs .github/workflows \
  --glob '*.md' --glob '*.yml'

printf '%s\n' '--- static caller/event summary ---'
python3 - <<'PY'
from pathlib import Path
import re

for path in sorted(Path(".github/workflows").glob("*.yml")):
    text = path.read_text()
    if "build.yml" not in text:
        continue
    events = re.findall(
        r"^\s{0,4}(pull_request_target|pull_request|workflow_call|workflow_dispatch|workflow_run|push):",
        text,
        flags=re.MULTILINE,
    )
    calls = [
        line.strip()
        for line in text.splitlines()
        if "build.yml" in line and "uses:" in line
    ]
    print(path)
    print("events:", events or ["none"])
    print("calls:", calls)
PY

Repository: LerianStudio/github-actions-shared-workflows

Length of output: 50403

Block pull-request execution of this build job.

build.yml is callable by external repositories, has no event guard, and accepts unrestricted checkout_ref and build_runner_type inputs. A pull_request caller can therefore run fork-controlled Docker build code on a caller-selected runner, including a self-hosted runner. Reject pull-request events or restrict this workflow to trusted release callers and approved runners.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml at line 284, Restrict the build workflow’s
callable execution so pull-request callers cannot run it with fork-controlled
inputs. Update the job/workflow guards around the build entry point and runner
selection using the visible build_runner_type, runner_type, and checkout_ref
inputs, allowing only trusted release callers and approved runners while
preserving legitimate release builds.

name: Build ${{ matrix.app.name }}
permissions:
contents: read
Expand Down
24 changes: 20 additions & 4 deletions .github/workflows/go-pr-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,22 @@ on:
description: 'GitHub runner type'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
lint_runner_type:
description: 'Optional runner override for the Lint jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
test_runner_type:
description: 'Optional runner override for the Tests jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
coverage_runner_type:
description: 'Optional runner override for the Coverage jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
build_runner_type:
description: 'Optional runner override for the Build jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
filter_paths:
description: 'JSON array of paths to monitor for changes (e.g., ["apps/api", "apps/worker"]). If empty, treats repo as single-app and runs against root directory.'
type: string
Expand Down Expand Up @@ -143,7 +159,7 @@ jobs:
name: Lint (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_lint
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.lint_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -335,7 +351,7 @@ jobs:
name: Tests (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_tests
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.test_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -514,7 +530,7 @@ jobs:
name: Coverage (${{ matrix.app.name }})
needs: [detect-changes, tests]
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_coverage
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.coverage_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -795,7 +811,7 @@ jobs:
name: Build (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_build
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.build_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down
42 changes: 38 additions & 4 deletions .github/workflows/go-pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ on:
description: 'GitHub runner type to use'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
gate_runner_type:
description: 'Optional runner override for the umbrella utility jobs only (Detect non-doc changes and the Go Analysis / Security / Lib Version result gates). Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
dry_run:
description: 'Preview metadata validations without posting comments or labels'
required: false
Expand Down Expand Up @@ -82,12 +86,32 @@ on:
description: 'Target branches that require source branch validation (pipe-separated)'
type: string
default: 'main'
pr_checks_summary_runner_type:
description: 'Optional runner override for the PR Checks Summary job only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''

# ----------------- Go analysis (go-pr-analysis.yml) -----------------
go_version:
description: 'Go version to use'
type: string
default: '1.23'
lint_runner_type:
description: 'Optional runner override for the Go analysis Lint jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
test_runner_type:
description: 'Optional runner override for the Go analysis Tests jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
coverage_runner_type:
description: 'Optional runner override for the Go analysis Coverage jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
build_runner_type:
description: 'Optional runner override for the Go analysis Build jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
golangci_lint_version:
description: 'GolangCI-Lint version'
type: string
Expand Down Expand Up @@ -158,6 +182,10 @@ on:
description: 'Path to Trivy ignore file (e.g., .trivyignore.yaml)'
type: string
default: ''
security_scan_runner_type:
description: 'Optional runner override for the security_scan jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
enable_docker_scan:
description: 'Build and scan a Docker image with Trivy. Set to false for repos without a root Dockerfile (e.g. monorepos with Dockerfiles under components/ or cmd/).'
type: boolean
Expand Down Expand Up @@ -229,6 +257,7 @@ jobs:
uses: ./.github/workflows/pr-validation.yml
with:
runner_type: ${{ inputs.runner_type }}
pr_checks_summary_runner_type: ${{ inputs.pr_checks_summary_runner_type }}
dry_run: ${{ inputs.dry_run }}
pr_title_types: ${{ inputs.pr_title_types }}
pr_title_scopes: ${{ inputs.pr_title_scopes }}
Expand All @@ -248,7 +277,7 @@ jobs:
changes:
name: Detect non-doc changes
if: contains(fromJSON('["opened","edited","synchronize","reopened","ready_for_review"]'), github.event.action)
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.gate_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
permissions:
contents: read
pull-requests: read
Expand All @@ -270,6 +299,10 @@ jobs:
uses: ./.github/workflows/go-pr-analysis.yml
with:
runner_type: ${{ inputs.runner_type }}
lint_runner_type: ${{ inputs.lint_runner_type }}
test_runner_type: ${{ inputs.test_runner_type }}
coverage_runner_type: ${{ inputs.coverage_runner_type }}
build_runner_type: ${{ inputs.build_runner_type }}
go_version: ${{ inputs.go_version }}
golangci_lint_version: ${{ inputs.golangci_lint_version }}
golangci_lint_args: ${{ inputs.golangci_lint_args }}
Expand Down Expand Up @@ -300,7 +333,7 @@ jobs:
name: Go Analysis
needs: [changes, go-analysis]
if: always()
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.gate_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
steps:
- name: Aggregate Go Analysis result
uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1
Expand All @@ -316,6 +349,7 @@ jobs:
uses: ./.github/workflows/pr-security-scan.yml
with:
runner_type: ${{ inputs.runner_type }}
security_scan_runner_type: ${{ inputs.security_scan_runner_type }}
ignore_file: ${{ inputs.ignore_file }}
enable_docker_scan: ${{ inputs.enable_docker_scan }}
dockerfile_path: ${{ inputs.dockerfile_path }}
Expand All @@ -333,7 +367,7 @@ jobs:
name: Security
needs: [changes, security]
if: always()
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.gate_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
steps:
- name: Aggregate security result
uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1
Expand All @@ -359,7 +393,7 @@ jobs:
name: Lib Version
needs: [changes, lib-version]
if: always()
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.gate_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
steps:
- name: Aggregate Lib Version result
uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1
Expand Down
10 changes: 10 additions & 0 deletions .github/workflows/go-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,14 @@ on:
description: 'GitHub runner type to use'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
build_runner_type:
description: 'Optional runner override for the Build jobs only (forwarded to build.yml; prepare/notify stay on runner_type). Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
release_runner_type:
description: 'Optional runner override for the Release (publish) jobs only (forwarded to release.yml as publish_runner_type). Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
dry_run:
description: 'Reserved. Downstream release/build/gitops workflows do not yet expose a dry-run mode.'
required: false
Expand Down Expand Up @@ -393,6 +401,7 @@ jobs:
uses: ./.github/workflows/release.yml
with:
runner_type: ${{ inputs.runner_type }}
publish_runner_type: ${{ inputs.release_runner_type }}
semantic_version: ${{ inputs.semantic_version }}
enable_changelog: ${{ inputs.enable_changelog }}
enable_major_tag: ${{ inputs.enable_major_tag }}
Expand Down Expand Up @@ -433,6 +442,7 @@ jobs:
release_version: ${{ github.ref_type == 'branch' && needs.release.outputs.new_release_version || '' }}
checkout_ref: ${{ github.ref_type == 'branch' && needs.release.outputs.new_release_git_tag || '' }}
runner_type: ${{ inputs.runner_type }}
build_runner_type: ${{ inputs.build_runner_type }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
enable_dockerhub: ${{ inputs.enable_dockerhub }}
enable_ghcr: ${{ inputs.enable_ghcr }}
enable_gitops_artifacts: ${{ inputs.enable_gitops_artifacts }}
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/pr-security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ on:
description: 'GitHub runner type to use'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
security_scan_runner_type:
description: 'Optional runner override for the security_scan jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
filter_paths:
description: 'Paths to monitor for changes (newline separated). If not provided, treats as single app repo'
type: string
Expand Down Expand Up @@ -161,7 +165,7 @@ jobs:
security_scan:
needs: prepare_matrix
if: needs.prepare_matrix.outputs.matrix != '[]'
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.security_scan_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
max-parallel: 1
fail-fast: false
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ on:
description: 'GitHub runner type to use'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
pr_checks_summary_runner_type:
description: 'Optional runner override for the PR Checks Summary job only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
dry_run:
description: Preview validations without posting comments or labels
required: false
Expand Down Expand Up @@ -174,7 +178,7 @@ jobs:
# ----------------- PR Checks Summary -----------------
pr-checks-summary:
name: PR Checks Summary
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.pr_checks_summary_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
needs: [blocking-checks, advisory-checks]
if: always()

Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ on:
description: 'Runner to use for the workflow'
type: string
default: 'blacksmith-4vcpu-ubuntu-2404'
publish_runner_type:
description: 'Optional runner override for the Release (publish) jobs only. Empty = vars.GENERAL_RUNNERS, then runner_type.'
type: string
default: ''
Comment thread
coderabbitai[bot] marked this conversation as resolved.
filter_paths:
description: 'Newline-separated list of path prefixes to filter. If not provided, treats as single app repo.'
type: string
Expand Down Expand Up @@ -185,7 +189,7 @@ jobs:
publish_release:
needs: prepare
if: needs.prepare.outputs.has_changes == 'true' && needs.prepare.outputs.should_skip != 'true'
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
runs-on: ${{ inputs.publish_runner_type || vars.GENERAL_RUNNERS || inputs.runner_type }}
environment:
name: create_release
name: Release ${{ matrix.app.name }}
Expand Down
17 changes: 2 additions & 15 deletions config/deployment-matrix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ apps:
- br-ccs
- br-sisbajud
- br-consignado-gw
- streaming-hub

# Test/mock infrastructure
- mock-btg-server # benedita only (-st variant); companion to plugin-br-pix-indirect-btg
Expand All @@ -107,12 +108,6 @@ apps:
- rosiehr # internal HR app (benedita only); values at cross/
- go-boilerplate-ddd # Go service boilerplate (reference/template)

# Provisioned by Severino (app-provisioning automation)
- severino-teste-4
- severino-teste-5
- severino-teste-6
- severino-teste-7

clusters:
anacleto:
# Anacleto hosts two parallel test types (chaos, fuzzing), each with two
Expand All @@ -137,10 +132,6 @@ clusters:
- lender
- ungoliant-controller

# Provisioned by Severino (app-provisioning automation)
- severino-teste-6
- severino-teste-7

benedita:
# Benedita hosts two parallel variants per environment as sibling namespaces:
# single-tenant (-st): dev-st, stg-st, prd-st
Expand Down Expand Up @@ -200,8 +191,4 @@ clusters:
- rosiehr
- go-boilerplate-ddd
- severino-bot

# Provisioned by Severino (app-provisioning automation)
- severino-teste-4
- severino-teste-5
- severino-teste-6
- streaming-hub
1 change: 1 addition & 0 deletions docs/build-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ jobs:
| Input | Type | Default | Description |
|-------|------|---------|-------------|
| `runner_type` | string | `firmino-lxc-runners` | GitHub runner type |
| `build_runner_type` | string | `''` | Optional runner override for the Build jobs only (prepare/notify stay on `runner_type`); empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` |
| `filter_paths` | string | `''` | Newline-separated list of path prefixes. If empty, builds from root (single-app mode) |
| `path_level` | string | `2` | Directory depth for app name extraction |
| `enable_dockerhub` | boolean | `true` | Enable pushing to DockerHub |
Expand Down
4 changes: 4 additions & 0 deletions docs/go-pr-analysis-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,10 @@ jobs:
| Input | Description | Required | Default |
|-------|-------------|----------|---------|
| `runner_type` | GitHub runner type | No | `firmino-lxc-runners` |
| `lint_runner_type` | Optional runner override for the Lint jobs only; empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` | No | `''` |
| `test_runner_type` | Optional runner override for the Tests jobs only | No | `''` |
| `coverage_runner_type` | Optional runner override for the Coverage jobs only | No | `''` |
| `build_runner_type` | Optional runner override for the Build jobs only | No | `''` |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
| `filter_paths` | JSON array of paths to monitor for changes. If empty, treats repo as single-app. | No | `''` |
| `path_level` | Directory depth level to extract app name | No | `2` |
| `normalize_to_filter` | Collapse every changed file under a `filter_paths` entry into that one component (`working_dir` = the filter itself) instead of the `path_level`-trimmed directory. With `false`, a change deeper than `path_level` segments inside a filtered component spawns a bogus matrix entry rooted at that subdirectory — no testable package, so no `coverage.txt`, and the coverage job fails with "Artifact not found". | No | `true` |
Expand Down
7 changes: 7 additions & 0 deletions docs/go-pr-validation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,13 @@ The `go-analysis`, `security` and `lib-version` pipelines each have a `*-gate` a
| Input | Description | Type | Default |
|-------|-------------|------|---------|
| `runner_type` | GitHub runner type | string | `blacksmith-4vcpu-ubuntu-2404` |
| `gate_runner_type` | Optional runner override for the umbrella utility jobs only (Detect non-doc changes + Go Analysis / Security / Lib Version result gates); empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` | string | `''` |
| `lint_runner_type` | Optional runner override for the Go analysis Lint jobs only | string | `''` |
| `test_runner_type` | Optional runner override for the Go analysis Tests jobs only | string | `''` |
| `coverage_runner_type` | Optional runner override for the Go analysis Coverage jobs only | string | `''` |
| `build_runner_type` | Optional runner override for the Go analysis Build jobs only | string | `''` |
| `security_scan_runner_type` | Optional runner override for the security_scan jobs only | string | `''` |
| `pr_checks_summary_runner_type` | Optional runner override for the PR Checks Summary job only | string | `''` |
Comment on lines +26 to +31

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Keep runner input tables synchronized with the fallback contract.

The new runner inputs use the same empty-value resolution: vars.GENERAL_RUNNERS, then runner_type. The documentation omits this contract in both tables.

  • docs/go-pr-validation.md#L26-L31: add the fallback chain to lint_runner_type, test_runner_type, coverage_runner_type, build_runner_type, security_scan_runner_type, and pr_checks_summary_runner_type.
  • docs/go-release-workflow.md#L30-L30: add the fallback chain to release_runner_type.

As per path instructions, keep the inputs table synchronized with the corresponding workflow changes in this PR.

📍 Affects 2 files
  • docs/go-pr-validation.md#L26-L31 (this comment)
  • docs/go-release-workflow.md#L30-L30
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/go-pr-validation.md` around lines 26 - 31, Update the inputs tables to
document the fallback chain vars.GENERAL_RUNNERS, then runner_type for all six
inputs in docs/go-pr-validation.md lines 26-31: lint_runner_type,
test_runner_type, coverage_runner_type, build_runner_type,
security_scan_runner_type, and pr_checks_summary_runner_type. Apply the same
documentation update to release_runner_type in docs/go-release-workflow.md line
30, keeping both tables synchronized with the workflow behavior.

Source: Path instructions

| `dry_run` | Preview metadata validations without posting comments/labels | boolean | `false` |
| `run_go_analysis` | Run the Go analysis pipeline | boolean | `true` |
| `run_security` | Run the security scan pipeline | boolean | `true` |
Expand Down
2 changes: 2 additions & 0 deletions docs/go-release-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ A third layout needs `release_single_app: true`: **one semantic-release tag for
| Input | Description | Type | Default |
|-------|-------------|------|---------|
| `runner_type` | GitHub runner type | string | `blacksmith-4vcpu-ubuntu-2404` |
| `build_runner_type` | Optional runner override for the Build jobs only (forwarded to build.yml; prepare/notify stay on `runner_type`); empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` | string | `''` |
| `release_runner_type` | Optional runner override for the Release (publish) jobs only (forwarded to release.yml as `publish_runner_type`) | string | `''` |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
| `dry_run` | Reserved (downstream workflows have no dry-run mode yet) | boolean | `false` |
| `ignore_globs` | Space-separated globs treated as docs/meta for the branch-push gate | string | `*.md docs/* .github/* LICENSE* .gitignore` |
| `semantic_version` | semantic-release version | string | `23.0.8` |
Expand Down
1 change: 1 addition & 0 deletions docs/pr-security-scan-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,7 @@ The detection regex can be overridden centrally through the optional **organizat
| Input | Type | Default | Description |
|-------|------|---------|-------------|
| `runner_type` | string | `blacksmith-4vcpu-ubuntu-2404` | GitHub runner type |
| `security_scan_runner_type` | string | `''` | Optional runner override for the security_scan jobs only; empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` |
| `filter_paths` | string | - | Paths to monitor (newline separated). If empty, treats as single app |
| `path_level` | string | `2` | Directory depth level to extract app name (monorepo only) |
| `monorepo_type` | string | `type1` | Monorepo type: `type1` or `type2` |
Expand Down
1 change: 1 addition & 0 deletions docs/pr-validation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ jobs:
| Input | Type | Default | Description |
|-------|------|---------|-------------|
| `runner_type` | string | `blacksmith-4vcpu-ubuntu-2404` | GitHub runner type |
| `pr_checks_summary_runner_type` | string | `''` | Optional runner override for the PR Checks Summary job only; empty falls back to `vars.GENERAL_RUNNERS`, then `runner_type` |
| `dry_run` | boolean | `false` | Preview validations without posting comments or labels |
| `pr_title_types` | string | (see below) | Allowed commit types (newline-separated) |
| `pr_title_scopes` | string | `''` | Allowed scopes (newline-separated, empty = any) |
Expand Down
Loading
Loading