Skip to content

chore(ci): rebuild & harden workflows #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tomtastisch merged 31 commits into from
Feb 10, 2026
Merged

chore(ci): rebuild & harden workflows #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
03b1084
phase1: normalize ci workflow orchestration
Feb 9, 2026
3d4f58d
phase2: confirm canonical version-policy PR check
Feb 9, 2026
27a63c7
phase3: harden qodana gating and scoped excludes
Feb 9, 2026
0d88974
phase4: enforce artifact contract for all required ci checks
Feb 9, 2026
b7f2de5
phase5: add sscc error ux and structured diagnostics
Feb 9, 2026
d6e9ff0
phase6: keep current duplication boundaries for safety
Feb 9, 2026
31e4540
phase4: include pack artifact in summary contract aggregation
Feb 9, 2026
f270da2
ci: make diag.json valid JSON and document CI DAG/contracts
Feb 9, 2026
9a1e618
Update tools/ci/lib/result.sh
tomtastisch Feb 9, 2026
9ab6e35
fix(ci): apply computed PR labels and verify outcome
Feb 9, 2026
1eca61b
phase1(ci): normalize orchestration shape in ci.yml without context c…
Feb 9, 2026
0c33ba3
phase2(version-policy): no-change deconfliction (single canonical PR …
Feb 9, 2026
1e13d55
phase3(qodana): no-change on branch (contract already green, threshol…
Feb 9, 2026
379ba8b
phase4(result): enforce fail-closed result schema validation for all …
Feb 9, 2026
3ce53ef
phase5(error-ux): resolve artifact deep-link via GitHub API with 9901…
Feb 9, 2026
f477731
phase6(ci): eliminate flaky GH API duplication with deterministic ret…
Feb 9, 2026
3e41bac
phase7(verify): finalize evidence pack and DoD verification
Feb 9, 2026
62a1e54
phase6(ci): switch pr-labeling to single REST PUT label sync for dete…
Feb 9, 2026
254acdb
phase1(ci): remove redundant job name and permissions
github-actions[bot] Feb 10, 2026
1be81ca
chore: update FileTypeOptions
github-actions[bot] Feb 10, 2026
890475b
ci: fix version-policy artifact + fail-closed finalize
github-actions[bot] Feb 10, 2026
2f8a562
style: format FileTypeOptions
github-actions[bot] Feb 10, 2026
e85bac8
ci: fix result schema path (no more tools/tools)
github-actions[bot] Feb 10, 2026
3e53c51
ci: finalize before exit for fail-closed (no set +e)
github-actions[bot] Feb 10, 2026
6e3d709
ci: require+verify ci-versioning-svt artifact in version-policy
github-actions[bot] Feb 10, 2026
9bff1a7
ci: use curl+python for version-policy artifact verify (no gh)
github-actions[bot] Feb 10, 2026
ad8287c
ci: fetch tags for versioning-svt (checkout hardening)
github-actions[bot] Feb 10, 2026
f615f04
ci: shrink version-policy verify run block (preflight CI-SHELL-004)
github-actions[bot] Feb 10, 2026
4e75369
chore(ci): replace gh api with curl+python
github-actions[bot] Feb 10, 2026
1fcba4f
chore(ci): address review threads
github-actions[bot] Feb 10, 2026
5fc241c
ci(qodana): grant checks/pr write permissions for annotations
github-actions[bot] Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 31 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,14 @@ concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

env:
LC_ALL: C.UTF-8
LANG: C.UTF-8

defaults:
run:
shell: bash

jobs:
pr-labeling:
if: github.event_name == 'pull_request'
Expand All @@ -27,6 +35,7 @@ jobs:
uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-tags: true
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
Expand All @@ -40,7 +49,7 @@ jobs:
- name: Run Entry Check
env:
GH_TOKEN: ${{ github.token }}
run: bash tools/ci/bin/run.sh pr-labeling
run: bash -euo pipefail tools/ci/bin/run.sh pr-labeling
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -56,6 +65,7 @@ jobs:
uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-tags: true
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
Expand All @@ -67,7 +77,7 @@ jobs:
with:
node-version: "20"
- name: Run Entry Check
run: bash tools/ci/bin/run.sh preflight
run: bash -euo pipefail tools/ci/bin/run.sh preflight
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -89,7 +99,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh docs-links-full
run: bash -euo pipefail tools/ci/bin/run.sh docs-links-full
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -104,14 +114,17 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-tags: true
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
dotnet-version: |
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh versioning-svt
run: bash -euo pipefail tools/ci/bin/run.sh versioning-svt
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -133,7 +146,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh naming-snt
run: bash -euo pipefail tools/ci/bin/run.sh naming-snt
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -155,7 +168,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh build
run: bash -euo pipefail tools/ci/bin/run.sh build
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -177,7 +190,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh api-contract
run: bash -euo pipefail tools/ci/bin/run.sh api-contract
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -199,7 +212,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh pack
run: bash -euo pipefail tools/ci/bin/run.sh pack
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -226,7 +239,7 @@ jobs:
name: ci-pack
path: artifacts/ci/pack
- name: Run Entry Check
run: bash tools/ci/bin/run.sh consumer-smoke
run: bash -euo pipefail tools/ci/bin/run.sh consumer-smoke
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -253,7 +266,7 @@ jobs:
name: ci-pack
path: artifacts/ci/pack
- name: Run Entry Check
run: bash tools/ci/bin/run.sh package-backed-tests
run: bash -euo pipefail tools/ci/bin/run.sh package-backed-tests
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -275,7 +288,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh security-nuget
run: bash -euo pipefail tools/ci/bin/run.sh security-nuget
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand All @@ -297,7 +310,7 @@ jobs:
8.0.x
10.0.102
- name: Run Entry Check
run: bash tools/ci/bin/run.sh tests-bdd-coverage
run: bash -euo pipefail tools/ci/bin/run.sh tests-bdd-coverage
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand Down Expand Up @@ -333,6 +346,11 @@ jobs:
with:
name: ci-api-contract
path: artifacts/ci/api-contract
- name: Download Pack Artifact
uses: actions/download-artifact@v4
with:
name: ci-pack
path: artifacts/ci/pack
- name: Download Consumer Smoke Artifact
uses: actions/download-artifact@v4
with:
Expand Down Expand Up @@ -369,7 +387,7 @@ jobs:
name: ci-tests-bdd-coverage
path: artifacts/ci/tests-bdd-coverage
- name: Run Entry Check
run: bash tools/ci/bin/run.sh summary
run: bash -euo pipefail tools/ci/bin/run.sh summary
- name: Upload Artifact
if: always()
uses: actions/upload-artifact@v4
Expand Down
7 changes: 3 additions & 4 deletions .github/workflows/qodana.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ on:

permissions:
contents: read
checks: write
pull-requests: write
security-events: write

jobs:
Expand Down Expand Up @@ -44,11 +46,8 @@ jobs:
if [ -f .editorconfig.qodana.bak ]; then
mv .editorconfig.qodana.bak .editorconfig
fi
- name: Skip Qodana (missing token)
if: env.QODANA_TOKEN == ''
run: echo "QODANA_TOKEN is not set; skipping Qodana scan."
- name: Run Entry Check
if: env.QODANA_TOKEN != ''
if: always() && env.QODANA_TOKEN != ''
run: bash tools/ci/bin/run.sh qodana
Comment thread
tomtastisch marked this conversation as resolved.
- name: Upload SARIF To Code Scanning
if: github.event_name != 'pull_request' && env.QODANA_TOKEN != ''
Expand Down
20 changes: 20 additions & 0 deletions .github/workflows/version-policy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,29 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-tags: true
- name: Setup .NET SDK
uses: actions/setup-dotnet@v4
with:
dotnet-version: 10.0.x
- name: Run versioning SVT (PR-safe)
env:
CI_DEFER_ARTIFACT_LINK_RESOLUTION: "1"
run: bash tools/ci/bin/run.sh versioning-svt
- name: Upload versioning SVT artifact (ci-versioning-svt)
if: always()
uses: actions/upload-artifact@v4
with:
name: ci-versioning-svt
path: artifacts/ci/versioning-svt/
if-no-files-found: error
- name: Verify ci-versioning-svt artifact exists (post-upload)
if: always()
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
out="artifacts/ci/versioning-svt/version-policy_artifacts.json"
python3 tools/ci/bin/verify_run_artifact.py --repo "${GITHUB_REPOSITORY}" --run-id "${GITHUB_RUN_ID}" --artifact-name "ci-versioning-svt" --out "$out"
Loading
Loading