Skip to content

fix(pr-validation): pin composite refs to v1.20.0#172

Merged
bedatty merged 4 commits intodevelopfrom
fix/pin-refs-v1.20.0
Mar 26, 2026
Merged

fix(pr-validation): pin composite refs to v1.20.0#172
bedatty merged 4 commits intodevelopfrom
fix/pin-refs-v1.20.0

Conversation

@bedatty
Copy link
Copy Markdown
Contributor

@bedatty bedatty commented Mar 26, 2026

Lerian

GitHub Actions Shared Workflows


Description

Pin pr-validation composite refs from v1.20.0-beta.1 to stable v1.20.0. Also adds missing README for pr-blocking-collect composite and pins its ref.

Type of Change

  • feat: New workflow or new input/output/step in an existing workflow
  • fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
  • perf: Performance improvement (e.g. caching, parallelism, reduced steps)
  • refactor: Internal restructuring with no behavior change
  • docs: Documentation only (README, docs/, inline comments)
  • ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
  • chore: Dependency bumps, config updates, maintenance
  • test: Adding or updating tests
  • BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

  • YAML syntax validated locally
  • Triggered a real workflow run on a caller repository using @develop or the beta tag
  • Verified all existing inputs still work with default values
  • Confirmed no secrets or tokens are printed in logs
  • Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Summary by CodeRabbit

  • Chores
    • Updated PR validation workflow to use stable versions of shared validation workflows.
    • Replaced ad-hoc inline enforcement with a reusable blocking-collection step to aggregate and enforce blocking check outcomes.
    • Added documentation for the new blocking-collection step, including usage and required permissions.

@bedatty bedatty requested a review from a team as a code owner March 26, 2026 13:37
@lerian-studio lerian-studio added size/XS PR changes < 50 lines workflow Changes to one or more reusable workflow files labels Mar 26, 2026
@lerian-studio
Copy link
Copy Markdown

lerian-studio commented Mar 26, 2026

🔍 Lint Analysis

Check Files Scanned Status
YAML Lint 2 file(s) ✅ success
Action Lint 1 file(s) ✅ success
Pinned Actions 2 file(s) ✅ success
Markdown Link Check 1 file(s) ✅ success
Spelling Check 3 file(s) ✅ success
Shell Check 2 file(s) ✅ success
README Check 2 file(s) ✅ success
Composite Schema 1 file(s) ✅ success
⚠️ Warnings (2)

Pinned Actions

.github

  • .github (line 81) — Found 1 internal action(s) not pinned to a version. Consider pinning to vX.Y.Z.

.github/workflows/pr-validation.yml

  • .github/workflows/pr-validation.yml (line 122) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/validate/pr-blocking-collect@fix/pin-refs-v1.20.0

🔍 View full scan logs

@lerian-studio
Copy link
Copy Markdown

lerian-studio commented Mar 26, 2026

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.


🔍 View full scan logs | 🛡️ Security tab

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 26, 2026

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e2d130f3-c4d3-472e-b9b5-ced4a86c810f

📥 Commits

Reviewing files that changed from the base of the PR and between bd7fc56 and b4f95c9.

📒 Files selected for processing (1)
  • src/validate/pr-blocking-collect/README.md

Walkthrough

Updated PR validation workflow refs to pinned tag @v1.20.0 and replaced an inline blocking-aggregation script with a reusable composite action pr-blocking-collect. Added the composite action and a README describing inputs, outputs, and failure behavior.

Changes

Cohort / File(s) Summary
PR validation workflow
.github/workflows/pr-validation.yml
Pinned reusable workflow/action refs from @v1.20.0-beta.1 to @v1.20.0. Replaced the inline "Collect results and enforce blocking" shell step with the reusable pr-blocking-collect@fix/pin-refs-v1.20.0, passing per-check outcomes. Applies to Tier 1 blocking checks, Tier 2 advisory checks, pr-checks-summary, and Slack notification usage.
New composite action
src/validate/pr-blocking-collect/action.yml
Added composite GitHub Action pr-blocking-collect with inputs source-branch-outcome (default skipped), title-outcome, description-outcome; outputs source_branch, title, description; and a step that emits outputs and exits non‑zero if any outcome equals failure.
New action docs
src/validate/pr-blocking-collect/README.md
Added README documenting inputs, outputs, defaults, example usage, and required workflow permissions for the pr-blocking-collect composite action.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately and concisely describes the main objective: pinning composite action references from a beta version to the stable v1.20.0 release.
Description check ✅ Passed The description addresses the template requirements: clearly summarizes changes, correctly marks the PR as a 'fix' type, documents testing performed, and properly sets 'Breaking Changes' to 'None'.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/pin-refs-v1.20.0

Comment @coderabbitai help to get the list of available commands and usage tips.

@lerian-studio lerian-studio added size/S PR changes 50–199 lines and removed size/XS PR changes < 50 lines labels Mar 26, 2026
coderabbitai[bot]
coderabbitai bot previously requested changes Mar 26, 2026
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/validate/pr-blocking-collect/README.md`:
- Line 8: The README currently says the action "writes them as job outputs"
which is incorrect for a composite action; update the sentence that begins
"Collects outcomes from blocking validation checks, writes them as job outputs,
and fails the job..." to state that the action exposes those results as step
outputs (e.g., "writes them as step outputs") and add a brief note that the
calling workflow must promote step outputs to job outputs if desired; look for
the exact phrase "writes them as job outputs" to locate and replace.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4085ae2f-c0f0-4d8f-8664-65fc8ec717ae

📥 Commits

Reviewing files that changed from the base of the PR and between 823880d and 55d36b3.

📒 Files selected for processing (2)
  • .github/workflows/pr-validation.yml
  • src/validate/pr-blocking-collect/README.md

@bedatty bedatty merged commit 20b73d4 into develop Mar 26, 2026
16 checks passed
@github-actions github-actions bot deleted the fix/pin-refs-v1.20.0 branch March 26, 2026 14:25
@bedatty bedatty restored the fix/pin-refs-v1.20.0 branch March 26, 2026 14:27
bedatty added a commit that referenced this pull request Mar 26, 2026
* refactor(pr-validation): modularize workflow into composites under src/validate/

Extract all inline business logic from pr-validation.yml into 7 reusable
composite actions under src/validate/. Add dry_run input, fix script injection
risks (use env vars instead of direct interpolation), fix notify ref for
external callers, and update conventions to prohibit workflow_dispatch on
reusable workflows due to injection risk.

* fix(pr-validation): address CodeRabbit and CodeQL review findings

- Fix code-injection: move needs.*.result and inputs.dry_run to env vars
  in pr-checks-summary job (use process.env instead of ${{ }} interpolation)
- Wire MANAGE_TOKEN into auto-labeler job (was hardcoded to github.token)
- Include pr-changelog in Slack notification status and failed_jobs
- Handle empty git diff output in pr-size (CHANGED_LINES defaults to 0)
- Support all * wildcard patterns in pr-source-branch (not just /*)
- Fix broken markdown links in docs (add -workflow suffix)
- Fix docs examples to use @v1.2.3 placeholder instead of @v1.x.x
- Update jobs table with non-draft condition for all gated jobs

* fix(helm-update-chart): use VALUES_KEY for template file paths instead of COMP_NAME

The workflow was using COMP_NAME to build configmap/secret template paths
(e.g. templates/plugin-br-pix-indirect-btg-worker-inbound/configmap.yaml)
but the actual directory structure uses VALUES_KEY names
(e.g. templates/inbound/configmap.yaml).

This caused the if [ -f ] check to silently fail, resulting in detected
env vars never being injected into configmap/secret templates.

Changes:
- Use VALUES_KEY for CONFIGMAP_FILE and SECRET_FILE paths
- Update create_secret_template to take VALUES_KEY as single arg
- Add ::warning:: annotations when template files are not found

Closes #167

* fix(helm-update-chart): quote GITHUB_OUTPUT and GITHUB_STEP_SUMMARY references

Resolves SC2086 (double quote to prevent globbing) and SC2129 (group
redirects) shellcheck warnings flagged by the PR lint analysis.

* fix(helm-update-chart): resolve CodeQL medium findings

- Pin crazy-max/ghaction-import-gpg and mikefarah/yq to commit SHAs
- Move inputs.base_branch to env var to prevent code injection in step summary
- Add inline comment dismissing untrusted-checkout false positive

* docs(rules): enforce commit SHA pinning for third-party actions

Update all rules and commands (Claude, Cursor, AGENTS.md) to require
third-party actions to be pinned by commit SHA instead of mutable tags.
LerianStudio org actions remain pinned by release tag.

* refactor(pr-validation): extract pr-checks-summary composite and use branch refs for testing

* fix(pr-validation): add missing README and fix broken doc link

* refactor(pr-validation): optimize to 2-tier fail-fast model

Consolidate 9 parallel jobs into 4 with a 2-tier architecture:
- Tier 1 (blocking-checks): title, source-branch, description — no checkout, fail-fast
- Tier 2 (advisory-checks): metadata, size, labels, changelog — shared checkout, only runs if Tier 1 passes

Reduces runner cost (9 → 4 runners, 3 checkouts → 1) while providing
faster feedback on blocking validation failures.

* fix(pr-changelog): remove comment logic — changelog is auto-generated

CHANGELOG.md is now generated by semantic-release, so the reminder
comment is unnecessary noise. Removed the comment step, github-token
and dry-run inputs from the composite.

* fix(pr-validation): default enforce_source_branches to true

The composite already auto-skips when the target branch is not in
target_branches_for_source_check (default: main), so enabling by
default is safe and avoids silent misconfiguration.

* fix(pr-description): validate real content instead of raw length

Rewrite pr-description composite to:
- Extract content under "## Description" heading and strip HTML comments
- Fail if description section is empty or below min-length
- Fail if no "Type of Change" checkbox is checked
- Remove github-token input (no API calls needed)
- Consolidate two github-script steps into one

Also pin amannn/action-semantic-pull-request to commit SHA in pr-title.

* feat(pr-metadata): auto-assign PR author instead of warning

Replace the warning-only assignee and linked issues checks with an
actionable auto-assign: if no assignee is set, assign the PR author
automatically. Bot accounts are skipped.

* fix(pr-size): skip label update when unchanged and remove XL comment

- Check current labels before removing/adding — skip entirely if the
  correct size label is already set
- Only remove stale size labels that actually exist on the PR
- Remove the XL comment (generic noise on every sync)

* fix(pr-labels): pin actions/labeler to commit SHA

* refactor(pr-validation): remove changelog check and pin all actions by SHA

- Remove pr-changelog from workflow, summary, and inputs — CHANGELOG.md
  is auto-generated by semantic-release
- Pin actions/github-script@v8 and actions/checkout@v6 to commit SHAs
  across all validate composites

* fix(pr-checks-summary): use markdown tables grouped by tier

Display results as two tables (Blocking / Advisory) instead of flat
lines. Skipped checks now use ⏭️ instead of ⚠️ for clarity.

* fix(pr-validation): address CodeRabbit review findings

- Remove stale check_changelog references from docs and examples
- Remove pr-changelog from jobs table and pr-checks-summary README
- Fix related-workflow links to current doc naming
- Make missing "Type of Change" section an error, not a warning
- Add null-safety for pr.assignees in pr-metadata
- Add dry-run gate to pr-metadata auto-assign
- Fix yamllint inline-comment spacing in pr-labels

* fix(pr-validation): sync defaults, fix caller, update docs

- Align min_description_length default to 30 (matches composite)
- Remove stale check_changelog from self-pr-validation.yml
- Update metadata feature description in docs
- Validate min-length input against NaN in pr-description

* fix(pr-validation): pin composite refs to v1.19.1-beta.2

* fix(lint): enforce SHA pinning for externals, warnings for internals

fix(lint): enforce SHA pinning for externals, warnings for internals

* fix(pr-validation): pin composite refs to v1.20.0 (#172)

* fix(pr-validation): pin composite refs to v1.20.0

* fix(pr-blocking-collect): add README and pin ref to v1.20.0

* fix(pr-blocking-collect): use branch ref for testing

* docs(pr-blocking-collect): fix terminology — step outputs, not job outputs

---------

Co-authored-by: Gandalf <gandalf@lerian.studio>
bedatty added a commit that referenced this pull request Mar 26, 2026
* refactor(pr-validation): modularize workflow into composites under src/validate/

Extract all inline business logic from pr-validation.yml into 7 reusable
composite actions under src/validate/. Add dry_run input, fix script injection
risks (use env vars instead of direct interpolation), fix notify ref for
external callers, and update conventions to prohibit workflow_dispatch on
reusable workflows due to injection risk.

* fix(pr-validation): address CodeRabbit and CodeQL review findings

- Fix code-injection: move needs.*.result and inputs.dry_run to env vars
  in pr-checks-summary job (use process.env instead of ${{ }} interpolation)
- Wire MANAGE_TOKEN into auto-labeler job (was hardcoded to github.token)
- Include pr-changelog in Slack notification status and failed_jobs
- Handle empty git diff output in pr-size (CHANGED_LINES defaults to 0)
- Support all * wildcard patterns in pr-source-branch (not just /*)
- Fix broken markdown links in docs (add -workflow suffix)
- Fix docs examples to use @v1.2.3 placeholder instead of @v1.x.x
- Update jobs table with non-draft condition for all gated jobs

* fix(helm-update-chart): use VALUES_KEY for template file paths instead of COMP_NAME

The workflow was using COMP_NAME to build configmap/secret template paths
(e.g. templates/plugin-br-pix-indirect-btg-worker-inbound/configmap.yaml)
but the actual directory structure uses VALUES_KEY names
(e.g. templates/inbound/configmap.yaml).

This caused the if [ -f ] check to silently fail, resulting in detected
env vars never being injected into configmap/secret templates.

Changes:
- Use VALUES_KEY for CONFIGMAP_FILE and SECRET_FILE paths
- Update create_secret_template to take VALUES_KEY as single arg
- Add ::warning:: annotations when template files are not found

Closes #167

* fix(helm-update-chart): quote GITHUB_OUTPUT and GITHUB_STEP_SUMMARY references

Resolves SC2086 (double quote to prevent globbing) and SC2129 (group
redirects) shellcheck warnings flagged by the PR lint analysis.

* fix(helm-update-chart): resolve CodeQL medium findings

- Pin crazy-max/ghaction-import-gpg and mikefarah/yq to commit SHAs
- Move inputs.base_branch to env var to prevent code injection in step summary
- Add inline comment dismissing untrusted-checkout false positive

* docs(rules): enforce commit SHA pinning for third-party actions

Update all rules and commands (Claude, Cursor, AGENTS.md) to require
third-party actions to be pinned by commit SHA instead of mutable tags.
LerianStudio org actions remain pinned by release tag.

* refactor(pr-validation): extract pr-checks-summary composite and use branch refs for testing

* fix(pr-validation): add missing README and fix broken doc link

* refactor(pr-validation): optimize to 2-tier fail-fast model

Consolidate 9 parallel jobs into 4 with a 2-tier architecture:
- Tier 1 (blocking-checks): title, source-branch, description — no checkout, fail-fast
- Tier 2 (advisory-checks): metadata, size, labels, changelog — shared checkout, only runs if Tier 1 passes

Reduces runner cost (9 → 4 runners, 3 checkouts → 1) while providing
faster feedback on blocking validation failures.

* fix(pr-changelog): remove comment logic — changelog is auto-generated

CHANGELOG.md is now generated by semantic-release, so the reminder
comment is unnecessary noise. Removed the comment step, github-token
and dry-run inputs from the composite.

* fix(pr-validation): default enforce_source_branches to true

The composite already auto-skips when the target branch is not in
target_branches_for_source_check (default: main), so enabling by
default is safe and avoids silent misconfiguration.

* fix(pr-description): validate real content instead of raw length

Rewrite pr-description composite to:
- Extract content under "## Description" heading and strip HTML comments
- Fail if description section is empty or below min-length
- Fail if no "Type of Change" checkbox is checked
- Remove github-token input (no API calls needed)
- Consolidate two github-script steps into one

Also pin amannn/action-semantic-pull-request to commit SHA in pr-title.

* feat(pr-metadata): auto-assign PR author instead of warning

Replace the warning-only assignee and linked issues checks with an
actionable auto-assign: if no assignee is set, assign the PR author
automatically. Bot accounts are skipped.

* fix(pr-size): skip label update when unchanged and remove XL comment

- Check current labels before removing/adding — skip entirely if the
  correct size label is already set
- Only remove stale size labels that actually exist on the PR
- Remove the XL comment (generic noise on every sync)

* fix(pr-labels): pin actions/labeler to commit SHA

* refactor(pr-validation): remove changelog check and pin all actions by SHA

- Remove pr-changelog from workflow, summary, and inputs — CHANGELOG.md
  is auto-generated by semantic-release
- Pin actions/github-script@v8 and actions/checkout@v6 to commit SHAs
  across all validate composites

* fix(pr-checks-summary): use markdown tables grouped by tier

Display results as two tables (Blocking / Advisory) instead of flat
lines. Skipped checks now use ⏭️ instead of ⚠️ for clarity.

* fix(pr-validation): address CodeRabbit review findings

- Remove stale check_changelog references from docs and examples
- Remove pr-changelog from jobs table and pr-checks-summary README
- Fix related-workflow links to current doc naming
- Make missing "Type of Change" section an error, not a warning
- Add null-safety for pr.assignees in pr-metadata
- Add dry-run gate to pr-metadata auto-assign
- Fix yamllint inline-comment spacing in pr-labels

* fix(pr-validation): sync defaults, fix caller, update docs

- Align min_description_length default to 30 (matches composite)
- Remove stale check_changelog from self-pr-validation.yml
- Update metadata feature description in docs
- Validate min-length input against NaN in pr-description

* fix(pr-validation): pin composite refs to v1.19.1-beta.2

* fix(lint): enforce SHA pinning for externals, warnings for internals

fix(lint): enforce SHA pinning for externals, warnings for internals

* fix(pr-validation): pin composite refs to v1.20.0

* fix(pr-blocking-collect): add README and pin ref to v1.20.0

* fix(pr-blocking-collect): use branch ref for testing

* docs(pr-blocking-collect): fix terminology — step outputs, not job outputs

* fix(pr-validation): pin composite refs to v1.20.0 (#172)

* fix(pr-validation): pin composite refs to v1.20.0

* fix(pr-blocking-collect): add README and pin ref to v1.20.0

* fix(pr-blocking-collect): use branch ref for testing

* docs(pr-blocking-collect): fix terminology — step outputs, not job outputs

* feat(release): fallback to PR when backmerge push fails

When the semantic-release backmerge plugin fails to push directly to
develop (non-fast-forward), create a PR from main→develop instead of
failing the entire release. The release tag and GitHub release are
already published at this point.

- Add continue-on-error to semantic-release step
- If release published but step failed → create backmerge PR
- If release not published and step failed → propagate error
- Check for existing backmerge PR to avoid duplicates

* fix(pr-validation): pin composite refs to v1.20.1

* feat(release): extract backmerge fallback into reusable composite

Create src/config/backmerge-pr composite that creates a PR when the
semantic-release backmerge push fails (non-fast-forward). Checks for
existing open PRs to avoid duplicates. Replace inline shell in
release.yml with the composite call.

* fix(release): use @develop ref for backmerge-pr composite

* fix(backmerge-pr): use heredoc to avoid indentation in PR body

* fix(pr-description): validate checkboxes only, not description content

Simplify pr-description to only check:
- At least one "Type of Change" checkbox is marked
- At least one "Testing" checkbox is marked

Remove min-length content validation that was blocking PRs with valid
template usage (e.g., merge PRs with CodeRabbit summaries).

* fix(pr-description): simplify to empty body check only

* fix(ci): use @develop ref for pr-description, sync backmerge-pr

---------

Co-authored-by: Gandalf <gandalf@lerian.studio>
@bedatty bedatty mentioned this pull request Mar 26, 2026
14 tasks
bedatty added a commit that referenced this pull request Mar 26, 2026
* refactor(pr-validation): modularize workflow into composites under src/validate/

Extract all inline business logic from pr-validation.yml into 7 reusable
composite actions under src/validate/. Add dry_run input, fix script injection
risks (use env vars instead of direct interpolation), fix notify ref for
external callers, and update conventions to prohibit workflow_dispatch on
reusable workflows due to injection risk.

* fix(pr-validation): address CodeRabbit and CodeQL review findings

- Fix code-injection: move needs.*.result and inputs.dry_run to env vars
  in pr-checks-summary job (use process.env instead of ${{ }} interpolation)
- Wire MANAGE_TOKEN into auto-labeler job (was hardcoded to github.token)
- Include pr-changelog in Slack notification status and failed_jobs
- Handle empty git diff output in pr-size (CHANGED_LINES defaults to 0)
- Support all * wildcard patterns in pr-source-branch (not just /*)
- Fix broken markdown links in docs (add -workflow suffix)
- Fix docs examples to use @v1.2.3 placeholder instead of @v1.x.x
- Update jobs table with non-draft condition for all gated jobs

* fix(helm-update-chart): use VALUES_KEY for template file paths instead of COMP_NAME

The workflow was using COMP_NAME to build configmap/secret template paths
(e.g. templates/plugin-br-pix-indirect-btg-worker-inbound/configmap.yaml)
but the actual directory structure uses VALUES_KEY names
(e.g. templates/inbound/configmap.yaml).

This caused the if [ -f ] check to silently fail, resulting in detected
env vars never being injected into configmap/secret templates.

Changes:
- Use VALUES_KEY for CONFIGMAP_FILE and SECRET_FILE paths
- Update create_secret_template to take VALUES_KEY as single arg
- Add ::warning:: annotations when template files are not found

Closes #167

* fix(helm-update-chart): quote GITHUB_OUTPUT and GITHUB_STEP_SUMMARY references

Resolves SC2086 (double quote to prevent globbing) and SC2129 (group
redirects) shellcheck warnings flagged by the PR lint analysis.

* fix(helm-update-chart): resolve CodeQL medium findings

- Pin crazy-max/ghaction-import-gpg and mikefarah/yq to commit SHAs
- Move inputs.base_branch to env var to prevent code injection in step summary
- Add inline comment dismissing untrusted-checkout false positive

* docs(rules): enforce commit SHA pinning for third-party actions

Update all rules and commands (Claude, Cursor, AGENTS.md) to require
third-party actions to be pinned by commit SHA instead of mutable tags.
LerianStudio org actions remain pinned by release tag.

* refactor(pr-validation): extract pr-checks-summary composite and use branch refs for testing

* fix(pr-validation): add missing README and fix broken doc link

* refactor(pr-validation): optimize to 2-tier fail-fast model

Consolidate 9 parallel jobs into 4 with a 2-tier architecture:
- Tier 1 (blocking-checks): title, source-branch, description — no checkout, fail-fast
- Tier 2 (advisory-checks): metadata, size, labels, changelog — shared checkout, only runs if Tier 1 passes

Reduces runner cost (9 → 4 runners, 3 checkouts → 1) while providing
faster feedback on blocking validation failures.

* fix(pr-changelog): remove comment logic — changelog is auto-generated

CHANGELOG.md is now generated by semantic-release, so the reminder
comment is unnecessary noise. Removed the comment step, github-token
and dry-run inputs from the composite.

* fix(pr-validation): default enforce_source_branches to true

The composite already auto-skips when the target branch is not in
target_branches_for_source_check (default: main), so enabling by
default is safe and avoids silent misconfiguration.

* fix(pr-description): validate real content instead of raw length

Rewrite pr-description composite to:
- Extract content under "## Description" heading and strip HTML comments
- Fail if description section is empty or below min-length
- Fail if no "Type of Change" checkbox is checked
- Remove github-token input (no API calls needed)
- Consolidate two github-script steps into one

Also pin amannn/action-semantic-pull-request to commit SHA in pr-title.

* feat(pr-metadata): auto-assign PR author instead of warning

Replace the warning-only assignee and linked issues checks with an
actionable auto-assign: if no assignee is set, assign the PR author
automatically. Bot accounts are skipped.

* fix(pr-size): skip label update when unchanged and remove XL comment

- Check current labels before removing/adding — skip entirely if the
  correct size label is already set
- Only remove stale size labels that actually exist on the PR
- Remove the XL comment (generic noise on every sync)

* fix(pr-labels): pin actions/labeler to commit SHA

* refactor(pr-validation): remove changelog check and pin all actions by SHA

- Remove pr-changelog from workflow, summary, and inputs — CHANGELOG.md
  is auto-generated by semantic-release
- Pin actions/github-script@v8 and actions/checkout@v6 to commit SHAs
  across all validate composites

* fix(pr-checks-summary): use markdown tables grouped by tier

Display results as two tables (Blocking / Advisory) instead of flat
lines. Skipped checks now use ⏭️ instead of ⚠️ for clarity.

* fix(pr-validation): address CodeRabbit review findings

- Remove stale check_changelog references from docs and examples
- Remove pr-changelog from jobs table and pr-checks-summary README
- Fix related-workflow links to current doc naming
- Make missing "Type of Change" section an error, not a warning
- Add null-safety for pr.assignees in pr-metadata
- Add dry-run gate to pr-metadata auto-assign
- Fix yamllint inline-comment spacing in pr-labels

* fix(pr-validation): sync defaults, fix caller, update docs

- Align min_description_length default to 30 (matches composite)
- Remove stale check_changelog from self-pr-validation.yml
- Update metadata feature description in docs
- Validate min-length input against NaN in pr-description

* fix(pr-validation): pin composite refs to v1.19.1-beta.2

* fix(lint): enforce SHA pinning for externals, warnings for internals

fix(lint): enforce SHA pinning for externals, warnings for internals

* fix(pr-validation): pin composite refs to v1.20.0

* fix(pr-blocking-collect): add README and pin ref to v1.20.0

* fix(pr-blocking-collect): use branch ref for testing

* docs(pr-blocking-collect): fix terminology — step outputs, not job outputs

* fix(pr-validation): pin composite refs to v1.20.0 (#172)

* fix(pr-validation): pin composite refs to v1.20.0

* fix(pr-blocking-collect): add README and pin ref to v1.20.0

* fix(pr-blocking-collect): use branch ref for testing

* docs(pr-blocking-collect): fix terminology — step outputs, not job outputs

* feat(release): fallback to PR when backmerge push fails

When the semantic-release backmerge plugin fails to push directly to
develop (non-fast-forward), create a PR from main→develop instead of
failing the entire release. The release tag and GitHub release are
already published at this point.

- Add continue-on-error to semantic-release step
- If release published but step failed → create backmerge PR
- If release not published and step failed → propagate error
- Check for existing backmerge PR to avoid duplicates

* fix(pr-validation): pin composite refs to v1.20.1

* feat(release): extract backmerge fallback into reusable composite

Create src/config/backmerge-pr composite that creates a PR when the
semantic-release backmerge push fails (non-fast-forward). Checks for
existing open PRs to avoid duplicates. Replace inline shell in
release.yml with the composite call.

* fix(release): use @develop ref for backmerge-pr composite

* fix(backmerge-pr): use heredoc to avoid indentation in PR body

* fix(pr-description): validate checkboxes only, not description content

Simplify pr-description to only check:
- At least one "Type of Change" checkbox is marked
- At least one "Testing" checkbox is marked

Remove min-length content validation that was blocking PRs with valid
template usage (e.g., merge PRs with CodeRabbit summaries).

* fix(pr-description): simplify to empty body check only

* fix(ci): use @develop ref for pr-description, sync backmerge-pr

---------

Co-authored-by: Gandalf <gandalf@lerian.studio>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/S PR changes 50–199 lines workflow Changes to one or more reusable workflow files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants