release: v0.4.0 - #101
Merged
Merged
Conversation
…security scans GH_PAT no longer exists (retired when this org migrated private-module auth to a GitHub App) — every workflow still referencing it was failing private module resolution with "could not read Password for 'https://github.com': terminal prompts disabled", as seen on PR #98. - ci.yaml, security.yml (new): private-module git config now uses a short-lived GitHub App installation token via actions/create-github-app-token, minted fresh per job instead of a PAT whose expiry can silently lapse. Also added a `go test` + coverage step to ci.yaml, which previously only built/vetted/linted — the new domain/ mediator/cache test suite would otherwise never run in CI. - ko.yml, release.yml, security.yml (trivy-image): GHCR login switched to the default GITHUB_TOKEN — the App token is denied package writes/pulls against this org-scoped package regardless of granted permission, but GITHUB_TOKEN's repo-scoped access is exactly what a same-repo push/pull needs. - create-release.yml, finalize-release.yml: switched to the App token (not GITHUB_TOKEN) since these push branches/tags/merges that must trigger downstream workflow runs (CI on the new branch, Release on the new tag) — pushes authenticated with the default GITHUB_TOKEN don't trigger other workflows, but an App installation token does. Also merges gosec.yml + vulnscan.yml into a single security.yml (three jobs: gosec, govulncheck, trivy-image), each keeping its original trigger scope via a job-level `if:` gate — mirroring the consolidation already done in the `environments` library's own CI. Release-lifecycle workflows (release.yml, create-release.yml, finalize-release.yml, ko.yml) stay standalone, unchanged from before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…orks PR #100's CI run was the first time golangci-lint ever got past the private-module auth step to completion — it found 31 real issues that had been silently accumulating (some pre-existing, some from the new test suite in #98), none caught before because the pipeline always failed earlier at "Configure Git for private modules". - goconst (21+2 more that surfaced after the first batch): repeated string literals in test fixtures (contract map keys/values, namespaces, label keys, sample names) extracted into local, file-scoped named constants — matching the existing per-file `testAppName`-style convention rather than introducing a shared testsupport helper. - revive import-shadowing (8+4 more): production code across 9 domain/ runtime files declared local variables or parameters named `cache`, `events`, `registry`, or `engine` that shadowed the same-named imported packages. Renamed to `domainCache`/`eventRecorder`/`objCache`/`reg`/`eng` (production code) and `githubEvents` (a local List result) — behavior unchanged, purely a naming fix. - unparam (2): two test helper `newTestDomain` functions returned an unused `client.Client` second value that every call site discarded; dropped the return value instead of threading a `_` through 13 call sites. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…coverage ci: migrate workflows off retired GH_PAT secret, consolidate security scans
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v0.4.0
Release branch cut from
develop. Merge fix PRs into this branch before finalizing.Next step: once all fixes are merged, run the Finalize Release workflow.