Skip to content

Commit e00aa64

Browse files
committed
ci: added workflows
* added codeql scan workflow (on pull request, on push, on weekly schedule) * added vuln scan workflow: trivy (on push, on weekly schedule) * added release workflow (on tag). Generates a github release with release notes * added badges to report workflows, releases etc Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
1 parent 3e3ae75 commit e00aa64

File tree

12 files changed

+626
-54
lines changed

12 files changed

+626
-54
lines changed

.cliff.toml

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# git-cliff ~ configuration file
2+
# https://git-cliff.org/docs/configuration
3+
4+
[changelog]
5+
header = """
6+
"""
7+
8+
footer = """
9+
10+
-----
11+
12+
**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
13+
14+
[![License][license-badge]][license-url]
15+
16+
[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
17+
[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
18+
19+
{%- macro remote_url() -%}
20+
https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
21+
{%- endmacro -%}
22+
"""
23+
24+
body = """
25+
{%- if version %}
26+
## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
27+
{%- else %}
28+
## [unreleased]
29+
{%- endif %}
30+
{%- if message %}
31+
{%- raw %}\n{% endraw %}
32+
{{ message }}
33+
{%- raw %}\n{% endraw %}
34+
{%- endif %}
35+
{%- if version %}
36+
{%- if previous.version %}
37+
38+
**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
39+
{%- endif %}
40+
{%- else %}
41+
{%- raw %}\n{% endraw %}
42+
{%- endif %}
43+
44+
{%- if statistics %}{% if statistics.commit_count %}
45+
{%- raw %}\n{% endraw %}
46+
{{ statistics.commit_count }} commits in this release.
47+
{%- raw %}\n{% endraw %}
48+
{%- endif %}{% endif %}
49+
-----
50+
51+
{%- for group, commits in commits | group_by(attribute="group") %}
52+
{%- raw %}\n{% endraw %}
53+
### {{ group | upper_first }}
54+
{%- raw %}\n{% endraw %}
55+
{%- for commit in commits %}
56+
{%- if commit.remote.pr_title %}
57+
{%- set commit_message = commit.remote.pr_title %}
58+
{%- else %}
59+
{%- set commit_message = commit.message %}
60+
{%- endif %}
61+
* {{ commit_message | split(pat="\n") | first | trim }}
62+
{%- if commit.remote.username %}
63+
{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
64+
{%- endif %}
65+
{%- if commit.remote.pr_number %}
66+
{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
67+
{%- endif %}
68+
{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
69+
{%- endfor %}
70+
{%- endfor %}
71+
72+
{%- if github %}
73+
{%- raw %}\n{% endraw -%}
74+
{%- set all_contributors = github.contributors | length %}
75+
{%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
76+
-----
77+
78+
### People who contributed to this release
79+
{% endif %}
80+
{%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
81+
{%- if contributor.username != "dependabot[bot]" %}
82+
* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
83+
{%- endif %}
84+
{%- endfor %}
85+
86+
{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
87+
-----
88+
{%- raw %}\n{% endraw %}
89+
90+
### New Contributors
91+
{%- endif %}
92+
93+
{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
94+
{%- if contributor.username != "dependabot[bot]" %}
95+
* @{{ contributor.username }} made their first contribution
96+
{%- if contributor.pr_number %}
97+
in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
98+
{%- endif %}
99+
{%- endif %}
100+
{%- endfor %}
101+
{%- endif %}
102+
103+
{%- raw %}\n{% endraw %}
104+
105+
{%- macro remote_url() -%}
106+
https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
107+
{%- endmacro -%}
108+
"""
109+
# Remove leading and trailing whitespaces from the changelog's body.
110+
trim = true
111+
# Render body even when there are no releases to process.
112+
render_always = true
113+
# An array of regex based postprocessors to modify the changelog.
114+
postprocessors = [
115+
# Replace the placeholder <REPO> with a URL.
116+
#{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
117+
]
118+
# output file path
119+
# output = "test.md"
120+
121+
[git]
122+
# Parse commits according to the conventional commits specification.
123+
# See https://www.conventionalcommits.org
124+
conventional_commits = false
125+
# Exclude commits that do not match the conventional commits specification.
126+
filter_unconventional = false
127+
# Require all commits to be conventional.
128+
# Takes precedence over filter_unconventional.
129+
require_conventional = false
130+
# Split commits on newlines, treating each line as an individual commit.
131+
split_commits = false
132+
# An array of regex based parsers to modify commit messages prior to further processing.
133+
commit_preprocessors = [
134+
# Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
135+
#{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
136+
# Check spelling of the commit message using https://github.com/crate-ci/typos.
137+
# If the spelling is incorrect, it will be fixed automatically.
138+
#{ pattern = '.*', replace_command = 'typos --write-changes -' }
139+
]
140+
# Prevent commits that are breaking from being excluded by commit parsers.
141+
protect_breaking_commits = false
142+
# An array of regex based parsers for extracting data from the commit message.
143+
# Assigns commits to groups.
144+
# Optionally sets the commit's scope and can decide to exclude commits from further processing.
145+
commit_parsers = [
146+
{ message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
147+
{ message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
148+
{ field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
149+
{ message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
150+
{ body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
151+
{ message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
152+
{ message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
153+
{ message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
154+
{ message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
155+
{ message = "^test", group = "<!-- 06 -->Testing" },
156+
{ message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
157+
{ message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
158+
{ message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
159+
{ message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
160+
{ message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
161+
{ message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
162+
{ message = ".*", group = "<!-- 0B -->Other" },
163+
]
164+
# Exclude commits that are not matched by any commit parser.
165+
filter_commits = false
166+
# An array of link parsers for extracting external references, and turning them into URLs, using regex.
167+
link_parsers = []
168+
# Include only the tags that belong to the current branch.
169+
use_branch_tags = false
170+
# Order releases topologically instead of chronologically.
171+
topo_order = false
172+
# Order releases topologically instead of chronologically.
173+
topo_order_commits = true
174+
# Order of commits in each group/release within the changelog.
175+
# Allowed values: newest, oldest
176+
sort_commits = "newest"
177+
# Process submodules commits
178+
recurse_submodules = false
179+
180+
#[remote.github]
181+
#owner = "go-openapi"

.github/release.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# github release notes configuration

.github/workflows/auto-merge.yml

Lines changed: 28 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,42 +2,52 @@ name: Dependabot auto-merge
22
on: pull_request
33

44
permissions:
5-
contents: write
6-
pull-requests: write
5+
contents: read
76

87
jobs:
98
dependabot:
9+
permissions:
10+
contents: write
11+
pull-requests: write
1012
runs-on: ubuntu-latest
11-
if: github.event.pull_request.user.login == 'dependabot[bot]'
13+
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
1214
steps:
13-
- name: Dependabot metadata
15+
-
16+
name: Dependabot metadata
1417
id: metadata
15-
uses: dependabot/fetch-metadata@v2
16-
17-
- name: Auto-approve all dependabot PRs
18-
run: gh pr review --approve "$PR_URL"
18+
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
19+
-
20+
name: Auto-approve all dependabot PRs
1921
env:
2022
PR_URL: ${{github.event.pull_request.html_url}}
2123
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
22-
23-
- name: Auto-merge dependabot PRs for development dependencies
24-
if: contains(steps.metadata.outputs.dependency-group, 'development-dependencies')
25-
run: gh pr merge --auto --rebase "$PR_URL"
24+
run: gh pr review --approve "$PR_URL"
25+
-
26+
name: Auto-merge dependabot PRs for development dependencies
27+
if: ${{ contains(steps.metadata.outputs.dependency-group, 'development-dependencies') }}
2628
env:
2729
PR_URL: ${{github.event.pull_request.html_url}}
2830
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
29-
30-
- name: Auto-merge dependabot PRs for go-openapi patches
31-
if: contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') && (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch')
3231
run: gh pr merge --auto --rebase "$PR_URL"
32+
-
33+
name: Auto-merge dependabot PRs for go-openapi patches
34+
if: >-
35+
${{
36+
contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') &&
37+
(
38+
steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
39+
steps.metadata.outputs.update-type == 'version-update:semver-patch'
40+
)
41+
}}
3342
env:
3443
PR_URL: ${{github.event.pull_request.html_url}}
3544
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
36-
37-
- name: Auto-merge dependabot PRs for golang.org updates
38-
if: contains(steps.metadata.outputs.dependency-group, 'golang-org-dependencies')
3945
run: gh pr merge --auto --rebase "$PR_URL"
46+
-
47+
name: Auto-merge dependabot PRs for golang.org updates
48+
if: ${{ contains(steps.metadata.outputs.dependency-group, 'golang-org-dependencies') }}
4049
env:
4150
PR_URL: ${{github.event.pull_request.html_url}}
4251
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
52+
run: gh pr merge --auto --rebase "$PR_URL"
4353

.github/workflows/codeql.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: "CodeQL"
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
push:
8+
branches: [ "master" ]
9+
pull_request:
10+
branches: [ "master" ]
11+
path-ignore:
12+
- '**/*.md'
13+
schedule:
14+
- cron: '39 19 * * 5'
15+
16+
jobs:
17+
analyze:
18+
name: Analyze.
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 360
21+
permissions:
22+
contents: read
23+
security-events: write
24+
# actions: read # <- is needed only for private repositories
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
language: ['go','actions']
29+
steps:
30+
-
31+
name: Checkout repository
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
-
34+
# Initializes the CodeQL tools for scanning.
35+
name: Initialize CodeQL
36+
uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
37+
with:
38+
languages: ${{ matrix.language }}
39+
-
40+
name: Analyze ${{ matrix.language }}
41+
uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v4.30.9

0 commit comments

Comments
 (0)