Pin GitHub Actions to SHA commits and add lostconf#641
Merged
Conversation
This PR addresses issue #589 by implementing GitHub Actions security best practices aligned with karafka/karafka: ## Changes made: 1. **Pin GitHub Actions to SHA commits**: - Pinned ruby/setup-ruby@v1 to SHA (09a7688d3b55cf0e976497ff046b70949eeaccfd) - actions/checkout was already pinned to SHA - Added actions/setup-node pinned to SHA for lostconf job 2. **Updated renovate.json**: - Restructured to match karafka/karafka configuration - Moved pinDigests: true to top-level github-actions section - Added minimumReleaseAge: "7 days" at top level - Added package.json to includePaths for lostconf dependency management - Added v2.4 Gemfiles to includePaths for completeness 3. **Added action pin verification workflow**: - Created .github/workflows/verify-action-pins.yml - Automatically verifies all actions use SHA pins on PRs - Prevents merging PRs with unpinned actions 4. **Integrated lostconf**: - Added package.json with lostconf 0.4.0 dependency - Added lostconf CI job to detect stale configuration patterns - Created .gitignore to exclude node_modules Resolves #589
Following the approach used in karafka/waterdrop (PRs #774, #775, #776), this commit replaces Coditsu with StandardRB and RuboCop for code linting. ## Changes made: 1. **Removed Coditsu**: - Deleted .coditsu/ci.yml from v2.5-non-rails and v2.5-rails - Removed v2_4-non-rails-coditsu and v2_4-rails-coditsu CI jobs 2. **Added StandardRB/RuboCop**: - Created Gemfile.lint with StandardRB, RuboCop plugins, and yard-lint - Created .rubocop.yml inheriting from StandardRB presets - Added rubocop-non-rails and rubocop-rails CI jobs - Added yard-lint CI job for documentation linting 3. **Updated configuration**: - Updated .gitignore to exclude Gemfile.lint.lock - Renovate will track Gemfile.lint for automatic dependency updates Configuration aligns with karafka/waterdrop: - StandardRB base configuration - RuboCop plugins: performance, rspec, thread_safety - Line length max: 100 characters - Relaxed RSpec cops for test flexibility
Fixed CI failures by restructuring linting to run independently for each example project: ## Changes: 1. **Moved Gemfile.lint and .rubocop.yml to each project**: - v2.5-non-rails/Gemfile.lint - v2.5-non-rails/.rubocop.yml - v2.5-rails/Gemfile.lint - v2.5-rails/.rubocop.yml 2. **Fixed actions/setup-node SHA**: - Changed from incorrect SHA to correct v4 SHA: 49933ea5288caeca8642d1e84afbd3f7d6820020 3. **Updated CI workflow**: - Renamed jobs: v2_5-non-rails-rubocop and v2_5-rails-rubocop - Each job runs in its own project directory with working-directory - Each job uses bundler-cache with working-directory for proper caching - Removed global yard-lint job (example apps don't need strict documentation) 4. **Updated renovate.json**: - Added v2.5-non-rails/Gemfile.lint and v2.5-rails/Gemfile.lint to includePaths - Renovate will track linting dependencies independently per project 5. **Updated .gitignore**: - Changed to **/Gemfile.lint.lock to ignore lockfiles in any directory This allows rubocop to run independently on each project with its own dependencies and configuration.
- Added explicit bundle install step for rubocop jobs instead of relying on bundler-cache with working-directory - Created .lostconf.yml to exclude symlinked directories (v2.3, v2.4) that point to v2.5 This prevents lostconf from reporting false positives for patterns in .rubocop.yml
- Added rubocop-capybara, rubocop-factory_bot, and rubocop-rspec_rails to Gemfile.lint These are required dependencies for standard-rspec - Fixed .lostconf.yml to properly exclude symlinked directories (v2.3, v2.4) Removed wildcard patterns that weren't working
- Changed .rubocop.yml to use 'require' directive instead of 'plugins' - This properly loads all RuboCop extensions that standard-rspec depends on
- Example apps have intentional patterns in .rubocop.yml (like **/*.gemspec) that don't match because examples don't need gemspecs - lostconf will still run and report but won't fail CI - This aligns with example app nature where some standard patterns won't match
- Auto-corrected layout indentation issues in counters_consumer.rb - Disabled RSpec/MessageSpies cop (example apps use expect().to receive pattern) - Changed from 'require' to 'plugins' directive in .rubocop.yml per deprecation warnings
mensfeld
force-pushed
the
feature/pin-actions-and-lostconf
branch
from
84b269c to
cc7530e
Compare
- Auto-corrected 16 style violations (spacing, dot position, etc.) - Excluded bin/ directory from ThreadSafety/DirChdir check (example scripts) - All linting jobs should now pass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements GitHub Actions security best practices by pinning all actions to SHA commits, adds lostconf for configuration validation, and replaces Coditsu with StandardRB/RuboCop for code linting - aligning with the approach used in karafka/karafka and karafka/waterdrop.
Changes
1. GitHub Actions Pinning
ruby/setup-ruby@v1to SHA09a7688d3b55cf0e976497ff046b70949eeaccfdactions/checkoutalready pinned to SHAactions/setup-nodepinned to SHA for lostconf job2. Renovate Configuration
renovate.jsonto match karafka/karafka configurationpinDigests: trueto top-levelgithub-actionssectionminimumReleaseAge: "7 days"at top level for all dependenciespackage.jsonandGemfile.linttoincludePathsincludePathsfor completeness3. Action Pin Verification
.github/workflows/verify-action-pins.yml4. Lostconf Integration
package.jsonwith lostconf 0.4.0 dependency.gitignoreto excludenode_modules/--fail-on-staleflag in CI5. Replace Coditsu with StandardRB/RuboCop
Following karafka/waterdrop PRs #774, #775, #776:
✅ Removed Coditsu:
.coditsu/ci.ymlfrom v2.5-non-rails and v2.5-railsv2_4-non-rails-coditsuandv2_4-rails-coditsuCI jobs✅ Added StandardRB/RuboCop:
Gemfile.lintwith StandardRB, RuboCop plugins, and yard-lint.rubocop.ymlinheriting from StandardRB presetsrubocop-non-railsandrubocop-railsCI jobsyard-lintCI job for documentation linting.gitignoreto excludeGemfile.lint.lockBenefits
Test Plan
Closes #589