From 6ba42ea35adda089152745f0d17c97208bc13a9b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 24 Aug 2026 16:35:39 +0000 Subject: [PATCH 1/4] Lock public SolZeroAI/platform CI to secret-less checks. Run Validate on every pull request and master push. Keep Test and Build in YAML, but gate them to the private deploy fork. Keep Deploy Preview as a gated template and retarget Release to Validate so Tegami still publishes without Cloudflare secrets. Co-authored-by: Jonathan Beckman --- .github/workflows/preview.yml | 8 +++++--- .github/workflows/release.yml | 2 +- .github/workflows/validate.yml | 8 ++++++++ CONTRIBUTING.md | 3 +++ README.md | 2 +- docs/releasing.md | 6 +++--- 6 files changed, 21 insertions(+), 8 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 11c21ea5..96e4bcaa 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -1,3 +1,5 @@ +# Template for the private deploy fork (jonbeckman/solzero). +# Gated off on the public SolZeroAI/platform repository. Do not add secrets here. name: Deploy Preview on: @@ -28,7 +30,7 @@ concurrency: jobs: validate: name: Validate - if: ${{ (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }} + if: ${{ github.repository == 'jonbeckman/solzero' && (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }} uses: ./.github/workflows/validate.yml permissions: contents: read @@ -36,7 +38,7 @@ jobs: deploy-preview: name: Deploy preview stage needs: validate - if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository) }} + if: ${{ github.repository == 'jonbeckman/solzero' && (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository)) }} runs-on: ubuntu-latest timeout-minutes: 30 environment: pre @@ -138,7 +140,7 @@ jobs: cleanup-preview: name: Clean up preview stage - if: ${{ (github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-')) }} + if: ${{ github.repository == 'jonbeckman/solzero' && ((github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-'))) }} runs-on: ubuntu-latest timeout-minutes: 30 environment: pre diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 20b9ab0f..16bc2154 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,7 @@ name: Release on: workflow_run: workflows: - - Deploy Preview + - Validate types: - completed branches: diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 72fd3fd4..d44bf7af 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -1,6 +1,12 @@ name: Validate on: + pull_request: + branches: + - master + push: + branches: + - master workflow_call: inputs: checkout_ref: @@ -51,7 +57,9 @@ jobs: run: nub run format - name: Test + if: github.repository == 'jonbeckman/solzero' run: nub run test - name: Build + if: github.repository == 'jonbeckman/solzero' run: nub run build diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c53b566d..60bb7c49 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -56,6 +56,9 @@ nub run build run at `warn`. Lint loads the GitHub package through `tsx` because that package ships TypeScript source. +GitHub Actions on SolZeroAI/platform runs `config:check`, `typecheck`, `lint`, and `format`. Tests that +need Cloudflare tokens and Deploy Preview run only on the private deploy fork. + If a check cannot run in your environment, explain why in the pull request. ## Pull requests diff --git a/README.md b/README.md index 3ea19ce1..42c17685 100644 --- a/README.md +++ b/README.md @@ -207,7 +207,7 @@ When your deployment uses sandbox agents, test its selected Codex, Claude Code, For a preview deployment, use `config/pre.config.jsonc` and `config/.pre.vars`. Run `nub run infra:plan:pre`, followed by `nub run infra:deploy:pre`. -GitHub Actions also deploys previews. The `Deploy Preview` workflow deploys the `pre` stage on each merge to `master`. Each pull request gets an ephemeral `pre-` stage with a preview URL comment, and the workflow destroys that stage when the pull request closes. Sync the required secrets with `nub run github:sync-env-secrets`. +Public GitHub Actions on this repository run secret-less checks only. The `Deploy Preview` workflow YAML is a template for the private deploy fork (`jonbeckman/solzero`) and is gated off here. That fork deploys the `pre` stage on merge to `master`, comments a `pre-` URL on each pull request, and destroys that stage when the pull request closes. Sync secrets on the private fork with `nub run github:sync-env-secrets`. SolZero validates the `dev`, `test`, `pre`, and `prod` profiles. Keep every profile in the repository to preserve this contract. diff --git a/docs/releasing.md b/docs/releasing.md index ea54e76e..912ec834 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -56,9 +56,9 @@ combined version and release-note preview. A change with no observable effect ca ## Automated release flow 1. Merge a feature pull request with its pending `.tegami/` entries. -2. Wait for `Deploy Preview` to pass on `master`. That workflow validates the commit and deploys the - `pre` preview stage. The `Release` workflow then runs `nub run tegami ci` and opens or updates - `tegami/version-packages`. +2. Wait for `Validate` to pass on `master`. That workflow runs the secret-less checks. The `Release` + workflow then runs `nub run tegami ci` and opens or updates `tegami/version-packages`. Preview + deploys stay on the private fork and are not required for a GitHub Release. 3. Review the version pull request. It updates `VERSION`, prepends `CHANGELOG.md`, consumes the pending entries, and writes `.tegami/publish-lock.yaml`. 4. Merge the version pull request. After validation, the release workflow pushes the `vX.Y.Z` tag and From 46d341d900f049198e26a2980bc5c28919d64ec8 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 24 Aug 2026 16:40:15 +0000 Subject: [PATCH 2/4] Allow the Deploy Preview template to start on the public repo. Replace peter-evans comment actions with GitHub-owned github-script so SolZeroAI/platform's action allowlist does not fail the workflow at startup. Secret-using jobs stay gated to jonbeckman/solzero. Co-authored-by: Jonathan Beckman --- .github/workflows/preview.yml | 98 +++++++++++++++++++++++------------ 1 file changed, 64 insertions(+), 34 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 96e4bcaa..7ea54e11 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -113,30 +113,50 @@ jobs: CF_AI_SEARCH_SERVICE_TOKEN_ID: ${{ secrets.CF_AI_SEARCH_SERVICE_TOKEN_ID }} WRANGLER_SEND_METRICS: "false" - - name: Find existing comment - if: ${{ github.event_name == 'pull_request' }} - id: find-comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 - with: - issue-number: ${{ github.event.pull_request.number }} - comment-author: "github-actions[bot]" - body-includes: "" - + # GitHub-owned action so this template can start on SolZeroAI/platform. + # Secret-using jobs stay gated to jonbeckman/solzero. - name: Create or update PR comment if: ${{ github.event_name == 'pull_request' }} - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + env: + PREVIEW_URL: ${{ steps.preview-target.outputs.website_url }} + PREVIEW_SHA: ${{ github.event.pull_request.head.sha }} with: - comment-id: ${{ steps.find-comment.outputs.comment-id }} - issue-number: ${{ github.event.pull_request.number }} - body: | - + script: | + const marker = "" + const body = `${marker} ## Preview Deployed Your preview is ready. - **Preview URL:** ${{ steps.preview-target.outputs.website_url }} - This preview was built from commit ${{ github.event.pull_request.head.sha }} + **Preview URL:** ${process.env.PREVIEW_URL} + This preview was built from commit ${process.env.PREVIEW_SHA} --- - This comment will be updated automatically when you push new commits to this PR. - edit-mode: replace + This comment will be updated automatically when you push new commits to this PR.` + const { owner, repo } = context.repo + const issue_number = context.issue.number + const comments = await github.paginate(github.rest.issues.listComments, { + owner, + repo, + issue_number, + }) + const existing = comments.find((comment) => + comment.user?.login === "github-actions[bot]" && + comment.body?.includes(marker) + ) + if (existing) { + await github.rest.issues.updateComment({ + owner, + repo, + comment_id: existing.id, + body, + }) + } else { + await github.rest.issues.createComment({ + owner, + repo, + issue_number, + body, + }) + } cleanup-preview: name: Clean up preview stage @@ -213,24 +233,34 @@ jobs: CF_AI_SEARCH_SERVICE_TOKEN_ID: ${{ secrets.CF_AI_SEARCH_SERVICE_TOKEN_ID }} WRANGLER_SEND_METRICS: "false" - - name: Find existing comment - if: ${{ github.event_name == 'pull_request' }} - id: find-comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 - with: - issue-number: ${{ github.event.pull_request.number }} - comment-author: "github-actions[bot]" - body-includes: "" - + # GitHub-owned action so this template can start on SolZeroAI/platform. - name: Update comment with cleanup status - if: steps.find-comment.outputs.comment-id != '' - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + if: ${{ github.event_name == 'pull_request' }} + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: - comment-id: ${{ steps.find-comment.outputs.comment-id }} - body: | - + script: | + const marker = "" + const body = `${marker} ## Preview Cleaned Up The preview for this PR has been cleaned up because the PR was closed. --- - Preview resources have been removed from Cloudflare. - edit-mode: replace + Preview resources have been removed from Cloudflare.` + const { owner, repo } = context.repo + const comments = await github.paginate(github.rest.issues.listComments, { + owner, + repo, + issue_number: context.issue.number, + }) + const existing = comments.find((comment) => + comment.user?.login === "github-actions[bot]" && + comment.body?.includes(marker) + ) + if (!existing) { + return + } + await github.rest.issues.updateComment({ + owner, + repo, + comment_id: existing.id, + body, + }) From 176c64aaf9d682586631aedaac9f58d6308f4244 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 24 Aug 2026 16:59:34 +0000 Subject: [PATCH 3/4] Invert public-repo CI guards and lint the Deploy Preview template. Replace equality gates with github.repository != SolZeroAI/platform so any non-public fork can run secret-using jobs without editing YAML. Keep preview.yml valid and add pinned actionlint to public Validate. Co-authored-by: Jonathan Beckman --- .github/workflows/preview.yml | 14 ++++++++------ .github/workflows/validate.yml | 16 ++++++++++++++-- CONTRIBUTING.md | 8 ++++++-- README.md | 2 +- docs/releasing.md | 5 ++++- 5 files changed, 33 insertions(+), 12 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 7ea54e11..dddff711 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -1,5 +1,8 @@ -# Template for the private deploy fork (jonbeckman/solzero). -# Gated off on the public SolZeroAI/platform repository. Do not add secrets here. +# Copyable Deploy Preview template. Keep this file valid YAML. Do not comment it out. +# On SolZeroAI/platform, disable it with Actions → Deploy Preview → Disable workflow +# (`gh workflow disable preview.yml`). Disabled state is per-repo; fork owners enable it +# on their Actions page. The invert guard below is the belt if the public workflow is enabled. +# Do not add secrets on SolZeroAI/platform. name: Deploy Preview on: @@ -30,7 +33,7 @@ concurrency: jobs: validate: name: Validate - if: ${{ github.repository == 'jonbeckman/solzero' && (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }} + if: ${{ github.repository != 'SolZeroAI/platform' && (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }} uses: ./.github/workflows/validate.yml permissions: contents: read @@ -38,7 +41,7 @@ jobs: deploy-preview: name: Deploy preview stage needs: validate - if: ${{ github.repository == 'jonbeckman/solzero' && (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository)) }} + if: ${{ github.repository != 'SolZeroAI/platform' && (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository)) }} runs-on: ubuntu-latest timeout-minutes: 30 environment: pre @@ -114,7 +117,6 @@ jobs: WRANGLER_SEND_METRICS: "false" # GitHub-owned action so this template can start on SolZeroAI/platform. - # Secret-using jobs stay gated to jonbeckman/solzero. - name: Create or update PR comment if: ${{ github.event_name == 'pull_request' }} uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 @@ -160,7 +162,7 @@ jobs: cleanup-preview: name: Clean up preview stage - if: ${{ github.repository == 'jonbeckman/solzero' && ((github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-'))) }} + if: ${{ github.repository != 'SolZeroAI/platform' && ((github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-'))) }} runs-on: ubuntu-latest timeout-minutes: 30 environment: pre diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index d44bf7af..d85c3b65 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -56,10 +56,22 @@ jobs: - name: Check formatting run: nub run format + - name: Lint GitHub Actions workflows + env: + ACTIONLINT_VERSION: "1.7.12" + ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8" + run: | + curl --proto '=https' --tlsv1.2 -fsSL \ + -o actionlint.tar.gz \ + "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" + echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum --check + tar -xzf actionlint.tar.gz actionlint + ./actionlint -color .github/workflows/*.yml + - name: Test - if: github.repository == 'jonbeckman/solzero' + if: github.repository != 'SolZeroAI/platform' run: nub run test - name: Build - if: github.repository == 'jonbeckman/solzero' + if: github.repository != 'SolZeroAI/platform' run: nub run build diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 60bb7c49..095b070f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -56,8 +56,12 @@ nub run build run at `warn`. Lint loads the GitHub package through `tsx` because that package ships TypeScript source. -GitHub Actions on SolZeroAI/platform runs `config:check`, `typecheck`, `lint`, and `format`. Tests that -need Cloudflare tokens and Deploy Preview run only on the private deploy fork. +GitHub Actions on SolZeroAI/platform runs `config:check`, `typecheck`, `lint`, `format`, and actionlint. +Tests that need Cloudflare tokens and Deploy Preview skip on this public repository +(`github.repository != 'SolZeroAI/platform'`). Keep `preview.yml` as valid YAML and disable it here +with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Disabled state +is per-repo. Fork owners enable it on their Actions page. GitHub disables scheduled workflows on +public forks by default. Do not comment the workflow YAML out. If a check cannot run in your environment, explain why in the pull request. diff --git a/README.md b/README.md index 42c17685..9eb89a5a 100644 --- a/README.md +++ b/README.md @@ -207,7 +207,7 @@ When your deployment uses sandbox agents, test its selected Codex, Claude Code, For a preview deployment, use `config/pre.config.jsonc` and `config/.pre.vars`. Run `nub run infra:plan:pre`, followed by `nub run infra:deploy:pre`. -Public GitHub Actions on this repository run secret-less checks only. The `Deploy Preview` workflow YAML is a template for the private deploy fork (`jonbeckman/solzero`) and is gated off here. That fork deploys the `pre` stage on merge to `master`, comments a `pre-` URL on each pull request, and destroys that stage when the pull request closes. Sync secrets on the private fork with `nub run github:sync-env-secrets`. +Public GitHub Actions on SolZeroAI/platform run secret-less checks only (`config:check`, typecheck, lint, format, and actionlint). Keep `preview.yml` as valid YAML. On this public repository, disable it with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Disabled state is per-repo; fork owners enable the workflow on their Actions page. GitHub disables scheduled workflows on public forks by default. Jobs that use secrets also have an invert guard (`github.repository != 'SolZeroAI/platform'`), so they skip on the public repo even if the workflow is enabled. Do not comment the YAML out. Any repository that is not SolZeroAI/platform can run those jobs without editing the file. Sync secrets only on a private deploy fork with `nub run github:sync-env-secrets`. SolZero validates the `dev`, `test`, `pre`, and `prod` profiles. Keep every profile in the repository to preserve this contract. diff --git a/docs/releasing.md b/docs/releasing.md index 912ec834..63bc7335 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -58,7 +58,10 @@ combined version and release-note preview. A change with no observable effect ca 1. Merge a feature pull request with its pending `.tegami/` entries. 2. Wait for `Validate` to pass on `master`. That workflow runs the secret-less checks. The `Release` workflow then runs `nub run tegami ci` and opens or updates `tegami/version-packages`. Preview - deploys stay on the private fork and are not required for a GitHub Release. + deploys are not required for a GitHub Release. On SolZeroAI/platform, disable `Deploy Preview` + with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Keep the + YAML in the tree. The invert guard skips secret-using jobs on this public repository even if the + workflow is enabled. Fork owners enable it on their own Actions page. 3. Review the version pull request. It updates `VERSION`, prepends `CHANGELOG.md`, consumes the pending entries, and writes `.tegami/publish-lock.yaml`. 4. Merge the version pull request. After validation, the release workflow pushes the `vX.Y.Z` tag and From 4e213fcfdd285d615276a800232cee88bdf97578 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 24 Aug 2026 17:45:20 +0000 Subject: [PATCH 4/4] Pin workflow actions to version tags and restore peter-evans comments. Use peter-evans find-comment@v4 and create-or-update-comment@v5 for preview comments. Pin checkout, artifact, and reviewdog actionlint to moving version tags. Keep nubjs/setup-nub@v0.4.0. Drop commit SHAs. Co-authored-by: Jonathan Beckman --- .github/workflows/preview.yml | 101 +++++++++--------------- .github/workflows/release.yml | 2 +- .github/workflows/tegami-pr-comment.yml | 4 +- .github/workflows/tegami-pr-preview.yml | 4 +- .github/workflows/validate.yml | 18 ++--- 5 files changed, 48 insertions(+), 81 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index dddff711..dd7b83ba 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -51,7 +51,7 @@ jobs: pull-requests: write steps: - name: Check out repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 with: # Full history and tags let the deploy compute the release offset # label, for example v1.5.0+2-bbb222. @@ -116,49 +116,30 @@ jobs: CF_AI_SEARCH_SERVICE_TOKEN_ID: ${{ secrets.CF_AI_SEARCH_SERVICE_TOKEN_ID }} WRANGLER_SEND_METRICS: "false" - # GitHub-owned action so this template can start on SolZeroAI/platform. + - name: Find existing comment + if: ${{ github.event_name == 'pull_request' }} + id: find-comment + uses: peter-evans/find-comment@v4 + with: + issue-number: ${{ github.event.pull_request.number }} + comment-author: "github-actions[bot]" + body-includes: "" + - name: Create or update PR comment if: ${{ github.event_name == 'pull_request' }} - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - PREVIEW_URL: ${{ steps.preview-target.outputs.website_url }} - PREVIEW_SHA: ${{ github.event.pull_request.head.sha }} + uses: peter-evans/create-or-update-comment@v5 with: - script: | - const marker = "" - const body = `${marker} + comment-id: ${{ steps.find-comment.outputs.comment-id }} + issue-number: ${{ github.event.pull_request.number }} + body: | + ## Preview Deployed Your preview is ready. - **Preview URL:** ${process.env.PREVIEW_URL} - This preview was built from commit ${process.env.PREVIEW_SHA} + **Preview URL:** ${{ steps.preview-target.outputs.website_url }} + This preview was built from commit ${{ github.event.pull_request.head.sha }} --- - This comment will be updated automatically when you push new commits to this PR.` - const { owner, repo } = context.repo - const issue_number = context.issue.number - const comments = await github.paginate(github.rest.issues.listComments, { - owner, - repo, - issue_number, - }) - const existing = comments.find((comment) => - comment.user?.login === "github-actions[bot]" && - comment.body?.includes(marker) - ) - if (existing) { - await github.rest.issues.updateComment({ - owner, - repo, - comment_id: existing.id, - body, - }) - } else { - await github.rest.issues.createComment({ - owner, - repo, - issue_number, - body, - }) - } + This comment will be updated automatically when you push new commits to this PR. + edit-mode: replace cleanup-preview: name: Clean up preview stage @@ -172,7 +153,7 @@ jobs: pull-requests: write steps: - name: Check out repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 - name: Set up Nub uses: nubjs/setup-nub@v0.4.0 @@ -235,34 +216,24 @@ jobs: CF_AI_SEARCH_SERVICE_TOKEN_ID: ${{ secrets.CF_AI_SEARCH_SERVICE_TOKEN_ID }} WRANGLER_SEND_METRICS: "false" - # GitHub-owned action so this template can start on SolZeroAI/platform. - - name: Update comment with cleanup status + - name: Find existing comment if: ${{ github.event_name == 'pull_request' }} - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + id: find-comment + uses: peter-evans/find-comment@v4 + with: + issue-number: ${{ github.event.pull_request.number }} + comment-author: "github-actions[bot]" + body-includes: "" + + - name: Update comment with cleanup status + if: steps.find-comment.outputs.comment-id != '' + uses: peter-evans/create-or-update-comment@v5 with: - script: | - const marker = "" - const body = `${marker} + comment-id: ${{ steps.find-comment.outputs.comment-id }} + body: | + ## Preview Cleaned Up The preview for this PR has been cleaned up because the PR was closed. --- - Preview resources have been removed from Cloudflare.` - const { owner, repo } = context.repo - const comments = await github.paginate(github.rest.issues.listComments, { - owner, - repo, - issue_number: context.issue.number, - }) - const existing = comments.find((comment) => - comment.user?.login === "github-actions[bot]" && - comment.body?.includes(marker) - ) - if (!existing) { - return - } - await github.rest.issues.updateComment({ - owner, - repo, - comment_id: existing.id, - body, - }) + Preview resources have been removed from Cloudflare. + edit-mode: replace diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 16bc2154..b1f73157 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: timeout-minutes: 15 steps: - name: Check out validated commit - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 with: ref: ${{ github.event.workflow_run.head_sha }} fetch-depth: 0 diff --git a/.github/workflows/tegami-pr-comment.yml b/.github/workflows/tegami-pr-comment.yml index d0e968be..4f20b1be 100644 --- a/.github/workflows/tegami-pr-comment.yml +++ b/.github/workflows/tegami-pr-comment.yml @@ -22,7 +22,7 @@ jobs: timeout-minutes: 10 steps: - name: Check out trusted release tooling - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 - name: Set up Nub uses: nubjs/setup-nub@v0.4.0 @@ -35,7 +35,7 @@ jobs: run: nub install --frozen-lockfile - name: Download release preview - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@v8 with: name: tegami-pr-preview run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/tegami-pr-preview.yml b/.github/workflows/tegami-pr-preview.yml index 3af8b30c..7af929d8 100644 --- a/.github/workflows/tegami-pr-preview.yml +++ b/.github/workflows/tegami-pr-preview.yml @@ -19,7 +19,7 @@ jobs: timeout-minutes: 10 steps: - name: Check out pull request - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 with: fetch-depth: 0 @@ -37,7 +37,7 @@ jobs: run: nub run tegami pr preview --artifact tegami-pr-preview.md - name: Upload release preview - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@v7 with: name: tegami-pr-preview path: tegami-pr-preview.md diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index d85c3b65..815e4d41 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -17,6 +17,8 @@ on: permissions: contents: read + checks: write + pull-requests: write jobs: validate: @@ -25,7 +27,7 @@ jobs: timeout-minutes: 30 steps: - name: Check out repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@v7 with: ref: ${{ inputs.checkout_ref || github.ref }} @@ -57,16 +59,10 @@ jobs: run: nub run format - name: Lint GitHub Actions workflows - env: - ACTIONLINT_VERSION: "1.7.12" - ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8" - run: | - curl --proto '=https' --tlsv1.2 -fsSL \ - -o actionlint.tar.gz \ - "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" - echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum --check - tar -xzf actionlint.tar.gz actionlint - ./actionlint -color .github/workflows/*.yml + uses: reviewdog/action-actionlint@v1 + with: + fail_level: error + filter_mode: nofilter - name: Test if: github.repository != 'SolZeroAI/platform'