From cd3e4003db7b8a45fec4edba94e4edaaee356948 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 19:16:40 +0200 Subject: [PATCH 1/3] chore(ci): adopt shared workflows and central Renovate preset - renovate.json -> central preset (dungeon-python-maintainers) - security.yml (Trivy + CycloneDX SBOM) - close_invalid_prs.yml --- .github/workflows/close_invalid_prs.yml | 10 +++++ .github/workflows/security.yml | 55 +++++++++++++++++++++++++ renovate.json | 6 +-- 3 files changed, 66 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/close_invalid_prs.yml create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/close_invalid_prs.yml b/.github/workflows/close_invalid_prs.yml new file mode 100644 index 0000000..bd99444 --- /dev/null +++ b/.github/workflows/close_invalid_prs.yml @@ -0,0 +1,10 @@ +name: Close invalid PRs + +on: + pull_request_target: + types: [opened] + +jobs: + close: + uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..2faf8ee --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,55 @@ +name: Security + +# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained +# on purpose: it needs no build tool and no registry credentials, so it is the +# baseline security gate for every repository regardless of language. +on: + pull_request: + push: + branches: [dev] + schedule: + - cron: "8 4 * * 1" + workflow_dispatch: +permissions: + contents: read + security-events: write + +jobs: + trivy: + name: Trivy scan + uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1 + with: + scan-type: "fs" + scanners: "vuln,secret" + severity: "CRITICAL,HIGH" + # Report-only for now, so adopting this does not turn CI red on day one. + fail-on-findings: false + upload-sarif: true + secrets: inherit + + sbom: + name: CycloneDX SBOM + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Upload SBOM + uses: actions/upload-artifact@v4 + with: + name: sbom-cyclonedx + path: bom.json + if-no-files-found: error + retention-days: 90 diff --git a/renovate.json b/renovate.json index 1bc58cd..59d89a7 100644 --- a/renovate.json +++ b/renovate.json @@ -1,11 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "config:base" - ], - "rebaseWhen": "conflicted", - "labels": [ - "renovate" + "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/dungeon-python-maintainers)" ], "packageRules": [ { From 067e87ae09b252c8b3c7fef8573dbc49a5eb0cef Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:12:42 +0200 Subject: [PATCH 2/3] chore(ci): add release-please, PR linting and release SBOMs - removed superseded close_invalid_prs.yaml - pr-lint.yml - commitlint.config.mjs - release-please simple mode, bootstrapped at 0.0.0 - release-please.yml with SBOM attached to the release --- .github/workflows/close_invalid_prs.yaml | 18 --------- .github/workflows/pr-lint.yml | 17 +++++++++ .github/workflows/release-please.yml | 48 ++++++++++++++++++++++++ .release-please-manifest.json | 3 ++ commitlint.config.mjs | 3 ++ release-please-config.json | 12 ++++++ 6 files changed, 83 insertions(+), 18 deletions(-) delete mode 100644 .github/workflows/close_invalid_prs.yaml create mode 100644 .github/workflows/pr-lint.yml create mode 100644 .github/workflows/release-please.yml create mode 100644 .release-please-manifest.json create mode 100644 commitlint.config.mjs create mode 100644 release-please-config.json diff --git a/.github/workflows/close_invalid_prs.yaml b/.github/workflows/close_invalid_prs.yaml deleted file mode 100644 index 9064b67..0000000 --- a/.github/workflows/close_invalid_prs.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Thanks paper: https://github.com/papermc/paper/blob/master/.github/workflows/close_invalid_prs.yml -name: Close invalid PRs - -on: - pull_request_target: - types: [ opened ] - -jobs: - run: - if: ${{ github.repository != github.event.pull_request.head.repo.full_name && github.head_ref == 'master' }} - runs-on: ubuntu-latest - steps: - - uses: superbrothers/close-pull-request@v3 - id: "master_branch" - if: github.head_ref == 'master' - with: - comment: | - Hi there! :wave: This PR is targeting the `master` branch, which is not allowed. Please target the `develop` branch instead. Thanks! \ No newline at end of file diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml new file mode 100644 index 0000000..759b37b --- /dev/null +++ b/.github/workflows/pr-lint.yml @@ -0,0 +1,17 @@ +name: PR Lint + +# Conventional Commits on the PR title and every commit on the branch. +# release-please parses those commit types to decide the version bump and to +# build the changelog - a non-conventional commit silently produces neither. +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..d7f86e9 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,48 @@ +name: Release + +# release-please collects Conventional Commits into a release PR; merging it +# tags the version and cuts the GitHub release. Everything that has to happen +# for a release is chained into this same run on purpose: release-please tags +# with GITHUB_TOKEN, and a tag pushed that way does NOT start a separate +# `on: push: tags` workflow. +on: + push: + branches: [dev] + workflow_dispatch: +permissions: + contents: write + pull-requests: write + +jobs: + release-please: + uses: OneLiteFeatherNET/workflows/.github/workflows/release-please.yml@v2.8.1 + secrets: inherit + + sbom: + name: Attach SBOM to release + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Generate CycloneDX SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Attach SBOM to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" bom.json --clobber diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..e18ee07 --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.0.0" +} diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 0000000..0616fb9 --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ['@commitlint/config-conventional'], +}; diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..0f3d69c --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "release-type": "simple", + "include-component-in-tag": false, + "include-v-in-tag": true, + "packages": { + ".": { + "package-name": "Dungeon-Python", + "changelog-path": "CHANGELOG.md" + } + } +} From dfaa01110ba70add7c79d736856429813f182523 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 21:12:42 +0200 Subject: [PATCH 3/3] fix(ci): restore Renovate platform presets and anchor the version in build.gradle.kts - bootstrap-sha set from tip of dev (no version tag yet) --- release-please-config.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/release-please-config.json b/release-please-config.json index 0f3d69c..9f53de3 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -8,5 +8,6 @@ "package-name": "Dungeon-Python", "changelog-path": "CHANGELOG.md" } - } + }, + "bootstrap-sha": "25a7f938a37ed87eb0f16be68da9eb69dd12e291" }