Repository navigation
feat: templates and zizmor fallback for new repositories - #5
Merged
Merged
Conversation
zizmor's default policy requires a SHA for privacybydesign/* too, so a new repository set up from the workflow templates failed workflow-lint on its @v1 references until it copied templates/zizmor.yml. Without a config of its own, a repository now gets the shared policy.
templates/workflows/ holds thin callers of the shared workflows (Status checks for Go and Node, Delivery, Image rescan, Terraform, releases), to copy into a new repository. They replace workflow templates in the org .github repository, which stays private and so could not serve the public repositories. Self CI lints them along with the workflows.
rubenhensen
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 22 October, every new repository in the org gets
shared-ci=v1, soStatus checks passedis required before its first pull request can merge. This makes that easy:templates/workflows/: thin callers of the shared workflows to copy into a new repository: Status checks for Go and Node (ending in theStatus checks passedgate), Delivery, Image rescan, Terraform, release-please, Go release, npm publish, PR title, GHCR clean-up and Scorecard. They are Martijn's v1.1 templates. The$default-branchplaceholder is replaced bymain, because that placeholder only works through the "New workflow" button. Self CI now lints them too. They live here instead of in the org.githubrepository, which stays private; GitHub only offers templates from a private.githubto private repositories.workflow-lint.yml: without azizmor-configinput or a.github/zizmor.yml, a repository now gets the shared policy (privacybydesign/*by tag, everything else by SHA). zizmor's own defaults reject@v1, which would fail a fresh repository on its first pull request.CHANGELOG: v1.1.3.
Part of YIV-401.