Commit Graph

29 Commits

Author SHA1 Message Date
Aurélien Bombo
8d7d859e30 gha: Eliminate use of force-skip-ci label
This was originally implemented as a Jenkins skip and is only used in a few
workflows.  Nowadays this would be better implemented via the gatekeeper.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-07-02 10:29:50 -05:00
stevenhorsman
088e97075c workflow: Add top-level permissions
Set:
```
permissions:
  contents: read
```
as the default top-level permissions explicitly
to conform to recommended security practices e.g.
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
2025-05-28 19:34:28 +01:00
Aurélien Bombo
a678046d13 gha: Pin third-party actions to commit hashes
A popular third-party action has recently been compromised [1][2] and
the attacker managed to point multiple git version tags to a malicious
commit containing code to exfiltrate secrets.

This PR follows GitHub's recommendation [3] to pin third-party actions
to a full-length commit hash, to mitigate such attacks.

Hopefully actionlint starts warning about this soon [4].

 [1] https://www.cve.org/CVERecord?id=CVE-2025-30066
 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
 [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
 [4] https://github.com/rhysd/actionlint/pull/436

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-19 13:52:49 -05:00
Aurélien Bombo
de98e467b4 ci: Use ubuntu-22.04 instead of ubuntu-latest
22.04 is the default today:
23da668261/README.md

Being more specific will avoid unexpected errors when Github updates the
default.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2024-08-27 16:44:39 +00:00
Fabiano Fidêncio
3fd021a9b3 ci: commit-message-check: Take re-revert into consideration
`Reapply "` should be taken into sonsideration as well.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-08-21 14:19:16 +02:00
stevenhorsman
0bec8721cc workflow: Skip commit checks for dependabout
Dependabot doesn't follow all our commit format guidelines,
so add a check and skip these if the author is `dependabot[bot]`

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-04-29 13:45:51 +01:00
Zvonko Kaiser
395e93acd5 kata: Remove Issue - PR dependency
We've discussed this over and over. Let's try to get to an agreement here.
I will use this issue to remove the mandatory Issue - PR dependency.

Fixes: #9500

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-04-17 09:53:08 +00:00
Fabiano Fidêncio
fbc2a91ab5 gha: Cancel previous jobs if a PR is updated
Let's make sure we cancel previous runs, mainly as we have some of those
that take a lot of time to run, whenever the PR is updated.

This is based on the following stack overflow suggestion:
https://stackoverflow.com/questions/66335225/how-to-cancel-previous-runs-in-the-pr-when-you-push-new-commitsupdate-the-curre

This is very much needed as we don't want to wait for a long time to
have access to a runner because of other runners are still being used
performing a task that's meaningless due to the PR update.

Fixes: #7298

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-07-11 14:37:10 +02:00
Byron Marohn
5226f15c84 gha: Fix Body Line Length action flagging empty body commit messages
Change the Body Line Length workflow to not trigger when the commit
message contains only a message without a body. Other workflows will
flag the missing body sections, and it was confusing to have an error
message that said 'Body line too long (max 150)' when this was not
actually the case.

Fixes: #5561

Co-authored-by: Jayant Singh <jayant.singh@intel.com>
Co-authored-by: Luke Phillips <lucas.phillips@intel.com>
Signed-off-by: Byron Marohn <byron.marohn@intel.com>
Signed-off-by: Jayant Singh <jayant.singh@intel.com>
Signed-off-by: Luke Phillips <lucas.phillips@intel.com>
Signed-off-by: Kelby Madal-Hellmuth <kelby.madal-hellmuth@intel.com>
Signed-off-by: Liz Lawrens <liz.lawrens@intel.com>
2023-04-26 17:29:16 -04:00
Bin Liu
99a7b4f3e1 workflow: Revert "static-checks: Allow Merge commit to be >75 chars"
This reverts commit 575df4dc4d.

Fixes: #4871

Signed-off-by: Bin Liu <bin@hyper.sh>
2022-08-11 08:59:02 +08:00
Zhongtao Hu
0826a2157d Merge remote-tracking branch 'origin/main' into runtime-rs-1
Signed-off-by: Zhongtao Hu <zhongtaohu.tim@linux.alibaba.com>
2022-07-11 09:47:23 +08:00
Peng Tao
3bafafec58 action: extend commit message line limit to 150 bytes
So that we can add move info there and few people use such small
terminals nowadays.

Fixes: #4596
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
2022-07-06 11:19:08 +08:00
Derek Lee
433816cca2 ci/cd: update check-commit-message
Recently added check-commit-message to the tests repository. Minor
changes were also made to action. For consistency's sake, copied changes
over to here as well.

tests - https://github.com/kata-containers/tests/pull/4878

Minor Changes:
   1. Body length check is now 75 and consistent with guidelines
   2. Lines without spaces are not counted in body length check

Fixes #4559

Signed-off-by: Derek Lee <derlee@redhat.com>
2022-06-29 16:55:43 -07:00
Liu Jiang
575df4dc4d static-checks: Allow Merge commit to be >75 chars
Some generated merge commit messages are >75 chars
Allow these to not trigger the subject line length failure

Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2022-06-10 18:25:24 +08:00
Gabriela Cervantes
62351637da action: Update link for format patch documentation
This PR updates the link for the format patch documentation for the
commit message check.

Fixes #3900

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2022-03-15 16:11:43 +00:00
Fabiano Fidêncio
88a70d32ba Revert "workflows: Ensure a label change re-triggers the actions"
This reverts commit 7a879164bd, as it's
been proved that re-triggering the checks at every single change is more
painful than having to close / re-open a PR in case we ever use the
`force-skip-ci` label again.

Fixes: #2804

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-02-04 00:01:21 +01:00
Tim Zhang
5083ae65a0 workflows: stop checking revert commit
The commit message of a revert commit usually generated by
`git revert`, we should consider this as legal.

Consider the commit as the merge commit if the subject
starts with 'Reject "'

Follow the pr kata-containers/tests/#3938, the suttle diffrence
is we skip all commit checks for revert commit including fixes checking
and subsystem checking. Because the commit was reverted must have passed
the check so the revert-commit should have the Fixes and Subsystem.

Fixes: #3568
Fixes: kata-containers/tests#3934

Signed-off-by: Tim Zhang <tim@hyper.sh>
2022-01-29 11:45:20 +08:00
Fabiano Fidêncio
7a879164bd workflows: Ensure a label change re-triggers the actions
This is needed in order to ensure that, for instance, if `force-skip-ci`
label is either added or removed later, the jobs related to the actions
will be restarted and accordingly checked.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-01-18 14:39:01 +01:00
Fabiano Fidêncio
d87ab14fa7 workflows: Ensure force-skip-ci skips all actions
Before this change it was only applied to the static-checks, but if
we're already taking the extreme path of skipping the CI, we better
ensure we skip all the actions and not just a few of them.

Fixes: #3471

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-01-18 14:37:32 +01:00
AIsland
5f0abc20f0 CI: Fix incorrect URL
Correct the link in the GitHub action commit message check showing users how to format all commits.

Fixes: #1053

Signed-off-by: AIsland <yuchunyu01@inspur.com>
2020-11-04 10:05:20 +08:00
James O. D. Hunt
0351732778 action: Allow long lines if non-alphabetic
Overly long commit lines are annoying. But sometimes,
we need to be able to force the use of long lines
(for example to reference a URL).

Ironically, I can't refer to the URL that explains this
because of ... the long line check! Hence:

```sh
$ cat <<EOT | tr -d '\n'; echo
See: https://github.com/kata-containers/tests/tree/master/
cmd/checkcommits#handling-long-lines
EOT
```

Maximum body length updated to 150 bytes for parity with:

https://github.com/kata-containers/tests/pull/2848

Fixes: #687.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2020-09-24 15:32:38 +01:00
Tim Zhang
729a3b1d33 action: ignore 'fixes check' for subsystem 'release'
Fixes #754

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-09-18 15:30:34 +08:00
Tim Zhang
cfa35a90b2 action: Fix subsystem check
\h is not a valid metacharacter in javascript which is used in
github-action.
Use \s\t to replace it.

Fixes: #551

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-21 23:49:43 +08:00
Tim Zhang
2889af7710 actions: Run subject-line-length check even if the previous checks failed
So that we can see as many errors as possible at once.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-13 20:36:49 +08:00
Tim Zhang
9f0fef5add actions: Add commit-body-missing check
Check if the commit body is missing use github action.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-13 20:36:49 +08:00
Tim Zhang
d81af48ae5 actions: Do not limit the length of single word in commit body
If the line comprises of only a single word,
it may be something like a URL (it's certainly very unlikely to be a
normal word if the default lengths are being used), so length
checks won't be applied to it.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-13 20:36:49 +08:00
Tim Zhang
8c46a41b96 actions: Fix subsystem checking in github-action
The former regex mistakenly count SoB(DCO) as a valid subsystem.
This commit will fix this issue.

Fixes: #520

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-13 20:36:49 +08:00
Tim Zhang
2466ac73bb actions: Fix 'Fixes checking' problem by update dependent action
The Fixes checking should pass as long as one of the commits of
pull-request pass the check.

update depdent github-action commit-message-checker-with-regex to v0.3.1

shortlog:
d6d9770 commit-message-checker-with-regex: Add input one_pass_all_pass

Fixes: #519

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-13 20:34:43 +08:00
Tim Zhang
c305911def actions: Use github action to do Fixes/Length/Subsystem check
The commit checks does not need to wait for CI dependencies to be
installed, It's a waste of time. we need show errors ASAP.

And we should display as many problems as possible at once
Fixes: #487

Signed-off-by: Tim Zhang <tim@hyper.sh>
2020-08-05 21:39:53 +08:00