Commit Graph

10 Commits

Author SHA1 Message Date
Aurélien Bombo
433e59de1f gha: zizmor: fix "workflow or action definition without a name" error
This fixes that error everywhere by adding a `name:` field to all jobs that
were missing it. We keep the same name as the job ID to ensure no
disturbance to the required job names.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-09-25 23:34:40 -05:00
stevenhorsman
b4545da15d workflows: Set top-level permissions to empty
The default suggestion for top-level permissions was
`contents: read`, but scorecard notes anything other than empty,
so try updating it and see if there are any issues. I think it's
only needed if we run workflows from other repos.

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-08-22 14:13:21 +01:00
stevenhorsman
9d3b9fb438 workflows: Pin action hashes
Pin Github owned actions to specific hashes as recommended
as tags are mutable see https://pin-gh-actions.kammel.dev/.
This one of the recommendations that scorecard gives us.

Note this was generated with `frizbee actions`

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-06-21 08:14:13 +01:00
stevenhorsman
088e97075c workflow: Add top-level permissions
Set:
```
permissions:
  contents: read
```
as the default top-level permissions explicitly
to conform to recommended security practices e.g.
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
2025-05-28 19:34:28 +01:00
Aurélien Bombo
de98e467b4 ci: Use ubuntu-22.04 instead of ubuntu-latest
22.04 is the default today:
23da668261/README.md

Being more specific will avoid unexpected errors when Github updates the
default.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2024-08-27 16:44:39 +00:00
stevenhorsman
cf5c3dc155 gha: stale: Bump stalebot version
- Bump the stalebot action version to v9 as that fixes the
```
Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/stale@v8.
```
warning.

Fixes: #9512
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-04-18 11:41:09 +01:00
stevenhorsman
7235988605 gha: stale: Remove the start-date
As documented in https://github.com/actions/stale?tab=readme-ov-file#start-date
> The start date is used to ignore the issues and pull requests created before the start date.
> Particularly useful when you wish to add this stale workflow on an existing repository
> and only wish to stale the new issues and pull requests.

As we don't want need to treat PRs older than May 2023 as a special case, then remove this option.

Fixes: #9502
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-04-17 11:19:56 +01:00
Fabiano Fidêncio
994615ca28 gha: stale: Allow manually triggering it
This will help us to avoid waiting till the next time cron would trigger
the action to test

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-11-03 08:17:48 +01:00
Fabiano Fidêncio
6abcf03611 gha: stale: Fix typo action -> actions
This is causing the following error:
```
Unable to resolve action action/stale, repository not found
```

Fixes: #8347

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-11-03 08:15:18 +01:00
Fabiano Fidêncio
abec287058 gha: Add workflow to close stale PRs
Our goal. as discussed in the Architecture Committee meeting held on
October 31st, 2023, is to take a more aggressive action on issues and
PRs that have been opened for a long time.

This commit is the very first step, and it's **only** targetting
**PRs**.  What this action will do is:
* Mark all the PRs that have no activity for more than 180 days,
  starting from May 1st, 2023, as stale.
  * A message will be added, letting the contributor know that they can
    simply comment on the PR in order to make it "not stale".
* If there's no activity on the PR for 7 days, the PR will be
  automatically closed.

Fixes: #8347

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-11-02 09:19:44 +01:00