diff --git a/.github/workflows/bootstrap-current-pr-queue.yml b/.github/workflows/bootstrap-current-pr-queue.yml new file mode 100644 index 000000000..1a8e07a79 --- /dev/null +++ b/.github/workflows/bootstrap-current-pr-queue.yml @@ -0,0 +1,60 @@ +name: Bootstrap Current PR Queue + +on: + push: + branches: + - automation/hourly-commercial-readiness-loop + +permissions: + actions: write + checks: read + contents: write + id-token: write + pull-requests: write + +concurrency: + group: bootstrap-current-pr-queue + cancel-in-progress: false + +jobs: + remove-one-shot-workflow: + if: github.event.head_commit.message == 'ci: dispatch current PR queue' + runs-on: ubuntu-latest + steps: + - name: Harden runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + + - name: Checkout queue branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Remove one-shot workflow from the product diff + shell: bash + run: | + set -euo pipefail + git rm .github/workflows/bootstrap-current-pr-queue.yml + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "chore(ci): remove one-shot queue bootstrap" + git push origin "HEAD:${GITHUB_REF_NAME}" + + dispatch-current-queue: + needs: remove-one-shot-workflow + if: needs.remove-one-shot-workflow.result == 'success' + uses: ContextualWisdomLab/.github/.github/workflows/pr-review-merge-scheduler.yml@5983b41ace75040c1d81818171ca7d0f3653254e + with: + dry_run: false + max_prs: "100" + trigger_reviews: true + review_dispatch_limit: "-1" + branch_update_limit: "-1" + enable_auto_merge: true + merge_mode: direct_or_auto + update_branches: true + stale_opencode_minutes: "0" + project_flow: github-flow + base_branch: main + secrets: inherit diff --git a/.github/workflows/hourly-commercial-readiness-loop.yml b/.github/workflows/hourly-commercial-readiness-loop.yml new file mode 100644 index 000000000..2e3830404 --- /dev/null +++ b/.github/workflows/hourly-commercial-readiness-loop.yml @@ -0,0 +1,40 @@ +name: Hourly Commercial Readiness Loop + +on: + schedule: + # Run once per hour, offset from the top of the hour to reduce hosted-runner + # queue contention. GitHub schedules are evaluated in UTC. + - cron: "17 * * * *" + workflow_dispatch: + +# The reusable scheduler needs these permissions to dispatch same-head reviews, +# update approved branches, enable auto-merge, and merge policy-clean PRs. +permissions: + actions: write + checks: read + contents: write + id-token: write + pull-requests: write + +concurrency: + group: hourly-commercial-readiness-${{ github.repository }} + # Only the newest queue sweep is relevant; prevent delayed hourly runs from + # accumulating behind a temporary GitHub Actions backlog. + cancel-in-progress: true + +jobs: + review-check-merge-loop: + uses: ContextualWisdomLab/.github/.github/workflows/pr-review-merge-scheduler.yml@5983b41ace75040c1d81818171ca7d0f3653254e + with: + dry_run: false + max_prs: "100" + trigger_reviews: true + review_dispatch_limit: "-1" + branch_update_limit: "-1" + enable_auto_merge: true + merge_mode: direct_or_auto + update_branches: true + stale_opencode_minutes: "90" + project_flow: github-flow + base_branch: main + secrets: inherit diff --git a/CHANGELOG.md b/CHANGELOG.md index 679a62024..a973fde17 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # Changelog ## Unreleased +- [Ops] ⏱️ **시간별 상용 준비도 루프**: 매시간 중앙 OpenCode/Strix 리뷰 디스패치, 최신 base 반영, 필수 Checks 재검증, auto-merge 및 head-SHA 보호 병합을 수행하는 GitHub Actions 워크플로를 추가했습니다. - [BE] 🔒 **공유 export 전 경로 redaction**: 공개 share의 SQL / index-design / reversing-spec export에서 코멘트·`example_value`를 제거합니다. 단위 테스트로 누출을 차단합니다. - [BE] 🛠️ **함수 인덱스 중복 오탐 수정**: `lower(email)` 등 expression index를 평문 컬럼 인덱스의 중복으로 잘못 판단하지 않도록 괄호 파서를 강화했습니다. - [Docs] README를 상용 기준 기능 설명으로 갱신 (MVP skeleton 표현 제거, share redaction·diff/export 반영).