Enhance reusable workflows#80
Conversation
Co-authored-by: Yaswant Pradhan <2984440+yaswant@users.noreply.github.com>
…e handling of merge conflicts and streamline file comparison
…private forks and streamline file comparison
Yaswant Pradhan (yaswant)
changed the title
…roved safety and clarity
…sions for workflows
- Set 'requirements' in build-sphinx-docs.yaml to optional - Update output redirection syntax in cla-check.yaml, sphinx-docs.yaml, and track-review-project.yaml for consistency - Add Actionlint, Zizmor, and Markdown Lint steps to validate workflows in validate.yaml - Change shell from Python to Bash in labeler action for input validation - Update pyproject.toml to include new dependencies and configure Markdown Lint settings - Improve formatting and clarity in README.md
…essaging and error handling
James Bruten (james-bruten-mo)
left a comment
James Bruten (james-bruten-mo)
left a comment
There was a problem hiding this comment.
A couple of queries around things, but otherwise looks ok. Can you link the git_playground PR where you tested these.
Would it also be possible for you to update the checkout action to the new v7 and retest please. There are changes to pull_request_target behaviour in that which may affect us https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
I suspect we're probably ok, other than the cla-check which may require us to use the override.
| # Clean up the localised workspace | ||
| rm -f base_raw.txt pr_raw.txt base_clean.txt pr_clean.txt | ||
| fi | ||
| # - name: Check if CONTRIBUTORS.md was modified in PR |
There was a problem hiding this comment.
I assume this commented section can now be removed?
There was a problem hiding this comment.
Yes. I kept it there as that was my first attempt to replace the original implementation.
There was a problem hiding this comment.
Now removed.
Its under the Code Quality Checklist section of the PR
Let me give that a spin. |
Yaswant Pradhan (yaswant)
requested a review
from James Bruten (james-bruten-mo)
3 participants
PR Summary
Code Reviewer: James Bruten (@james-bruten-mo)
Hardens the GitHub Actions security baseline across all workflows.
Action pinning
actions/checkout@v6→@df4cb1c…).actions/github-scriptintrack-review-project.yamlupgraded fromv8 → v9as part of the pin.Credential & permission scoping
persist-credentials: falseadded to everyactions/checkoutsteppermissions: {}set on caller workflows; granularcontents: read/pull-requests: write/actions: readpushed down to job level incall-track-review-project.yaml,call-trigger-project-workflow.yaml, andtrigger-project-workflow.yamlfortran-lint.yamlgains an explicit contents: read job permission.Template-injection fixes (zizmor)
cla-check.yaml: step outputs andinputs.cla-urlmoved toenv:vars, read viaprocess.env.*in thegithub-scriptblock.fortran-lint.yaml: all string/path inputs moved toenv:vars; boolean flags resolved in shell using a bash array.track-review-project.yaml:inputs.project_organdinputs.project_numbermoved toenv:vars. Also, includedPROJECT_ACTION_PATsecret as required parameter to avoid secret inheritance in caller workflow (breaking change! See updated README for usage).CLA workflow logic
git ls-remote → gh api repos/.../pulls/…(avoids unauthenticated git network call).CONTRIBUTORS.mdmodification check rewritten:git diff→ GitHub Contents API +base64 | tr | cmp(avoids authenticated git fetch from fork). File modification now checked against content instead of just file state.Tooling & config
dependabot.yaml: monthly schedule, major-version updates blocked, all action updates grouped into a single PRzizmor.yaml: suppressesunpinned-uses,dangerous-triggers, andsecrets-inheritfor the two caller workflows that usesecrets: inherit.yamllint: updatedignoresyntax; addedcommentsandcomments-indentationrules.To enforce strict GitHub Actions security baselines, we now use immutable 40-character commit SHAs.
✅ Code Quality Checklist
(Some checks are automatically carried out via the CI pipeline)
🤖 AI Assistance and Attribution
💻 Code Review