From 14ba4301ef3cca361e81075e78b6beea04bb75aa Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Wed, 12 Aug 2026 15:28:02 -0500 Subject: [PATCH 1/4] chore: upgrade action runtime to node24 --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index 00acac4..1e34a98 100644 --- a/action.yml +++ b/action.yml @@ -73,5 +73,5 @@ inputs: outputs: {} runs: - using: "node20" + using: "node24" main: "dist/index.js" From 825e2e46a6b306fa91ce61d0e4ee05e283342645 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 10:47:37 -0500 Subject: [PATCH 2/4] fix: route codeowners validation through shared-codeowners workflow --- .github/workflows/validate-codeowners.yml | 28 ++++------------------- 1 file changed, 5 insertions(+), 23 deletions(-) diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index e7a8159..7f58333 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -5,26 +5,8 @@ on: pull_request: jobs: - validate-codeowners: - runs-on: ubuntu-latest - steps: - - name: "Checkout source code at current commit" - uses: actions/checkout@v2 - # Leave pinned at 0.7.1 until https://github.com/mszostok/codeowners-validator/issues/173 is resolved - - uses: mszostok/codeowners-validator@v0.7.1 - if: github.event.pull_request.head.repo.full_name == github.repository - name: "Full check of CODEOWNERS" - with: - # For now, remove "files" check to allow CODEOWNERS to specify non-existent - # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos - # checks: "files,syntax,owners,duppatterns" - checks: "syntax,owners,duppatterns" - owner_checker_allow_unowned_patterns: "false" - # GitHub access token is required only if the `owners` check is enabled - github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" - - uses: mszostok/codeowners-validator@v0.7.1 - if: github.event.pull_request.head.repo.full_name != github.repository - name: "Syntax check of CODEOWNERS" - with: - checks: "syntax,duppatterns" - owner_checker_allow_unowned_patterns: "false" + ci-codeowners: + uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main + with: + is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + secrets: inherit From 6e4942b86e23380b5bfbea29edc23dbfb2e50a37 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 10:56:43 -0500 Subject: [PATCH 3/4] chore: declare least-privilege permissions on codeowners workflow --- .github/workflows/validate-codeowners.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index 7f58333..b9272b7 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -4,6 +4,9 @@ on: pull_request: +permissions: + contents: read + jobs: ci-codeowners: uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main From 9dd96768758f967335e5e3f08cb3bf74a9590513 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 11:57:21 -0500 Subject: [PATCH 4/4] chore: SHA-pin workflow actions on Node 24 runtimes --- .github/workflows/build-and-test.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 3d8f5f8..e85a5f3 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -36,10 +36,10 @@ jobs: runs-on: ubuntu-latest needs: check-dist steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} - - uses: actions/setup-node@v3 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: package.json cache: yarn @@ -53,17 +53,17 @@ jobs: runs-on: ubuntu-latest needs: check-dist steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} - - uses: actions/setup-node@v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: package.json cache: yarn - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} aws-region: ${{ env.AWS_REGION }} @@ -126,11 +126,11 @@ jobs: runs-on: ubuntu-latest needs: check-dist steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} - - uses: actions/setup-node@v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: package.json cache: yarn