Skip to content

Commit 19edb2a

Browse files
Teebor-Chokaclaude
Teebor-Choka
and
claude
authored
feat(ci): rename build.yaml to pr.yaml, add zizmor and PR validation (#722)
Rename build.yaml to pr.yaml, add PR title validation, labeling, and zizmor scanning. Pin unpinned actions to SHA. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Adds automated security checks via Zizmor on PRs. * Adds automatic PR labeling for toolchain and dependency changes. * Implements semantic pull request title validation. * **Chores** * Reworks CI workflows and build pipeline (consolidation and new PR-triggered flows). * Adds a new developer CI shell for local CI-related tooling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent f18d36b commit 19edb2a

5 files changed

Lines changed: 171 additions & 67 deletions

File tree

‎.github/labeler.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
toolchain:
2+
- changed-files:
3+
- any-glob-to-any-file:
4+
- 'flake.*'
5+
- '*.nix'
6+
- .github/**
7+
dependencies:
8+
- changed-files:
9+
- any-glob-to-any-file:
10+
- yarn.lock
11+
- package.json

‎.github/workflows/build.yaml‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎.github/workflows/checks-zizmor.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: Zizmor
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
paths: ['.github/**']
7+
merge_group:
8+
types: [checks_requested]
9+
concurrency:
10+
group: ${{ github.event.pull_request.head.ref || github.ref_name }}-zizmor
11+
cancel-in-progress: true
12+
permissions:
13+
contents: read
14+
security-events: write
15+
jobs:
16+
zizmor:
17+
uses: hoprnet/hopr-workflows/.github/workflows/checks-zizmor.yaml@bbd22e57cf954c15f0a6051d59329857809141dd # workflow-checks-zizmor-v1
18+
permissions:
19+
contents: read
20+
security-events: write
21+
with:
22+
source_branch: ${{ github.event.pull_request.head.ref || github.ref }}
23+
runner: self-hosted-hoprnet-bigger
24+
secrets:
25+
cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}

‎.github/workflows/pr.yaml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
---
2+
name: PR
3+
on:
4+
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- reopened
9+
- labeled
10+
- ready_for_review
11+
merge_group:
12+
types: [checks_requested]
13+
14+
concurrency:
15+
group: ${{ github.event.pull_request.head.ref || github.ref_name }}-pr
16+
cancel-in-progress: true
17+
jobs:
18+
validate-pr-title:
19+
name: Validate title
20+
if: github.event_name == 'pull_request'
21+
runs-on: self-hosted-hoprnet-small
22+
permissions:
23+
pull-requests: read
24+
steps:
25+
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
with:
29+
types: |
30+
fix
31+
feat
32+
build
33+
chore
34+
docs
35+
style
36+
refactor
37+
perf
38+
test
39+
requireScope: false
40+
ignoreLabels: |
41+
bot
42+
ignore-semantic-pull-request
43+
44+
label:
45+
name: Add labels
46+
if: github.event_name == 'pull_request'
47+
runs-on: self-hosted-hoprnet-small
48+
permissions:
49+
contents: read
50+
issues: write
51+
pull-requests: write
52+
steps:
53+
- name: Harden Runner
54+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
55+
with:
56+
disable-sudo: true
57+
egress-policy: audit
58+
- name: Checkout repository
59+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60+
with:
61+
persist-credentials: false
62+
- uses: actions/labeler@77a4082b841706ac431479b7e2bb11216ffef250 # main on 20.02.2025
63+
with:
64+
sync-labels: true
65+
- name: Add "external" label for forked PRs
66+
env:
67+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
68+
BASE_REPO: ${{ github.repository }}
69+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
70+
PR_NUMBER: ${{ github.event.pull_request.number }}
71+
run: |
72+
if [[ "$HEAD_REPO" != "$BASE_REPO" ]]; then
73+
gh pr edit "$PR_NUMBER" --add-label "external"
74+
fi
75+
76+
build:
77+
name: Build
78+
runs-on: self-hosted-hoprnet-small
79+
permissions:
80+
contents: read
81+
strategy:
82+
matrix:
83+
node-version: [22.x, 24.x]
84+
steps:
85+
- name: Checkout repository
86+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
87+
with:
88+
persist-credentials: false
89+
90+
- name: Setup Node.js
91+
uses: hoprnet/hopr-workflows/actions/setup-node-js@15db9fb5571957317b77567abef997b1554f2fbb # setup-node-js-v1
92+
with:
93+
node_version: ${{ matrix.node-version }}
94+
95+
- name: Building
96+
run: yarn build
97+
98+
- name: Linting
99+
run: yarn lint:ci
100+
101+
- name: Formatting
102+
run: yarn format:ci
103+
104+
- name: Testing
105+
run: yarn test
106+
build-docker:
107+
name: Docker
108+
uses: hoprnet/hopr-workflows/.github/workflows/build-docker.yaml@43b03a7b5df777770d95c6524f48be34184b26fa # build-docker-v1
109+
permissions:
110+
contents: read
111+
pull-requests: write
112+
id-token: write
113+
with:
114+
source_branch: ${{ github.event.pull_request.head.ref || github.ref }}
115+
version_type: commit
116+
build_matrix: >-
117+
[
118+
{
119+
"runner": "self-hosted-hoprnet-bigger",
120+
"architecture": "x86_64-linux",
121+
"build_command": "nix run .#docker-x86_64-linux"
122+
}
123+
]
124+
build_file: package.json
125+
docker_image_name: ${{ vars.DOCKER_IMAGE_NAME }}
126+
docker_image_format: docker
127+
fail_on_scan_vulnerabilities: ${{ vars.FAIL_ON_SCAN_VULNERABILITIES }}
128+
secrets:
129+
gcp_service_account: ${{ secrets.GCP_SA_GITHUB_RUNNER }}
130+
cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}

‎flake.nix‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@
3131
in
3232
{
3333
devShells.default = import ./shell.nix { inherit pkgs; };
34+
devShells.ci = pkgs.mkShell {
35+
nativeBuildInputs = [
36+
pkgs.zizmor
37+
];
38+
};
3439

3540
# Expose as flake as app
3641
apps = {

0 commit comments

Comments
 (0)