From b2aaa820ecaceca6adfd1997e195e06d2ca25e52 Mon Sep 17 00:00:00 2001 From: edbfi <326875205+edbfi@users.noreply.github.com> Date: Sat, 19 Sep 2026 03:28:53 +0200 Subject: [PATCH] ci(automation): migrate shared checks and PR policy Signed-off-by: edbfi <326875205+edbfi@users.noreply.github.com> --- .github/merge-policy.json | 26 -------------------- .github/workflows/ci.yml | 8 +++---- .github/workflows/merge.yml | 29 ----------------------- .github/workflows/pr-policy.yml | 15 ++++++++++++ CI.md | 42 ++++++++++++++++++++++++++------- renovate.json | 14 ++++++++--- 6 files changed, 64 insertions(+), 70 deletions(-) delete mode 100644 .github/merge-policy.json delete mode 100644 .github/workflows/merge.yml create mode 100644 .github/workflows/pr-policy.yml diff --git a/.github/merge-policy.json b/.github/merge-policy.json deleted file mode 100644 index 7d73299a..00000000 --- a/.github/merge-policy.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "schema": 1, - "enabled": true, - "ci_workflow": "ci.yml", - "required_checks": [ - "guard", - "quality", - "platforms / Build and Test (minimum, linux, amd64)", - "platforms / Build and Test (minimum, linux, arm64)", - "platforms / Build and Test (current, linux, amd64)", - "platforms / Build and Test (current, linux, arm64)", - "platforms / Test macOS (minimum)", - "platforms / Test macOS (current)", - "codeql / Analyze (go)", - "ci / required" - ], - "optional_checks": [], - "check_app_id": 15368, - "renovate": { - "login": "renovate[bot]", - "id": 29139614 - }, - "renovate_comment": "/merge-when-green", - "minimum_approvals": 0, - "deploy_workflows": [] -} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 98d57656..20115312 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 5 steps: - - uses: edbfi/automation/actions/dispatch-guard@v2.0.0 + - uses: edbfi/automation/actions/dispatch-guard@v3.0.1 with: token: ${{ github.token }} pr-number: ${{ inputs.pr-number }} @@ -58,13 +58,13 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 5 steps: - - uses: edbfi/automation/actions/dispatch-guard@v2.0.0 + - uses: edbfi/automation/actions/dispatch-guard@v3.0.1 with: token: ${{ github.token }} pr-number: ${{ inputs.pr-number }} expected-head-sha: ${{ inputs.expected-head-sha }} expected-default-sha: ${{ inputs.expected-default-sha }} - - uses: edbfi/automation/actions/gate@v2.0.0 + - uses: edbfi/automation/actions/gate@v3.0.1 with: needs: ${{ toJSON(needs) }} required: guard quality platforms codeql @@ -84,6 +84,6 @@ jobs: type: string default: '' expected-default-sha: - description: Exact default-branch commit requested after a checked merge + description: Exact current default-branch commit type: string default: '' diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml deleted file mode 100644 index 84d13dfe..00000000 --- a/.github/workflows/merge.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Checked merge -on: - issue_comment: - types: [created] - pull_request_target: - types: [synchronize, reopened, edited, ready_for_review] - workflow_run: - workflows: [ci] - types: [completed] -permissions: {} -concurrency: - group: checked-merge - cancel-in-progress: false -jobs: - merge: - if: github.event_name != 'issue_comment' || github.event.issue.pull_request - runs-on: ubuntu-26.04 - timeout-minutes: 10 - permissions: - contents: write - pull-requests: write - issues: write - actions: write - checks: read - statuses: read - steps: - - uses: edbfi/automation/actions/merge@v2.0.0 - with: - token: ${{ github.token }} diff --git a/.github/workflows/pr-policy.yml b/.github/workflows/pr-policy.yml new file mode 100644 index 00000000..1fc68b24 --- /dev/null +++ b/.github/workflows/pr-policy.yml @@ -0,0 +1,15 @@ +name: PR policy +on: + pull_request: + types: [opened, reopened, synchronize, edited, labeled, unlabeled, ready_for_review, converted_to_draft, review_requested, review_request_removed] + pull_request_review: + types: [submitted, edited, dismissed] +permissions: + contents: read + pull-requests: read +concurrency: + group: pr-policy-${{ github.event.pull_request.number }} + cancel-in-progress: true +jobs: + policy: + uses: edbfi/automation/.github/workflows/pr-policy.yml@v3.0.1 diff --git a/CI.md b/CI.md index 8310351b..39722129 100644 --- a/CI.md +++ b/CI.md @@ -3,9 +3,23 @@ Every pull request and default-branch push runs `ci`: hygiene/quality, Linux amd64 and arm64 builds on Go 1.26.8 and 1.27.1, native macOS builds/race tests on both Go versions, and CodeQL. The shared dispatch guard and fail-closed aggregate require -all expected jobs to succeed. No branch protections or rulesets are configured; Renovate updates merge unattended only after every current-head job in `.github/merge-policy.json` succeeds. -Other changes retain manual review of exact head/base, full diff, author/DCO, every expected job and -relevant artifacts before merging through the maintainer ghmerge function. No path filter may bypass this workflow. +all expected jobs to succeed. No path filter may bypass this workflow. + +Shared actions, workflows and presets use immutable `v3.0.1` references. +Renovate is the sole ongoing dependency merge owner. Direct automerge remains +explicitly disabled, including matching package rules, until the hosted rollout +proves native Renovate operation behind complete required CI. The legacy Actions +merger and its comment commands are retired. + +The separate PR policy workflow verifies Conventional Commit titles, genuine +matching author sign-offs, Renovate provenance, holds, outstanding review requests +and unresolved changes requests. Require its actual emitted policy context alongside +all existing application/content checks, pinned to GitHub Actions, with strict +up-to-date branch protection. Preserve stronger review requirements. Explicit CI +dispatches do not substitute for a missing metadata policy result. Review exact +head/base, full diffs and all required results before a bootstrap merge, then +verify resulting default-branch CI. Repository-specific updater ownership and +manual publication or delivery controls remain unchanged. Go 1.26 is now the minimum: `golang.org/x/crypto` 0.56.0 requires it and fixes the reported SSH deadlocks/source-address validation issues. Its compatible x/text @@ -62,11 +76,7 @@ comes from existing build flags, so the redundant source-writing release branch is removed. Container publication keeps the repository's own GHCR namespace and existing release/manual controls. Platform CI does not start Docker containers, configure VPNs, install games, contact NanoGPT, or exercise a live panel. These -integration gaps and the lint backlog remain documented limitations. The shared -v1.1.0 policy makes all dependency update types eligible, including Go, container -and shared-policy updates, without dashboard approval. The checked merge action -preserves genuine sign-offs and dispatches full CI for the exact merged commit. - +integration gaps and the lint backlog remain documented limitations. Platform checks use stable minimum/current lane names so a Go patch update does not invalidate required-check names or suppress binary artifacts. The minimum lane stays on Go 1.26 patches; the current lane may advance to new Go releases. @@ -85,3 +95,19 @@ Their stored workflows and credentials are preserved for separate validation. The self-update command defaults to upstream Pelican; do not use it to update this fork, because an upstream binary does not contain its network-mode customization. No fork release has been published. + +## Service startup follow-up + +The executable version smoke proves real CLI execution, not daemon readiness. +A required service fixture must run on an isolated Linux runner with a real Docker +daemon and a disposable network; use temporary data/log/archive/backup paths, a +dedicated system user, isolated SFTP/API ports and disabled host log rotation. +Provide a loopback panel fixture implementing boot-server pagination and state +reset, then launch the actual built Wings executable. Require authenticated +`/api/system` JSON and the empty server listing, reject unauthenticated requests, +and prove SFTP readiness. Capture daemon logs and clean up the process group, +network, user and temporary state on failure and cancellation. VPN/container game +execution needs separate bounded fixtures; this migration does not claim it. +The local macOS validation environment does not supply these privileged Linux +prerequisites. Existing CLI, filesystem, SFTP, HTTP, race and CodeQL gates remain +mandatory until this integration fixture is implemented and proven on its runner. diff --git a/renovate.json b/renovate.json index f3209e3a..daae09b7 100644 --- a/renovate.json +++ b/renovate.json @@ -1,8 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>edbfi/automation//default.json#v2.0.0", - "github>edbfi/automation//automerge.json#v2.0.0" + "github>edbfi/automation//default.json#v3.0.1" ], "packageRules": [ { @@ -15,6 +14,12 @@ ], "matchCurrentVersion": "/^1\\.26\\./", "allowedVersions": ">=1.26.0 <1.27.0" + }, + { + "matchPackageNames": [ + "*" + ], + "automerge": false } ], "customManagers": [ @@ -33,5 +38,8 @@ "forkProcessing": "enabled", "postUpdateOptions": [ "gomodTidy" - ] + ], + "automerge": false, + "platformAutomerge": false, + "ignoreTests": false }