Repository navigation
feat: add additional fields that are passed on to mkShell to support … - #18
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesmkShell Parameter Enhancement
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
olzemal
approved these changes
Jun 10, 2026
3 of 4 tasks
dermorz
added a commit
that referenced
this pull request
Oct 6, 2026
## What Make the governance workflows reusable, so consumer repos call them from a small stub instead of carrying copies that drift. Closes #38. `scorecard` stays a standalone workflow per repo (decided in #37). ## Why Each consumer carries its own copy of `update-action-pins`, `conventional-commits`, `osv-scanner` and the issue automations. The copies have drifted — `update-action-pins` alone exists in three variants, and dev-kit's own misses `- uses:` spacing and is gated by a `paths` filter, which leaves a required check pending forever on PRs outside those paths. ## Testing - New `scripts/test-update-action-pins.sh` runs the real check extracted from the workflow (via `yq`) against 12 cases: quoted refs, sequence spacing, composite actions, reusable workflows, short SHAs. All pass; the old matcher fails 2 of them. Wired into `test-actions.yml`. - `actionlint` clean on all workflows and on the five README stubs (with a dummy SHA). - `renovate-dev-kit-lock`: the relock step ran on a Solar checkout with the flake input bumped to v2.2.0 (`nix flake lock` relocks only `dev-kit`; a second run commits nothing, so no loop), and the `createCommitOnBranch` payload round-trips `flake.lock`. **Not run end to end**: it needs the org's dev-kit GitHub App (Monday). - Not yet called from another repo — the Solar pilot (opendefensecloud/solution-arsenal#825) is the first real run. ## Notes for reviewers - **One stub per workflow**, not grouped by trigger: a workflow has a single `on:` block and `osv-scanner` runs on PR, push and a schedule, so shared stubs would need `if:` guards and a union of permissions. A single `org-checks.yml` was wanted to get one Renovate PR per dev-kit release instead of one per stub; opendefensecloud/renovate-config#20's `dev-kit` group now delivers that whatever the stub count. - dev-kit runs the workflows on its own events from the same files (`workflow_call` next to the regular triggers). `osv-scanner.yml` is reusable only; dev-kit didn't scan itself before either. - Pins bumped to what consumers already use (semantic-PR v6, checkout v7, add-to-project v2), so switching to the stub doesn't downgrade them. - **Breaking:** `make repo-settings` no longer installs `update-action-pins.yml` — it would recreate the copy the stub replaces. Upgrade path: the stubs in the README's "Governance workflows" section. - **Check names change** to `<stub job> / <called job>`, e.g. `update-action-pins / Check action pins`, `osv-scanner / scan-pr / osv-scan`. Consumers must update `REPO_STATUS_CHECKS` and rerun `make repo-settings` in the same change. - Overlaps with #33 in `test-actions.yml` and `common.mk`; whichever merges second may need a small rebase. - **New: `renovate-dev-kit-lock.yml`.** Renovate's grouped dev-kit PR (opendefensecloud/renovate-config#17/#18) bumps the flake input tag but can't update `flake.lock`, so `nix develop` rewrites it in CI and `diff-check` fails. This workflow commits `nix flake lock` to `renovate/dev-kit` via a GitHub App token and `createCommitOnBranch`: signed by GitHub (`required_signatures`), and it starts CI, which a `GITHUB_TOKEN` push wouldn't. Needs, before merge: - an org GitHub App (Contents: write, Pull requests: read) — done: `dev-kit-bot`, installed on dev-kit and solution-arsenal for now; extended to the other consumers once it proves itself in the pilot - org secrets `DEV_KIT_BOT_APP_CLIENT_ID` and `DEV_KIT_BOT_APP_PRIVATE_KEY` — done, shared with the same two repos - the app's bot email in renovate-config's `gitIgnoredAuthors` — in renovate-config#20 ## Merge order This PR is one step in a sequence; the relock workflow and renovate-config#20's manual `flake.lock` note only look contradictory without it: 1. **opendefensecloud/renovate-config#20** — dev-kit group, weekly lock refresh; the dev-kit PR asks a human for the `flake.lock` commit (interim). 2. ~~#34~~ (merged; this PR is rebased onto it and formatted with its treefmt setup), then **this PR** and **#39** → release **v3.0.0**. The relock workflow ships here, but no consumer calls it yet. 3. **Org GitHub App** (done: `dev-kit-bot`; its bot is in `gitIgnoredAuthors` via renovate-config#20). **opendefensecloud/renovate-config#19** then drops the manual steps. 4. **Rollout** (pilot opendefensecloud/solution-arsenal#825): a consumer adds the relock stub only after renovate-config#20 is merged; before that, the bot commit would make Renovate stop rebasing the branch. ## Not covered here - dev-kit's own pins: no `renovate.json` yet, and dev-kit doesn't call `renovate-auto-approve` itself — that's #40. - dev-kit doesn't scan itself: `osv-scanner.yml` is reusable-only, and dev-kit had no scan before either. No issue yet. ## Checklist - [x] Tests added/updated - [x] No breaking changes (or upgrade path documented above) - [x] Readable commit history (squashed and cleaned up as desired) - [ ] AI code review considered and comments resolved <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Automation** * Governance, commit-check, issue-labeling, project-assignment, and security-scanning workflows can be reused across repositories. * Security scans run on pushes, pull requests, and scheduled events; merge-queue events are no longer included. * Action pin checks cover additional workflow and action reference formats, with automated tests for supported cases. * Renovate pull requests can automatically update the development kit lockfile when needed. * **Documentation** * Added guidance on reusable workflows, permissions, triggers, requirements, and required status checks. * Updated the documented status check for action pin validation. * **Configuration** * Repository setup no longer installs the action pin update workflow. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…env among others
What
Additional fields that are inherited by mkShell.
Why
Required for UI prototype of solar.
Testing
Notes for reviewers
Checklist
Summary by CodeRabbit