feat!: make governance workflows reusable

.github/workflows/conventional-commits.yml

@@ -4,16 +4,17 @@ on:
   pull_request:
     branches: ["main"]
     types: [opened, edited, synchronize, reopened]
+  workflow_call:
 
 permissions:
   pull-requests: read
 
 jobs:
   pr-title:
     name: PR Title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -31,11 +32,12 @@ jobs:
 
   commitlint:
     name: Commit Messages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
         with:
           configFile: .commitlintrc.yml

.github/workflows/issues-add-labels.yaml

@@ -7,9 +7,10 @@ on:
     types:
       - reopened
       - opened
+  workflow_call:
 jobs:
   label_issues:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
     steps:

.github/workflows/issues-add-to-project.yml

@@ -10,15 +10,19 @@ on:
   pull_request:
     types:
       - opened
+  workflow_call:
+    secrets:
+      ADD_TO_PROJECT_PAT:
+        required: true
 
 jobs:
   add-to-project:
     name: Add issue to project
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Authenticates with ADD_TO_PROJECT_PAT, so the workflow GITHUB_TOKEN needs no scopes.
     permissions: {}
     steps:
-      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/opendefensecloud/projects/3
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/osv-scanner.yml

@@ -0,0 +1,49 @@
+name: OSV-Scanner
+
+# Reusable only. The caller's stub carries the triggers (pull_request, push to
+# main, a weekly schedule); its event decides which job runs. See "Governance
+# workflows" in the README.
+#
+# No merge_group: the upstream PR scan diffs against $GITHUB_BASE_REF, which is
+# empty in a merge queue, so it would pass without comparing anything. No repo
+# uses a merge queue; pick a working scan for it when one does.
+
+on:
+  workflow_call:
+    inputs:
+      scan-args:
+        description: Arguments passed to osv-scanner, one per line, e.g. add `--config ./.osv-scanner.toml`.
+        type: string
+        default: |-
+          --include-git-root
+          -r
+          ./
+
+# Least privilege by default. The write permission needed to upload the SARIF
+# report is granted per job, not here -- a top-level write permission is what
+# OpenSSF Scorecard's Token-Permissions check flags.
+permissions:
+  contents: read
+
+jobs:
+  scan-scheduled:
+    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
+    permissions:
+      # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+      actions: read
+      security-events: write
+      contents: read
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
+    with:
+      scan-args: ${{ inputs.scan-args }}
+      runs-on: ubuntu-24.04
+  scan-pr:
+    if: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
+    with:
+      scan-args: ${{ inputs.scan-args }}
+      runs-on: ubuntu-24.04

.github/workflows/release-drafter.yaml

@@ -25,7 +25,7 @@ jobs:
       # write permission is required for autolabeler
       # otherwise, read permission is required at least
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       # (Optional) GitHub Enterprise requires GHE_HOST variable set
       #- name: Set GHE_HOST

.github/workflows/renovate-auto-approve.yml

@@ -47,7 +47,7 @@ concurrency:
 
 jobs:
   auto-approve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >-
       github.event_name == 'pull_request' &&
       github.event.pull_request.user.login == inputs.renovate-actor &&

.github/workflows/renovate-dev-kit-lock.yml

@@ -0,0 +1,96 @@
+name: renovate-dev-kit-lock
+
+# Reusable only. Commits `nix flake lock` to Renovate's dev-kit PR. It relocks
+# only inputs whose flake.nix reference changed, here the bumped dev-kit tag,
+# and is a no-op otherwise, so a re-run after its own commit changes nothing.
+# Renovate bumps the flake input tag with a regex manager, which can't update
+# flake.lock; without this, `nix develop` rewrites the lock in CI and any
+# diff-check fails. See "Governance workflows" in the README for the stub.
+#
+# Commits through the GitHub App's installation token, via the API: GitHub
+# signs the commit (required_signatures), and unlike GITHUB_TOKEN it starts CI
+# on the new head. renovate-config lists the app's bot in gitIgnoredAuthors, so
+# Renovate keeps rebasing the branch; each rebase re-runs this and relocks.
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        description: Renovate's branch for the dev-kit group.
+        type: string
+        default: renovate/dev-kit
+      renovate-actor:
+        description: Login of the Renovate app that authors the pull requests.
+        type: string
+        default: renovate[bot]
+    secrets:
+      DEV_KIT_BOT_APP_CLIENT_ID:
+        required: true
+      DEV_KIT_BOT_APP_PRIVATE_KEY:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  relock:
+    name: Relock dev-kit
+    # Only Renovate's own branch in this repo: fork PRs get no secrets, and a
+    # same-named branch from someone else doesn't get a bot commit.
+    if: >-
+      github.event.pull_request.head.ref == inputs.branch &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login == inputs.renovate-actor
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: renovate-dev-kit-lock-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+      - name: Install nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        with:
+          # Upstream Nix and no telemetry, as in setup-nix.
+          determinate: false
+          diagnostic-endpoint: ''
+      - name: Relock dev-kit
+        id: relock
+        run: |
+          nix flake lock
+          if git diff --quiet -- flake.lock; then
+            echo "flake.lock already matches flake.nix"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        if: steps.relock.outputs.changed == 'true'
+        id: app
+        with:
+          client-id: ${{ secrets.DEV_KIT_BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DEV_KIT_BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+      - name: Commit flake.lock
+        if: steps.relock.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # createCommitOnBranch, not git push: GitHub signs API commits.
+          # expectedHeadOid makes it fail instead of clobbering a newer push;
+          # that push re-runs this workflow anyway.
+          jq -n --arg repo "$REPO" --arg branch "$BRANCH" --arg head "$HEAD_SHA" \
+            --arg lock "$(base64 -w0 flake.lock)" '{
+              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }",
+              variables: { input: {
+                branch: { repositoryNameWithOwner: $repo, branchName: $branch },
+                message: { headline: "chore(deps): relock dev-kit in flake.lock" },
+                expectedHeadOid: $head,
+                fileChanges: { additions: [{ path: "flake.lock", contents: $lock }] }
+              } }
+            }' | gh api graphql --input - --jq '.data.createCommitOnBranch.commit.oid'

.github/workflows/test-actions.yml

@@ -5,11 +5,13 @@ on:
     paths:
       - '.github/actions/**/*.sh'
       - 'scripts/*.sh'
+      - '.github/workflows/update-action-pins.yml'
   push:
     branches: [main]
     paths:
       - '.github/actions/**/*.sh'
       - 'scripts/*.sh'
+      - '.github/workflows/update-action-pins.yml'
 
 permissions:
   contents: read
@@ -31,3 +33,5 @@ jobs:
         run: .github/actions/diff-check/test-verify-clean.sh
       - name: Test extract-go-version.sh
         run: .github/actions/get-go-version/test-extract-go-version.sh
+      - name: Test the update-action-pins check
+        run: scripts/test-update-action-pins.sh

.github/workflows/update-action-pins.yml

@@ -1,31 +1,43 @@
 name: Update Action Pins
 
+# Reusable, and also run on dev-kit's own PRs. Consumers call it from a stub;
+# see "Governance workflows" in the README.
+#
+# No `paths` filter on purpose: a required check gated by paths never reports on
+# PRs outside them, so the merge stays blocked.
+
 permissions:
   contents: read
 
 on:
   pull_request:
-    paths:
-      - ".github/workflows/**"
-      - ".github/actions/**"
+  workflow_call:
 
 jobs:
   check-pins:
     name: Check action pins
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Verify all actions are pinned to a SHA
         run: |
-          unpinned=$(grep -rhE '^\s+(- )?uses: ' .github/ \
-            | grep -vE "^\s+(- )?uses: ['\"]?\./" \
-            | grep -vE '@[0-9a-f]{40}($|\s)' || true)
+          # Scan all of .github/ so composite actions are covered. Strip quotes
+          # before matching so single- and double-quoted values are both handled,
+          # and allow any YAML sequence spacing: `-   uses:` is valid YAML, and a
+          # matcher expecting exactly one space would let an unpinned action
+          # through unseen. Drop trailing comments, or `@main # @<sha>` would
+          # pass on the SHA in the comment.
+          unpinned=$(grep -rhE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/ \
+            | tr -d "\"'" \
+            | sed -E 's/[[:space:]]+#.*$//' \
+            | grep -vE 'uses:[[:space:]]*\./' \
+            | grep -vE '@[0-9a-f]{40}([[:space:]]|$)' || true)
           if [[ -n "$unpinned" ]]; then
             echo "::error::Found unpinned GitHub Actions (must use SHA digest, not tag):"
             echo "$unpinned"
             echo ""
-            echo "Run 'GITHUB_TOKEN=\$(gh auth token) update-action-pins .github/workflows/ .github/actions/' to fix."
+            echo "Run 'GITHUB_TOKEN=\$(gh auth token) update-action-pins .github/' to fix."
             exit 1
           fi