Skip to content

fix(release): develop to main #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bedatty merged 23 commits into from
Jul 21, 2026
Merged

fix(release): develop to main #601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
a0729f7
feat(go-pr-analysis): add auto-detected OpenAPI spec drift gate
fredcamaral Jul 10, 2026
829526e
fix(go-pr-analysis): probe only check-api-spec in OpenAPI drift gate
fredcamaral Jul 10, 2026
1b4e380
Merge branch 'develop' into feat/openapi-drift-gate
fredcamaral Jul 13, 2026
ff77d06
Merge branch 'develop' into feat/openapi-drift-gate
fredcamaral Jul 14, 2026
56d643e
Merge branch 'develop' into feat/openapi-drift-gate
fredcamaral Jul 14, 2026
9545c97
Merge branch 'develop' into feat/openapi-drift-gate
fredcamaral Jul 14, 2026
bf932b9
chore(release): backmerge main into develop [skip ci]
lerian-studio Jul 20, 2026
6f98c5b
chore(changelog): backmerge main into develop [skip ci]
lerian-studio Jul 20, 2026
82c5833
fix(release): default enable_dockerhub to true for JS/TS builds
bedatty Jul 20, 2026
bb4d93b
fix(release): default enable_dockerhub to true for JS/TS builds (#595)
bedatty Jul 20, 2026
7eaa7b6
Merge branch 'develop' into feat/openapi-drift-gate
fredcamaral Jul 21, 2026
67dad77
feat(go-pr-analysis): add auto-detected OpenAPI spec drift gate (#570)
fredcamaral Jul 21, 2026
ebdcfb6
fix(build): add jitter and delay cap to cosign retry backoff
bedatty Jul 21, 2026
f10ae9a
fix(build): address CodeRabbit findings on cosign retry PR
bedatty Jul 21, 2026
c611ab9
fix(build): add jitter and delay cap to cosign retry backoff (#598)
bedatty Jul 21, 2026
6a65e6e
feat: standardize runners via vars.RUNNER_LABEL across shared workflows
gandalf-at-lerian Jul 21, 2026
30cffb8
fix(release): fallback runner to ubuntu-latest instead of blacksmith
bedatty Jul 21, 2026
3e4333c
fix(release): rename runner variable to vars.GENERAL_RUNNERS
bedatty Jul 21, 2026
dceccbc
fix(release): restore blacksmith fallback, keep network runners autho…
bedatty Jul 21, 2026
985dc1e
fix(release): avoid shell injection in dry-run runner echo
bedatty Jul 21, 2026
fc099c6
fix(release): padronizar runners via vars.RUNNER_LABEL (shared workfl…
bedatty Jul 21, 2026
66250b1
chore(config): bump Mattraks/delete-workflow-runs to v2.1
bedatty Jul 21, 2026
5b96532
chore(config): bump Mattraks/delete-workflow-runs to v2.1 (#602)
bedatty Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/backmerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ permissions:
jobs:
# ----------------- Expand Rules -----------------
expand:
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Shared runner override violates the reusable-workflow security contract.

The new vars.GENERAL_RUNNERS precedence allows privileged jobs to run on arbitrary labels instead of the required Blacksmith runner. Revert these expressions or add a strict approved-runner allowlist before merging.

  • .github/workflows/backmerge.yml#L48-L48: keep expand on the approved runner.
  • .github/workflows/backmerge.yml#L140-L140: keep sync on the approved runner.
  • .github/workflows/branch-cleanup.yml#L48-L48: keep branch cleanup on the approved runner.
  • .github/workflows/dispatch-helm.yml#L100-L100: keep workflow dispatch on the approved runner.
  • .github/workflows/go-lambda-release.yml#L73-L73: keep AWS release on the approved runner.
  • .github/workflows/release.yml#L113-L113: keep release preparation on the approved runner.
  • .github/workflows/release.yml#L171-L171: keep publishing on the approved runner.
  • .github/workflows/release.yml#L413-L413: keep aggregation on the approved runner.
  • .github/workflows/release.yml#L474-L474: keep changelog generation on the approved runner.
  • .github/workflows/release.yml#L504-L504: keep major-tag updates on the approved runner.
  • .github/workflows/release.yml#L540-L540: keep latest-release enforcement on the approved runner.
  • .github/workflows/s3-upload.yml#L127-L127: keep S3 uploads on the approved runner.

As per path instructions, all jobs in reusable workflows must use blacksmith-4vcpu-ubuntu-2404.

📍 Affects 6 files
  • .github/workflows/backmerge.yml#L48-L48 (this comment)
  • .github/workflows/backmerge.yml#L140-L140
  • .github/workflows/branch-cleanup.yml#L48-L48
  • .github/workflows/dispatch-helm.yml#L100-L100
  • .github/workflows/go-lambda-release.yml#L73-L73
  • .github/workflows/release.yml#L113-L113
  • .github/workflows/release.yml#L171-L171
  • .github/workflows/release.yml#L413-L413
  • .github/workflows/release.yml#L474-L474
  • .github/workflows/release.yml#L504-L504
  • .github/workflows/release.yml#L540-L540
  • .github/workflows/s3-upload.yml#L127-L127
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/backmerge.yml at line 48, Replace the shared
vars.GENERAL_RUNNERS override with the approved blacksmith-4vcpu-ubuntu-2404
runner for every affected job: expand and sync in
.github/workflows/backmerge.yml (48, 140), branch cleanup in
.github/workflows/branch-cleanup.yml (48), workflow dispatch in
.github/workflows/dispatch-helm.yml (100), AWS release in
.github/workflows/go-lambda-release.yml (73), release preparation, publishing,
aggregation, changelog generation, major-tag updates, and latest-release
enforcement in .github/workflows/release.yml (113, 171, 413, 474, 504, 540), and
S3 uploads in .github/workflows/s3-upload.yml (127).

Source: Path instructions

outputs:
matrix: ${{ steps.expand.outputs.matrix }}
has_pairs: ${{ steps.expand.outputs.has_pairs }}
Expand Down Expand Up @@ -137,7 +137,7 @@ jobs:
sync:
needs: expand
if: needs.expand.outputs.has_pairs == 'true'
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.expand.outputs.matrix) }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/branch-cleanup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ permissions:
jobs:
cleanup:
name: Clean up branches
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}
steps:
- name: Run branch cleanup
uses: LerianStudio/github-actions-shared-workflows/src/config/branch-cleanup@v1
Expand Down
15 changes: 10 additions & 5 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,13 +156,17 @@ on:
type: boolean
default: true
cosign_max_attempts:
description: 'Maximum cosign signing attempts per image reference. Increase to absorb transient OIDC/Fulcio rate limits.'
description: 'Maximum cosign signing attempts per image reference. Increase to absorb transient OIDC/Fulcio/Rekor rate limits.'
type: string
default: '3'
default: '5'
cosign_initial_delay:
description: 'Initial delay (seconds) between cosign retries. Grows exponentially (×3) after each failed attempt.'
description: 'Initial delay (seconds) between cosign retries. Grows exponentially (×3) after each failed attempt, capped at cosign_max_delay, then randomized (equal jitter).'
type: string
default: '5'
cosign_max_delay:
description: 'Maximum delay (seconds) between cosign retries. Caps the exponential backoff before jitter is applied.'
type: string
default: '60'
continue_gitops_on_signing_failure:
description: 'When true, continue to GitOps artifact upload even if cosign signing fails after all retries. Image stays in registry unsigned and a warning is emitted; manual signing is required afterwards.'
type: boolean
Expand All @@ -182,7 +186,7 @@ permissions:

jobs:
prepare:
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
has_builds: ${{ steps.set-matrix.outputs.has_builds }}
Expand Down Expand Up @@ -273,7 +277,7 @@ jobs:
build:
needs: prepare
if: needs.prepare.outputs.has_builds == 'true'
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
name: Build ${{ matrix.app.name }}
permissions:
contents: read
Expand Down Expand Up @@ -504,6 +508,7 @@ jobs:
image-refs: ${{ steps.cosign-refs.outputs.refs }}
max-attempts: ${{ inputs.cosign_max_attempts }}
initial-delay: ${{ inputs.cosign_initial_delay }}
max-delay: ${{ inputs.cosign_max_delay }}

- name: Report cosign signing status
if: inputs.enable_cosign_sign && steps.preflight.outputs.should_build != 'false' && steps.cosign-sign.outcome == 'failure'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dispatch-helm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ on:
jobs:
prepare-and-dispatch:
name: Prepare and Dispatch
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
Expand Down
30 changes: 15 additions & 15 deletions .github/workflows/frontend-pr-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,7 @@ jobs:
# ============================================
detect-changes:
name: Detect Changes
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
outputs:
matrix: ${{ steps.changed-paths.outputs.matrix }}
has_changes: ${{ steps.changed-paths.outputs.has_changes }}
Expand All @@ -220,7 +220,7 @@ jobs:
name: Lint (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_lint
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -273,7 +273,7 @@ jobs:
name: Type Check (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_typecheck
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -319,7 +319,7 @@ jobs:
name: Security (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_security
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -373,7 +373,7 @@ jobs:
name: Tests (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_tests
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -449,7 +449,7 @@ jobs:
name: Coverage (${{ matrix.app.name }})
needs: [detect-changes, tests]
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_coverage
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -585,7 +585,7 @@ jobs:
name: Build (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_build
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -638,7 +638,7 @@ jobs:
name: i18n Check (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_i18n_check
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -720,7 +720,7 @@ jobs:
name: Accessibility (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_accessibility
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -774,7 +774,7 @@ jobs:
name: Custom Checks (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_custom_checks
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -853,7 +853,7 @@ jobs:
name: Bundle Budget (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_bundle_budget
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -907,7 +907,7 @@ jobs:
name: Performance Budget (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_performance_budget
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -972,7 +972,7 @@ jobs:
name: Visual Regression (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_visual_regression
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -1048,7 +1048,7 @@ jobs:
name: Docker Smoke Test (${{ matrix.app.name }})
needs: detect-changes
if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_docker_smoke
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -1195,7 +1195,7 @@ jobs:
name: No Frontend Changes
needs: detect-changes
if: needs.detect-changes.outputs.has_changes != 'true'
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
steps:
- name: Skip
run: |
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/go-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ jobs:

coverage-report:
name: Coverage Report
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
needs: test
if: inputs.enable_coverage_comment && github.event_name == 'pull_request'
permissions:
Expand All @@ -133,7 +133,7 @@ jobs:

lint:
name: Lint
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}

steps:
- name: Checkout code
Expand All @@ -153,7 +153,7 @@ jobs:

build:
name: Build Binary
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
needs: [test, lint]
if: inputs.enable_cross_platform_build

Expand Down Expand Up @@ -203,7 +203,7 @@ jobs:

verify-module:
name: Verify Module
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
if: inputs.check_module_tidy

steps:
Expand All @@ -223,7 +223,7 @@ jobs:

check-format:
name: Check Formatting
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}

steps:
- name: Checkout code
Expand All @@ -248,7 +248,7 @@ jobs:

check-docs:
name: Check Documentation
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
if: inputs.check_docs

steps:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/go-fuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ permissions:
jobs:
fuzz:
name: Fuzz Tests
runs-on: ${{ inputs.runner_type }}
runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
timeout-minutes: ${{ inputs.timeout_minutes }}

steps:
Expand All @@ -86,9 +86,11 @@ jobs:

- name: Dry run summary
if: ${{ inputs.dry_run }}
env:
RESOLVED_RUNNER: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
run: |
echo "::notice::DRY RUN — no fuzz tests will be executed"
echo " runner : ${{ inputs.runner_type }}"
echo " runner : $RESOLVED_RUNNER"
echo " go_version : ${{ inputs.go_version }}"
echo " fuzz_command: ${{ inputs.fuzz_command }}"
echo " artifacts : ${{ inputs.fuzz_artifacts_path }}"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/go-lambda-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ permissions:

jobs:
release:
runs-on: blacksmith-4vcpu-ubuntu-2404
runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}
permissions:
id-token: write # AWS OIDC to assume the upload role
contents: read
Expand Down
Loading