From bc93aeb5f7c9ee6b2a637842582fcf22ba925d35 Mon Sep 17 00:00:00 2001 From: Noah Schatz Date: Sat, 7 Nov 2026 20:37:07 -0500 Subject: [PATCH] ci: call the shared workflows at one published reference and check PR titles CodeQL and Scorecard now call cosyte/.github at workflows-2026-11-07-498c7c13c886, the reference every Cosyte repository moves to together (EN2, ST37). A new pr-title.yml caller checks that each pull request title follows Conventional Commits, since a squash merge makes the title the commit on main (ST24). Dependabot writes its commit messages with the chore prefix and the dependency scope, so its titles pass the same check, and it never proposes reviewdog/action-actionlint, which from v1.75.0 installs actionlint from a fork with curl piped to bash (EN5). CLAUDE.md names the new caller and the reference. --- .github/dependabot.yml | 9 +++++++-- .github/workflows/codeql.yml | 6 +++--- .github/workflows/pr-title.yml | 24 ++++++++++++++++++++++++ .github/workflows/scorecard.yml | 4 ++-- CLAUDE.md | 3 ++- 5 files changed, 38 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/pr-title.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 21e7b92..d8018fa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -25,7 +25,7 @@ updates: starters: patterns: ["*"] commit-message: - prefix: build + prefix: chore include: scope # Keep the workflows' actions current, one grouped pull request a week. @@ -39,6 +39,11 @@ updates: groups: actions: patterns: ["*"] + # From v1.75.0 reviewdog/action-actionlint installs actionlint from a fork with `curl | bash`. + # actionlint.yml runs rhysd/actionlint's own release, checked by SHA-256, so this action is + # never proposed here. + ignore: + - dependency-name: "reviewdog/action-actionlint" commit-message: - prefix: ci + prefix: chore include: scope diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6664710..3d3214f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,7 +1,7 @@ name: CodeQL -# Static analysis through the shared CodeQL workflow, called the way the libraries call it, at one -# published reference pinned by its commit SHA. Two languages: `javascript-typescript` for the +# Static analysis through the shared CodeQL workflow, called the way the libraries call it, at the +# published reference every Cosyte repository uses. Two languages: `javascript-typescript` for the # starters, and `actions` for the workflows under .github/workflows/, which run with this # repository's token. @@ -27,6 +27,6 @@ jobs: security-events: write # upload the SARIF to the Security tab contents: read actions: read - uses: cosyte/.github/.github/workflows/codeql.yml@6d0a8217760a8cf45f147376384962f031d92482 # workflows-2026-11-07-6d0a8217760a + uses: cosyte/.github/.github/workflows/codeql.yml@workflows-2026-11-07-498c7c13c886 with: languages: '["actions", "javascript-typescript"]' diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml new file mode 100644 index 0000000..388accc --- /dev/null +++ b/.github/workflows/pr-title.yml @@ -0,0 +1,24 @@ +name: PR title + +# The pull request title must follow Conventional Commits: squash-merged, it is the commit that lands +# on main. The rule lives in the shared workflow, called at the published reference every Cosyte +# repository uses. Its one context is `pr-title / conventional-commits`. + +on: + pull_request: + branches: [main] + # `edited` is load-bearing: a title changed after the last push is the title that lands. + types: [opened, synchronize, reopened, edited] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + pr-title: + permissions: + contents: read + uses: cosyte/.github/.github/workflows/pr-title.yml@workflows-2026-11-07-498c7c13c886 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f066c8b..62497e5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,7 +1,7 @@ name: Scorecard # OpenSSF Scorecard supply-chain analysis through the shared workflow, called the way the libraries -# call it, at one published reference pinned by its commit SHA. It runs on main only: publishing the +# call it, at the published reference every Cosyte repository uses. It runs on main only: publishing the # results needs the default branch. on: @@ -20,4 +20,4 @@ jobs: contents: read # required to resolve the reusable workflow (else contents:none and a startup failure) security-events: write # upload the SARIF to the Security tab id-token: write # publish results to the OpenSSF API (for the badge) - uses: cosyte/.github/.github/workflows/scorecard.yml@6d0a8217760a8cf45f147376384962f031d92482 # workflows-2026-11-07-6d0a8217760a + uses: cosyte/.github/.github/workflows/scorecard.yml@workflows-2026-11-07-498c7c13c886 diff --git a/CLAUDE.md b/CLAUDE.md index ea1906c..2d8fbb4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -13,7 +13,8 @@ since a squash merge makes them the commit on `main`, and editing the title or b Steps 2 and 3 are `starters.yml`: every starter on Node 22 and 24, and `All starters` is the one check that stands for the whole matrix, so a new starter folder is tested with no workflow edit. `starters.yml` also runs nightly on `main`, from the lockfiles. Step 4 is `actionlint.yml`; -`codeql.yml` and `scorecard.yml` call the shared workflows. A new starter also adds its folder to +`codeql.yml`, `scorecard.yml`, and `pr-title.yml` (the PR title in Conventional Commits) call the +shared workflows at one published `workflows-*` reference. A new starter also adds its folder to `.github/dependabot.yml`. ## Hazard: a starter gets copied into production