Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/workflows/ci-all.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# Orchestrates all CI workflows - runs on PRs, pushes to main, and manual dispatch
# Individual test workflows are called as reusable workflows
name: CI All
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a brief header comment explaining the orchestrator role:

Suggested change
name: CI All
# Orchestrates all CI workflows - runs on PRs, pushes to main, and manual dispatch
# Individual test workflows are called as reusable workflows
name: CI All

This helps future maintainers understand the purpose of this workflow at a glance.


on:
push:
branches:
- main
pull_request:
workflow_dispatch:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SECURITY: Missing explicit permission declarations. When no permissions are declared, workflows get default read-all permissions for GITHUB_TOKEN.

Recommendation: Add explicit minimal permissions:

Suggested change
workflow_dispatch:
workflow_dispatch:
permissions:
contents: read

This follows the principle of least privilege and ensures called workflows don't have more permissions than necessary.


permissions:
contents: read

jobs:
ci:
uses: ./.github/workflows/ci.yml

test-base-action:
uses: ./.github/workflows/test-base-action.yml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a brief comment explaining why secrets: inherit is necessary:

Suggested change
uses: ./.github/workflows/test-base-action.yml
test-base-action:
uses: ./.github/workflows/test-base-action.yml
secrets: inherit # Required for ANTHROPIC_API_KEY

This clarifies the security implications and dependencies.

secrets: inherit # Required for ANTHROPIC_API_KEY

test-custom-executables:
uses: ./.github/workflows/test-custom-executables.yml
secrets: inherit

test-mcp-servers:
uses: ./.github/workflows/test-mcp-servers.yml
secrets: inherit

test-settings:
uses: ./.github/workflows/test-settings.yml
secrets: inherit

test-structured-output:
uses: ./.github/workflows/test-structured-output.yml
secrets: inherit
3 changes: 1 addition & 2 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
name: CI

on:
push:
branches: [main]
pull_request:
workflow_call:

jobs:
test:
Expand Down
16 changes: 15 additions & 1 deletion .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,23 @@ on:
required: false
type: boolean
default: false
workflow_run:
workflows: ["CI All"]
types:
- completed
branches:
- main

jobs:
create-release:
runs-on: ubuntu-latest
# Run if: manual dispatch OR (CI All succeeded AND commit is a version bump)
if: |
github.event_name == 'workflow_dispatch' ||
(github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.head_branch == 'main' &&
github.event.workflow_run.event == 'push' &&
startsWith(github.event.workflow_run.head_commit.message, 'chore: bump Claude Code to'))
environment: production
permissions:
contents: write
Expand Down Expand Up @@ -84,7 +97,8 @@ jobs:

update-major-tag:
needs: create-release
if: ${{ !inputs.dry_run }}
# Skip for dry runs (workflow_run events are never dry runs)
if: github.event_name == 'workflow_run' || !inputs.dry_run
runs-on: ubuntu-latest
environment: production
permissions:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/test-base-action.yml
Original file line number Diff line number Diff line change
@@ -1,16 +1,14 @@
name: Test Claude Code Action

on:
push:
branches:
- main
pull_request:
workflow_dispatch:
inputs:
test_prompt:
description: "Test prompt for Claude"
required: false
default: "List the files in the current directory starting with 'package'"
workflow_call:

jobs:
test-inline-prompt:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/test-custom-executables.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
name: Test Custom Executables

on:
push:
branches:
- main
pull_request:
workflow_dispatch:
workflow_call:

jobs:
test-custom-executables:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/test-mcp-servers.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
name: Test MCP Servers

on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
workflow_call:

jobs:
test-mcp-integration:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/test-settings.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
name: Test Settings Feature

on:
push:
branches:
- main
pull_request:
workflow_dispatch:
workflow_call:

jobs:
test-settings-inline-allow:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/test-structured-output.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
name: Test Structured Outputs

on:
push:
branches:
- main
pull_request:
workflow_dispatch:
workflow_call:

permissions:
contents: read
Expand Down
Loading