-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Consolidate CI workflows into a single entry point #836
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,37 @@ | ||||||||||||
| # Orchestrates all CI workflows - runs on PRs, pushes to main, and manual dispatch | ||||||||||||
| # Individual test workflows are called as reusable workflows | ||||||||||||
| name: CI All | ||||||||||||
|
|
||||||||||||
| on: | ||||||||||||
| push: | ||||||||||||
| branches: | ||||||||||||
| - main | ||||||||||||
| pull_request: | ||||||||||||
| workflow_dispatch: | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SECURITY: Missing explicit permission declarations. When no permissions are declared, workflows get default read-all permissions for GITHUB_TOKEN. Recommendation: Add explicit minimal permissions:
Suggested change
This follows the principle of least privilege and ensures called workflows don't have more permissions than necessary. |
||||||||||||
|
|
||||||||||||
| permissions: | ||||||||||||
| contents: read | ||||||||||||
|
|
||||||||||||
| jobs: | ||||||||||||
| ci: | ||||||||||||
| uses: ./.github/workflows/ci.yml | ||||||||||||
|
|
||||||||||||
| test-base-action: | ||||||||||||
| uses: ./.github/workflows/test-base-action.yml | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding a brief comment explaining why
Suggested change
This clarifies the security implications and dependencies. |
||||||||||||
| secrets: inherit # Required for ANTHROPIC_API_KEY | ||||||||||||
|
|
||||||||||||
| test-custom-executables: | ||||||||||||
| uses: ./.github/workflows/test-custom-executables.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-mcp-servers: | ||||||||||||
| uses: ./.github/workflows/test-mcp-servers.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-settings: | ||||||||||||
| uses: ./.github/workflows/test-settings.yml | ||||||||||||
| secrets: inherit | ||||||||||||
|
|
||||||||||||
| test-structured-output: | ||||||||||||
| uses: ./.github/workflows/test-structured-output.yml | ||||||||||||
| secrets: inherit | ||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,8 @@ | ||
| name: CI | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| test: | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider adding a brief header comment explaining the orchestrator role:
This helps future maintainers understand the purpose of this workflow at a glance.