Add build, publish, and scan workflow configuration#64
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #64 +/- ##
========================================
Coverage 97.41% 97.41%
========================================
Files 18 18
Lines 927 927
========================================
Hits 903 903
Misses 24 24 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow that delegates build/publish/scan to a centrally managed reusable workflow, enabling consistent CI behavior across branches and release events.
Changes:
- Introduces a “Build, Publish and Scan (Managed)” workflow triggered on push, pull_request, release, and workflow_dispatch.
- Configures a reusable workflow job with read access to contents and write access to packages.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| push: | ||
| branches: ["main", "master", "develop"] | ||
| pull_request: | ||
| branches: ["main", "master", "develop"] | ||
| release: | ||
| types: [published] | ||
| jobs: | ||
| build-publish-scan: | ||
| uses: BERDataLakehouse/.github/.github/workflows/build_publish_scan.yaml@main | ||
| permissions: | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
This workflow runs on pull_request but grants packages: write. If the called workflow performs publishing, this enables publishing from unmerged PRs (at least for same-repo PRs), which is a security/release-process risk. Consider restricting publish to push/release events (split workflows/jobs or gate with an if:), and keep PR runs to build/scan with read-only permissions.
There was a problem hiding this comment.
We need this for dev work
Uh oh!
There was an error while loading. Please reload this page.