From 581c542a93c85e89cc2ca2b1e60ab7d05f1ce541 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 19:15:25 +0200 Subject: [PATCH 1/4] chore(ci): adopt shared workflows and central Renovate preset - renovate.json -> central preset (apus-maintainers) - security.yml (Trivy + CycloneDX SBOM) --- .github/workflows/security.yml | 55 ++++++++++++++++++++++++++++++++++ renovate.json | 3 +- 2 files changed, 56 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..327c77b --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,55 @@ +name: Security + +# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained +# on purpose: it needs no build tool and no registry credentials, so it is the +# baseline security gate for every repository regardless of language. +on: + pull_request: + push: + branches: [main] + schedule: + - cron: "38 4 * * 1" + workflow_dispatch: +permissions: + contents: read + security-events: write + +jobs: + trivy: + name: Trivy scan + uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1 + with: + scan-type: "fs" + scanners: "vuln,secret" + severity: "CRITICAL,HIGH" + # Report-only for now, so adopting this does not turn CI red on day one. + fail-on-findings: false + upload-sarif: true + secrets: inherit + + sbom: + name: CycloneDX SBOM + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Upload SBOM + uses: actions/upload-artifact@v4 + with: + name: sbom-cyclonedx + path: bom.json + if-no-files-found: error + retention-days: 90 diff --git a/renovate.json b/renovate.json index b9a507f..3ae51cd 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/apus-maintainers)", - "github>OneLiteFeatherNET/renovate:paper" + "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/apus-maintainers)" ] } From 3b191546674d343cb758a19d31b5287a3e2171b6 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:11:48 +0200 Subject: [PATCH 2/4] chore(ci): add release-please, PR linting and release SBOMs - pr-lint.yml - commitlint.config.mjs - SBOM job appended to release-please.yml --- .github/workflows/pr-lint.yml | 17 +++++++++++++++++ .github/workflows/release-please.yml | 28 ++++++++++++++++++++++++++++ commitlint.config.mjs | 3 +++ 3 files changed, 48 insertions(+) create mode 100644 .github/workflows/pr-lint.yml create mode 100644 commitlint.config.mjs diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml new file mode 100644 index 0000000..759b37b --- /dev/null +++ b/.github/workflows/pr-lint.yml @@ -0,0 +1,17 @@ +name: PR Lint + +# Conventional Commits on the PR title and every commit on the branch. +# release-please parses those commit types to decide the version bump and to +# build the changelog - a non-conventional commit silently produces neither. +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 3f5dcca..492e84a 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -400,3 +400,31 @@ jobs: build-task: ":paper-worldpush:build" publish-task: ":paper-worldpush:publish" secrets: inherit + + sbom: + name: Attach SBOM to release + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Generate CycloneDX SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + exit-code: '0' + + - name: Attach SBOM to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" bom.json --clobber diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 0000000..0616fb9 --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ['@commitlint/config-conventional'], +}; From 3c66f42b183649fb3802ca52762dc260edf02512 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:23:24 +0200 Subject: [PATCH 3/4] fix(ci): make the release SBOM job actually run The inline release-please job did not expose its outputs, so the downstream `needs.release-please.outputs.release_created` gate was always empty and the job was skipped on every release without ever failing. --- .github/workflows/release-please.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 492e84a..28a4d8c 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -404,7 +404,9 @@ jobs: sbom: name: Attach SBOM to release needs: release-please - if: needs.release-please.outputs.release_created == 'true' + # This repo funnels the release signal through its own resolve step, and its + # root tag carries the component prefix (include-component-in-tag). + if: ${{ !cancelled() && needs.release-please.outputs.root-released == 'true' }} runs-on: ubuntu-latest permissions: contents: write @@ -412,7 +414,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: - ref: ${{ needs.release-please.outputs.tag_name }} + ref: apus-v${{ needs.release-please.outputs.root-version }} - name: Generate CycloneDX SBOM uses: aquasecurity/trivy-action@v0.36.0 @@ -426,5 +428,5 @@ jobs: - name: Attach SBOM to the release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TAG: ${{ needs.release-please.outputs.tag_name }} + TAG: apus-v${{ needs.release-please.outputs.root-version }} run: gh release upload "$TAG" bom.json --clobber From 0d0b6137c392acdb97735cba9120abe6c067a72b Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 21:11:39 +0200 Subject: [PATCH 4/4] fix(ci): restore Renovate platform presets and anchor the version in build.gradle.kts - renovate flavor restored: paper - extra-files now points at build.gradle.kts --- release-please-config.json | 25 ++++++++++++++++++++----- renovate.json | 3 ++- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/release-please-config.json b/release-please-config.json index 039a753..c037387 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -11,23 +11,38 @@ "package-name": "apus", "changelog-path": "CHANGELOG.md", "extra-files": [ - { "type": "generic", "path": "build.gradle.kts" }, - { "type": "generic", "path": "deploy/charts/apus-operator/Chart.yaml" }, - { "type": "generic", "path": "deploy/charts/apus-platform/Chart.yaml" } + { + "type": "generic", + "path": "build.gradle.kts" + }, + { + "type": "generic", + "path": "deploy/charts/apus-operator/Chart.yaml" + }, + { + "type": "generic", + "path": "deploy/charts/apus-platform/Chart.yaml" + } ] }, "telemetry-addon": { "package-name": "telemetry-addon", "changelog-path": "CHANGELOG.md", "extra-files": [ - { "type": "generic", "path": "build.gradle.kts" } + { + "type": "generic", + "path": "build.gradle.kts" + } ] }, "paper-worldpush": { "package-name": "paper-worldpush", "changelog-path": "CHANGELOG.md", "extra-files": [ - { "type": "generic", "path": "build.gradle.kts" } + { + "type": "generic", + "path": "build.gradle.kts" + } ] } } diff --git a/renovate.json b/renovate.json index 3ae51cd..b9a507f 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,7 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/apus-maintainers)" + "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/apus-maintainers)", + "github>OneLiteFeatherNET/renovate:paper" ] }