From 3584a1f25dce294e661adef8261ae2165736f5e4 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Wed, 16 Sep 2026 11:58:59 -0600 Subject: [PATCH 1/4] wip: spotfix Signed-off-by: Sean Tronsen --- README.md | 2 +- packaging/rpm-quadlet/openchami-haproxy-quadlet.spec | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index f13a30a..ccbba78 100644 --- a/README.md +++ b/README.md @@ -19,4 +19,4 @@ sudo systemctl start haproxy.service Edit `/etc/openchami/configs/haproxy.cfg` to change routing. For Podman or systemd changes, add a drop-in under `/etc/containers/systemd/haproxy.container.d/` rather than editing the packaged one, then run `systemctl daemon-reload`. -TLS certificates are read from the `haproxy-certs` volume, which `openchami-acme-quadlets` populates; supply your own there if you are not using ACME. +TLS certificates are read from the `haproxy-certs` volume, which `openchami-acme-quadlet` populates; supply your own there if you are not using ACME. diff --git a/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec b/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec index 30af8fc..13257bd 100644 --- a/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec +++ b/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec @@ -22,9 +22,9 @@ Requires(post,preun,postun): systemd # systemd-style *.container.d drop-in directories Requires: podman >= 5.0.0 -# NOTE: openchami-acme-quadlets populates the haproxy-certs volume that +# NOTE: openchami-acme-quadlet populates the haproxy-certs volume that # terminates TLS, but a site may install its own certificates there instead. -Suggests: openchami-acme-quadlets >= 0.0.1 +Suggests: openchami-acme-quadlet >= 0.0.1 Suggests: boot-service-quadlet >= 0.3.2 Suggests: metadata-service-quadlet >= 0.2.2 Suggests: smd-quadlet >= 2.20.5 From 1ea00057497ccf65cd5cd5f4b9c316e519aa0096 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Wed, 16 Sep 2026 12:35:49 -0600 Subject: [PATCH 2/4] fix: add missing workflows and bump versions Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 6 +++--- .github/workflows/cleanup.yml | 2 +- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 13 +++++++++++++ .github/workflows/scorecard.yml | 21 +++++++++++++++++++++ 5 files changed, 42 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/reuse.yml create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a375e8a..e084f7a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -28,14 +28,14 @@ jobs: rpmbuild: needs: [config] - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} rpmsign: needs: [config, rpmbuild] - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} @@ -44,7 +44,7 @@ jobs: rpmvalidate: needs: [config, rpmsign] - uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.11 secrets: inherit with: artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }} diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index 34188ef..081a4bf 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -9,6 +9,6 @@ on: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.11 permissions: packages: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4465799..bfb2b62 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,14 +32,14 @@ jobs: rpmbuild: needs: [config] - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} rpmsign: needs: [config, rpmbuild] - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} @@ -48,7 +48,7 @@ jobs: release: needs: [config, rpmsign] - uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.11 secrets: inherit with: artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }} @@ -57,5 +57,5 @@ jobs: publish: needs: release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.9 + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.11 secrets: inherit diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml new file mode 100644 index 0000000..088cf74 --- /dev/null +++ b/.github/workflows/reuse.yml @@ -0,0 +1,13 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# +# SPDX-License-Identifier: MIT + +name: REUSE +on: + pull_request: + push: + branches: [main] + +jobs: + reuse: + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@v3.11 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..9008c88 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,21 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# +# SPDX-License-Identifier: MIT + +name: Scorecard +on: + branch_protection_rule: + pull_request: + push: + branches: [main] + schedule: + - cron: '39 5 * * 1' + +permissions: + contents: read + security-events: write + id-token: write + +jobs: + scorecard: + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@v3.11 From 6318c21ff04ab6036bac2f26ce783fc6414c5209 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Thu, 17 Sep 2026 10:19:51 -0600 Subject: [PATCH 3/4] chore: update workflows to v3.11 Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 6 +++--- .github/workflows/cleanup.yml | 2 +- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e084f7a..fcb8759 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -28,14 +28,14 @@ jobs: rpmbuild: needs: [config] - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} rpmsign: needs: [config, rpmbuild] - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} @@ -44,7 +44,7 @@ jobs: rpmvalidate: needs: [config, rpmsign] - uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }} diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index 081a4bf..d8b7f82 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -9,6 +9,6 @@ on: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 permissions: packages: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bfb2b62..b73fc4f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,14 +32,14 @@ jobs: rpmbuild: needs: [config] - uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} rpmsign: needs: [config, rpmbuild] - uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }} @@ -48,7 +48,7 @@ jobs: release: needs: [config, rpmsign] - uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit with: artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }} @@ -57,5 +57,5 @@ jobs: publish: needs: release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 secrets: inherit diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 088cf74..2846a63 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -10,4 +10,4 @@ on: jobs: reuse: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9008c88..084cd04 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,4 +18,4 @@ permissions: jobs: scorecard: - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@v3.11 + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 From f7577a8da249479c8cfb56812eae03c98ab16e0a Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Thu, 17 Sep 2026 10:20:45 -0600 Subject: [PATCH 4/4] chore: hoist permissions to workflow level Signed-off-by: Sean Tronsen --- .github/workflows/cleanup.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index d8b7f82..ac5e75e 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -7,8 +7,9 @@ on: pull_request: types: [closed] +permissions: + packages: write + jobs: cleanup: uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11 - permissions: - packages: write