fix(ci): three CI workflow optimizations

[shubham-sumo]

What and why

Five independent CI issues found while working on the nodejs v2.1.0 release.

---

1. release-tag.yml cannot push to main (run)

Branch-protection rules apply to the default GITHUB_TOKEN, so it cannot push directly to main. The release-tag.yml workflow pushes a changelog commit and a release tag after a prepare PR merges. Both pushes fail with a 403.

Fix: add a Generate GitHub App token step that uses actions/create-github-app-token@v3 with the RenovateBot-SumoLogic GitHub App. The org already uses this App through the RENOVATE_APP_ID and RENOVATE_PRIVATE_KEY secrets. The App has the necessary bypass permission on main.

Note: RENOVATE_APP_ID and RENOVATE_PRIVATE_KEY must exist as repository or org secrets here. They are already present in sumologic-kubernetes-collection.

---

2. markdown-link-check fails on docs PRs because of unreleased tag links (run)

CHANGELOG.md contains a link to the next release tag, for example releases/tag/nodejs-v2.1.0, before that tag exists. The link checker makes a live HTTP request, gets a 404, and fails the PR.

Fix: ignore releases/tag/ URLs in .markdown_link_check.json. Release tags do not change after creation, so a live check gives no value. If the tag name is wrong, release-tag.yml fails to push and shows the error.

---

3. Lint jobs start a runner to do nothing

pull-request-checks.yml put the "did the docs change?" test in a step-level if. The job still requested a runner, checked out the repo, and installed tooling before it decided to do nothing. yamllint also read a chart-changed output that does not exist, a typo for docs-changed, so it never linted anything.

Fix: move the guard from step level to job level on markdownlint, yamllint, md-links-lint, and markdown-table-formatter-check. Correct the docs-changed reference. A guarded job now claims no runner at all.

---

4. Required status checks never report on some PRs

Branch protection matches checks by name, and the two ways to skip work do not behave the same:

How the work is skipped	What branch protection sees
Job-level if is false	A check run with a skipped conclusion. Accepted.
on.pull_request.paths does not match	No check run at all. Waits forever.

The three pr-build-* workflows used paths filters that exclude **/*.md. On a docs-only PR all three workflows skip, so these six required contexts never report and the merge stays blocked:

build-artifacts / Build and upload artifacts (amd64)
build-artifacts / Build and upload artifacts (arm64)
create-dev-lambda-layer / Create Dev Lambda Layer (amd64, eu-central-1)
create-dev-lambda-layer / Create Dev Lambda Layer (arm64, eu-central-1)
run-tests / Run tests (amd64, eu-central-1)
run-tests / Run tests (arm64, eu-central-1)

A job-level if cannot replace the paths filter on these jobs, because each one calls a reusable workflow. When the call is skipped, the nested check names never exist. A required check name must therefore be a plain job in a workflow that always runs.

Fix: each pr-build-* workflow now runs on every PR. A changes job does the file test, the three build jobs read its output, and a plain aggregator job reports the result. pull-request-checks.yml gets the same aggregator.

---

5. Artifact names hold a slash, so every PR build fails at once

ARTIFACT_NAME: ${{ github.head_ref }} puts the branch name into the artifact name. actions/upload-artifact@v4 rejects a name that contains a forward slash, so a branch such as fix/ci-optimizations fails the build before it compiles any code:

The artifact name is not valid: fix/ci-optimizations-python-amd64-artifacts.
Contains the following character:  Forward slash /

This fault is older than this branch. It also appeared on the run before these commits.

Fix: use ${{ github.run_id }}-${{ github.run_attempt }}, which is always plain digits. The attempt number gives each re-run a new namespace, because an artifact name cannot be reused. ARTIFACT_NAME only names and finds artifacts, so layer names and bucket names do not change. The release workflows keep github.ref_name, because a tag name has no slash.

Note: PR #72 makes the same fix with the same value, on purpose. The two branches agree on these lines.

---

Action needed after merge

The change adds new check names. It does not remove the old ones. Nothing improves until an admin replaces the required-contexts list on main with these four names:

pr-checks-complete
pr-build-java-complete
pr-build-nodejs-complete
pr-build-python-complete

---

Follow-ups, out of scope here

• The changes job matches .github/workflows/*-<lang>.yml. This glob also matches release-build-<lang>.yml, so an edit to a release workflow starts a full PR build. The patterns are unchanged from before to keep this diff small.
• tj-actions/changed-files@v44 is a moving tag. An attacker retargeted that tag in March 2025 to steal secrets. A commit SHA pin removes the risk.

---

Checklist

• Confirm RENOVATE_APP_ID and RENOVATE_PRIVATE_KEY secrets exist in this repository
• Confirm RenovateBot-SumoLogic is a bypass actor in the main branch-protection rule
• Replace the required status checks on main with the four names above

— written by an agent on behalf of Shubham Gupta

[Copilot]

🟡 Changes recommended

Newly added workflows introduce additional uses of an unpinned third-party action tag (tj-actions/changed-files@v44), which should be pinned to an immutable commit SHA to reduce supply-chain risk.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates GitHub Actions workflows and CI tooling configs to address multiple CI reliability/branch-protection issues (release tagging permissions, docs link checking, and PR check/run gating) so required checks consistently report and unnecessary runners aren’t started.

Changes:

• Use a GitHub App token in release-tag.yml so the workflow can push a changelog commit and tag to protected main.
• Adjust docs-related CI behavior: ignore unreleased releases/tag/ links and gate docs lint/link jobs at the job level (plus add an aggregator check).
• Remove paths-based PR build skipping and replace it with a changes job + always-reporting *-complete aggregator checks for Java/NodeJS/Python PR builds.

File summaries

File	Description
.yamllint.yaml	Relaxes YAML line-length limit to reduce lint noise.
.markdown_link_check.json	Ignores GitHub release-tag URLs to prevent link-check failures on unreleased tags.
.github/workflows/release-tag.yml	Generates a GitHub App token and uses it for checkout/push to protected main.
.github/workflows/release-build-python.yml	Removes trailing whitespace in workflow content block.
.github/workflows/release-build-nodejs.yml	Removes trailing whitespace in workflow content block.
.github/workflows/release-build-java.yml	Removes trailing whitespace in workflow content block.
.github/workflows/pull-request-checks.yml	Moves docs guards to job-level if and adds a required-check aggregator job.
.github/workflows/publish-release-layer.yml	Minor formatting adjustment in the matrix list.
.github/workflows/pr-build-python.yml	Adds changes gating and a pr-build-python-complete aggregator check.
.github/workflows/pr-build-nodejs.yml	Adds changes gating and a pr-build-nodejs-complete aggregator check.
.github/workflows/pr-build-java.yml	Adds changes gating and a pr-build-java-complete aggregator check.
.github/labeler.yml	Normalizes YAML inline array formatting for label rules.

Review details

• Files reviewed: 11/12 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The switch to a GitHub App token for tag pushes can cause duplicate release-build runs because release-build workflows already trigger on push.tags and release-tag.yml also dispatches them explicitly.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/release-tag.yml:50

• Switching the tag push to a GitHub App token means the subsequent git push will now emit normal push events for tags, so release-build-*.yml (which already runs on push.tags) may start automatically; the later gh workflow run ... --ref "${TAG}" step can then trigger a second, duplicate release build run for the same tag. Consider removing the manual dispatch, or removing the push.tags trigger from the release-build workflows so each tag produces exactly one release build.
  .markdown_link_check.json:17
• The new ignorePatterns entry is treated as a regex, so unescaped dots in "github.com" match any character and the missing start anchor can ignore unintended URLs. Escaping the dots and anchoring the pattern makes the ignore rule precise to the intended release-tag links.

• Files reviewed: 11/12 changed files
• Comments generated: 0 new
• Review effort level: Lite

[shubham-sumo]

• The new ignorePatterns entry is treated as a regex, so unescaped dots in "github.com" match any character and the missing start anchor can ignore unintended URLs. Escaping the dots and anchoring the pattern makes the ignore rule precise to the intended release-tag links.

Both addressed.

1. Duplicate release-build runs — fixed in 86f6000. Removed the explicit gh workflow run dispatch from release-tag.yml. The push.tags trigger on release-build-*.yml is now the
   only entry point.

2. .markdown_link_check.json regex — fixed. Added start anchor and escaped the dots: ^https://github\\.com/SumoLogic/sumologic-otel-lambda/releases/tag/

[Copilot]

🔵 Needs a closer look

It changes multiple GitHub Actions workflows in ways that can affect required status checks and release automation, so a final human verification of CI behavior is warranted.

Review details

• Files reviewed: 11/12 changed files
• Comments generated: 1
• Review effort level: Lite