Skip to content

Split OPS reporting into unprivileged collection and trusted publishing - #37

Merged
BillWagner merged 2 commits into
dotnet:mainfrom
BillWagner:harden-build-reporter
Oct 28, 2026
Merged

BillWagner merged 2 commits into
dotnet:mainfrom
BillWagner:harden-build-reporter

Conversation

@BillWagner

Copy link
Copy Markdown
Member
  • Make ops-build-reporter produce preview and diagnostic artifacts on pull_request
  • Add a trusted workflow_run publisher for PR descriptions and annotations
  • Validate artifact schemas, source runs, fork PR associations, and head SHAs
  • Preserve user-authored PR content and publish diagnostics from failed builds
  • Add reusable workflows with runner hardening and least-privilege permissions
  • Update status-checker permissions, Node 24 tooling, tests, and documentation
  • Regenerate action bundles from TypeScript sources

BREAKING CHANGE: ops-build-reporter no longer updates PRs directly. Existing callers must migrate to the producer/publisher workflow pair.

- Make ops-build-reporter produce preview and diagnostic artifacts on `pull_request`
- Add a trusted `workflow_run` publisher for PR descriptions and annotations
- Validate artifact schemas, source runs, fork PR associations, and head SHAs
- Preserve user-authored PR content and publish diagnostics from failed builds
- Add reusable workflows with runner hardening and least-privilege permissions
- Update status-checker permissions, Node 24 tooling, tests, and documentation
- Regenerate action bundles from TypeScript sources

BREAKING CHANGE: ops-build-reporter no longer updates PRs directly.
Existing callers must migrate to the producer/publisher workflow pair.
@BillWagner
BillWagner marked this pull request as ready for review October 27, 2026 21:45
@BillWagner
BillWagner requested review from a team and gewarren as code owners October 27, 2026 21:45
@BillWagner
BillWagner merged commit 691009a into dotnet:main Oct 28, 2026
9 checks passed
@BillWagner
BillWagner deleted the harden-build-reporter branch October 28, 2026 14:40
BillWagner added a commit to dotnet/docs that referenced this pull request Oct 28, 2026
- Run artifact collection on `pull_request` with read-only permissions
- Add a trusted `workflow_run` publisher for preview links and diagnostics

Requires the updated producer and publisher actions in dotnet/docs-actions#37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants