From b09743de122471a7ba4243f7fd2288c504785d5a Mon Sep 17 00:00:00 2001 From: Wes Tarle Date: Fri, 24 Jul 2026 14:12:12 +0000 Subject: [PATCH 1/3] feat: add create-issue-on-failure to scheduled workflows --- .github/workflows/codeql-autogenerated.yml | 8 ++++++++ .github/workflows/codeql-handwritten.yml | 8 ++++++++ .github/workflows/codeql-repo.yml | 8 ++++++++ .github/workflows/discovery.yaml | 8 ++++++++ .github/workflows/response.yml | 7 +++++++ .github/workflows/update-api-list.yaml | 8 ++++++++ 6 files changed, 47 insertions(+) diff --git a/.github/workflows/codeql-autogenerated.yml b/.github/workflows/codeql-autogenerated.yml index 262caafadc4a..ff284c8052fe 100644 --- a/.github/workflows/codeql-autogenerated.yml +++ b/.github/workflows/codeql-autogenerated.yml @@ -69,3 +69,11 @@ jobs: build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis for autogenerated uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "CodeQL Advanced - autogenerated failed" + body: "The daily scheduled task CodeQL Advanced - autogenerated failed." + mention: "@googleapis/cloud-sdk-nodejs-team" diff --git a/.github/workflows/codeql-handwritten.yml b/.github/workflows/codeql-handwritten.yml index 26a4ad03ded0..afb44f397738 100644 --- a/.github/workflows/codeql-handwritten.yml +++ b/.github/workflows/codeql-handwritten.yml @@ -69,3 +69,11 @@ jobs: build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis for handwritten uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "CodeQL Advanced - handwritten failed" + body: "The daily scheduled task CodeQL Advanced - handwritten failed." + mention: "@googleapis/cloud-sdk-nodejs-team" diff --git a/.github/workflows/codeql-repo.yml b/.github/workflows/codeql-repo.yml index e34a4a511754..da1037658e5a 100644 --- a/.github/workflows/codeql-repo.yml +++ b/.github/workflows/codeql-repo.yml @@ -70,3 +70,11 @@ jobs: - name: Perform CodeQL Analysis for repo meta uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "CodeQL Advanced - repo meta failed" + body: "The daily scheduled task CodeQL Advanced - repo meta failed." + mention: "@googleapis/cloud-sdk-nodejs-team" diff --git a/.github/workflows/discovery.yaml b/.github/workflows/discovery.yaml index 907fbd76301c..908d534d4e7c 100644 --- a/.github/workflows/discovery.yaml +++ b/.github/workflows/discovery.yaml @@ -1,5 +1,6 @@ permissions: contents: read + issues: write # Added for creating issues on failure on: schedule: @@ -41,3 +42,10 @@ jobs: git_dir: 'handwritten/bigquery' fork: true force: true + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "Update Discovery Generated Types failed" + body: "The weekly scheduled task to update Discovery Generated Types failed." + mention: "@googleapis/cloud-sdk-nodejs-team" # Can be updated to @googleapis/bigquery-team if preferred diff --git a/.github/workflows/response.yml b/.github/workflows/response.yml index 0b5d5e8a0313..0710cf714250 100644 --- a/.github/workflows/response.yml +++ b/.github/workflows/response.yml @@ -24,6 +24,13 @@ jobs: script: | const script = require('./.github/scripts/close-unresponsive.cjs') await script({github, context}) + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "Close unresponsive issues failed" + body: "The daily scheduled task to close unresponsive issues failed." + mention: "@googleapis/cloud-sdk-nodejs-team" remove_label: if: github.event_name == 'issue_comment' diff --git a/.github/workflows/update-api-list.yaml b/.github/workflows/update-api-list.yaml index d0fe250a386a..d5f061d9ee82 100644 --- a/.github/workflows/update-api-list.yaml +++ b/.github/workflows/update-api-list.yaml @@ -1,5 +1,6 @@ permissions: contents: read + issues: write # Added for creating issues on failure on: schedule: @@ -33,3 +34,10 @@ jobs: message: 'docs: update the list of available APIs' branch: update-api-list git_dir: '.' + - name: Create issue on failure + if: ${{ failure() }} + uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + with: + title: "Update API list failed" + body: "The daily scheduled task to update the API list failed." + mention: "@googleapis/cloud-sdk-nodejs-team" From 08a7b29525186cf243f6466e43022a092416c1fc Mon Sep 17 00:00:00 2001 From: Wes Tarle Date: Fri, 24 Jul 2026 18:29:31 +0000 Subject: [PATCH 2/3] fix: pin librarian action to hash to satisfy zizmor --- .github/workflows/codeql-autogenerated.yml | 2 +- .github/workflows/codeql-handwritten.yml | 2 +- .github/workflows/codeql-repo.yml | 2 +- .github/workflows/discovery.yaml | 2 +- .github/workflows/response.yml | 2 +- .github/workflows/update-api-list.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql-autogenerated.yml b/.github/workflows/codeql-autogenerated.yml index ff284c8052fe..dafede4aa265 100644 --- a/.github/workflows/codeql-autogenerated.yml +++ b/.github/workflows/codeql-autogenerated.yml @@ -72,7 +72,7 @@ jobs: - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "CodeQL Advanced - autogenerated failed" body: "The daily scheduled task CodeQL Advanced - autogenerated failed." diff --git a/.github/workflows/codeql-handwritten.yml b/.github/workflows/codeql-handwritten.yml index afb44f397738..6c0044309ac6 100644 --- a/.github/workflows/codeql-handwritten.yml +++ b/.github/workflows/codeql-handwritten.yml @@ -72,7 +72,7 @@ jobs: - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "CodeQL Advanced - handwritten failed" body: "The daily scheduled task CodeQL Advanced - handwritten failed." diff --git a/.github/workflows/codeql-repo.yml b/.github/workflows/codeql-repo.yml index da1037658e5a..ee086151658a 100644 --- a/.github/workflows/codeql-repo.yml +++ b/.github/workflows/codeql-repo.yml @@ -73,7 +73,7 @@ jobs: - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "CodeQL Advanced - repo meta failed" body: "The daily scheduled task CodeQL Advanced - repo meta failed." diff --git a/.github/workflows/discovery.yaml b/.github/workflows/discovery.yaml index 908d534d4e7c..e46675c0b945 100644 --- a/.github/workflows/discovery.yaml +++ b/.github/workflows/discovery.yaml @@ -44,7 +44,7 @@ jobs: force: true - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "Update Discovery Generated Types failed" body: "The weekly scheduled task to update Discovery Generated Types failed." diff --git a/.github/workflows/response.yml b/.github/workflows/response.yml index 0710cf714250..d812dc4f483b 100644 --- a/.github/workflows/response.yml +++ b/.github/workflows/response.yml @@ -26,7 +26,7 @@ jobs: await script({github, context}) - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "Close unresponsive issues failed" body: "The daily scheduled task to close unresponsive issues failed." diff --git a/.github/workflows/update-api-list.yaml b/.github/workflows/update-api-list.yaml index d5f061d9ee82..c8aa3f8233aa 100644 --- a/.github/workflows/update-api-list.yaml +++ b/.github/workflows/update-api-list.yaml @@ -36,7 +36,7 @@ jobs: git_dir: '.' - name: Create issue on failure if: ${{ failure() }} - uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses] + uses: googleapis/librarian/.github/actions/create-issue-on-failure@baf9b8078c5e98cb90b53088f284fb7b060e195b # main with: title: "Update API list failed" body: "The daily scheduled task to update the API list failed." From 1bda9182cf38a8d742782ee1494bef204aff3d88 Mon Sep 17 00:00:00 2001 From: Wes Tarle Date: Fri, 24 Jul 2026 21:17:42 +0000 Subject: [PATCH 3/3] fix: move issues: write to job level to satisfy zizmor --- .github/workflows/codeql-autogenerated.yml | 1 + .github/workflows/codeql-handwritten.yml | 1 + .github/workflows/codeql-repo.yml | 1 + .github/workflows/discovery.yaml | 4 +++- .github/workflows/update-api-list.yaml | 4 +++- 5 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-autogenerated.yml b/.github/workflows/codeql-autogenerated.yml index dafede4aa265..47d2fe34a62d 100644 --- a/.github/workflows/codeql-autogenerated.yml +++ b/.github/workflows/codeql-autogenerated.yml @@ -29,6 +29,7 @@ jobs: # only required for workflows in private repositories actions: read contents: read + issues: write # Added for creating issues on failure strategy: fail-fast: false diff --git a/.github/workflows/codeql-handwritten.yml b/.github/workflows/codeql-handwritten.yml index 6c0044309ac6..ba2433cf2d61 100644 --- a/.github/workflows/codeql-handwritten.yml +++ b/.github/workflows/codeql-handwritten.yml @@ -29,6 +29,7 @@ jobs: # only required for workflows in private repositories actions: read contents: read + issues: write # Added for creating issues on failure strategy: fail-fast: false diff --git a/.github/workflows/codeql-repo.yml b/.github/workflows/codeql-repo.yml index ee086151658a..5c8af0954eda 100644 --- a/.github/workflows/codeql-repo.yml +++ b/.github/workflows/codeql-repo.yml @@ -29,6 +29,7 @@ jobs: # only required for workflows in private repositories actions: read contents: read + issues: write # Added for creating issues on failure strategy: fail-fast: false diff --git a/.github/workflows/discovery.yaml b/.github/workflows/discovery.yaml index e46675c0b945..9213d299bfd7 100644 --- a/.github/workflows/discovery.yaml +++ b/.github/workflows/discovery.yaml @@ -1,6 +1,5 @@ permissions: contents: read - issues: write # Added for creating issues on failure on: schedule: @@ -10,6 +9,9 @@ name: Update Discovery Generated Types jobs: sync: runs-on: ubuntu-latest + permissions: + contents: read + issues: write # Added for creating issues on failure steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: diff --git a/.github/workflows/update-api-list.yaml b/.github/workflows/update-api-list.yaml index c8aa3f8233aa..982d11082da8 100644 --- a/.github/workflows/update-api-list.yaml +++ b/.github/workflows/update-api-list.yaml @@ -1,6 +1,5 @@ permissions: contents: read - issues: write # Added for creating issues on failure on: schedule: @@ -10,6 +9,9 @@ on: jobs: update-api-list: runs-on: ubuntu-latest + permissions: + contents: read + issues: write # Added for creating issues on failure steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: