[PPSC-731] feat(action): publish dedicated GitHub Action with versioned tags#213
Merged
Merged
Conversation
|
Test Coverage Reporttotal: (statements) 72.1% Coverage by function |
There was a problem hiding this comment.
Pull request overview
This PR formalizes distribution of the repository’s composite GitHub Action by introducing release-managed floating version tags (e.g., v1, v1.10) and updating documentation/examples to recommend safe version pinning (@v1 instead of @main). It also updates the Marketplace sample workflow to reference the action in this repository and marks the previously duplicated local composite action as deprecated.
Changes:
- Update the release workflow to only trigger on full semver tags and add a job that force-moves floating major/minor tags to the latest stable release.
- Update docs and example workflows to recommend pinning the action to
@v1(or exact tags / SHAs) and document one-time Marketplace publish steps. - Deprecate the local composite action in
.github/actions/armis-cli-action/in favor of the rootaction.yml.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates GitHub Action usage guidance to pin @v1 (or exact tags/SHAs). |
| docs/DISTRIBUTION-SETUP.md | Documents one-time Marketplace publish steps and floating tag behavior. |
| docs/CI-INTEGRATION.md | Updates CI integration examples and adds version-pinning guidance. |
| docs/ci-examples/github-actions.yml | Updates example workflow to use ArmisSecurity/armis-cli@v1 with pinning notes. |
| docs/CHANGELOG.md | Adds unreleased changelog entries describing the new versioned Action distribution. |
| .github/workflows/release.yml | Narrows release trigger to full semver tags and adds update-aliases to move floating tags. |
| .github/workflows/armis-cli-marketplace-sample.yml | Fixes Marketplace sample to use ArmisSecurity/armis-cli@v1 with structured inputs. |
| .github/actions/armis-cli-action/action.yml | Marks the local composite action as deprecated and points users to the root action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
yiftach-armis
added a commit
that referenced
this pull request
Jun 5, 2026
- Fix CI-INTEGRATION.md anchor link text to match target heading (Version Pinning -> Supply Chain Security). - Replace (#PR) placeholders in CHANGELOG with the actual PR number (#213).
yiftach-armis
added a commit
that referenced
this pull request
Jun 8, 2026
- Fix CI-INTEGRATION.md anchor link text to match target heading (Version Pinning -> Supply Chain Security). - Replace (#PR) placeholders in CHANGELOG with the actual PR number (#213).
yiftach-armis
force-pushed
the
feat/PPSC-731-dedicated-github-action
branch
from
d8952f3 to
2a5900f
Compare
yiftach-armis
added a commit
that referenced
this pull request
Jun 8, 2026
- Revert reusable-workflow refs back to @main (bootstrapping constraint: the workflow file must exist at the called ref, and @v1 is created by the release pipeline after the workflow runs) - Clarify release.yml trigger comment: v*.*.* matches tags with a major.minor.patch segment (including pre-release like v1.10.3-rc.1), not strictly stable semver; the regex guard in update-aliases filters
yiftach-armis
added a commit
that referenced
this pull request
Jun 8, 2026
- Fix CI-INTEGRATION.md anchor link text to match target heading (Version Pinning -> Supply Chain Security). - Replace (#PR) placeholders in CHANGELOG with the actual PR number (#213).
yiftach-armis
added a commit
that referenced
this pull request
Jun 8, 2026
- Revert reusable-workflow refs back to @main (bootstrapping constraint: the workflow file must exist at the called ref, and @v1 is created by the release pipeline after the workflow runs) - Clarify release.yml trigger comment: v*.*.* matches tags with a major.minor.patch segment (including pre-release like v1.10.3-rc.1), not strictly stable semver; the regex guard in update-aliases filters
yiftach-armis
force-pushed
the
feat/PPSC-731-dedicated-github-action
branch
from
a02c0db to
f3436d4
Compare
yiftach-armis
added a commit
that referenced
this pull request
Jun 9, 2026
- Fix CI-INTEGRATION.md anchor link text to match target heading (Version Pinning -> Supply Chain Security). - Replace (#PR) placeholders in CHANGELOG with the actual PR number (#213).
yiftach-armis
added a commit
that referenced
this pull request
Jun 9, 2026
- Revert reusable-workflow refs back to @main (bootstrapping constraint: the workflow file must exist at the called ref, and @v1 is created by the release pipeline after the workflow runs) - Clarify release.yml trigger comment: v*.*.* matches tags with a major.minor.patch segment (including pre-release like v1.10.3-rc.1), not strictly stable semver; the regex guard in update-aliases filters
yiftach-armis
force-pushed
the
feat/PPSC-731-dedicated-github-action
branch
from
f3436d4 to
4a51eee
Compare
yiftach-armis
added a commit
that referenced
this pull request
Jun 9, 2026
Clarify that pinning the action ref freezes the action definition, not the CLI binary (the action installs from releases/latest by default). Reword "fully reproducible builds" across README, CI-INTEGRATION, DISTRIBUTION-SETUP, and the github-actions example. Also add an explicit `git fetch --force --tags` to the update-aliases job so LATEST_FOR_MAJOR is computed from a complete tag set, mirroring the goreleaser job.
…ed tags The dedicated composite action (root action.yml, ArmisSecurity/armis-cli) already existed but lacked versioned distribution: consumers were told to pin @main, and no floating major/minor tags existed. - release.yml: add update-aliases job that force-moves floating vN and vN.M tags to each stable release; narrow trigger to v*.*.* to avoid a release re-trigger loop; regex-guard skips pre-release tags. - Fix marketplace-sample workflow: repoint non-existent ArmisSecurity/armis-cli-action@v1 -> ArmisSecurity/armis-cli@v1 with structured inputs. - Docs: recommend @v1 over @main (README, CI-INTEGRATION, ci-examples) with version-pinning guidance; document one-time Marketplace publish steps. - Deprecate the duplicate local composite action in favor of the root action. - CHANGELOG: add Unreleased entries.
- Fix CI-INTEGRATION.md anchor link text to match target heading (Version Pinning -> Supply Chain Security). - Replace (#PR) placeholders in CHANGELOG with the actual PR number (#213).
- Revert reusable-workflow refs back to @main (bootstrapping constraint: the workflow file must exist at the called ref, and @v1 is created by the release pipeline after the workflow runs) - Clarify release.yml trigger comment: v*.*.* matches tags with a major.minor.patch segment (including pre-release like v1.10.3-rc.1), not strictly stable semver; the regex guard in update-aliases filters
…leases Previously, update-aliases unconditionally moved the floating major tag (e.g. v1) to $GITHUB_SHA. If a stable patch was released for an older minor line (e.g. v1.9.9 after v1.10.3), v1 would regress. Now the major alias is only updated when the current release is the highest semver tag for that major line, detected via `git tag --sort=-v:refname`. The minor alias update remains unconditional since a backport to vX.Y.z can never share the same minor with a newer release.
Clarify that pinning the action ref freezes the action definition, not the CLI binary (the action installs from releases/latest by default). Reword "fully reproducible builds" across README, CI-INTEGRATION, DISTRIBUTION-SETUP, and the github-actions example. Also add an explicit `git fetch --force --tags` to the update-aliases job so LATEST_FOR_MAJOR is computed from a complete tag set, mirroring the goreleaser job.
The PPSC-731 entries had been absorbed into the already-released [1.11.0] section during a rebase. v1.11.0 and v1.11.1 shipped without this PR's code, so the GitHub Action / floating-tag feature has not been released yet. Move all five #213 entries back under [Unreleased] and prune the now-empty Deprecated/Removed headers from the 1.11.0 section.
yiftach-armis
force-pushed
the
feat/PPSC-731-dedicated-github-action
branch
from
3d3cd28 to
8493ad7
Compare
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
Type of Change
Problem
The dedicated composite action already existed at the repo root (
ArmisSecurity/armis-cli), but distribution wasn't versioned: docs told consumers to pin@main(unsafe/unpinned), no floatingv1/v1.10tags existed, and the marketplace sample referenced a non-existentArmisSecurity/armis-cli-action@v1repo.Solution
release.ymlnow runs anupdate-aliasesjob that force-moves floating major/minor tags (v1,v1.10) to each stable release (trigger narrowed tov*.*.*with a pre-release regex guard to prevent a release re-trigger loop); the broken marketplace sample is repointed toArmisSecurity/armis-cli@v1with structured inputs; the duplicate local composite action is deprecated in favor of the rootaction.yml; and docs (README, CI-INTEGRATION, ci-examples, DISTRIBUTION-SETUP) now recommend@v1, add version-pinning guidance, and document the one-time Marketplace publish steps.Testing
Automated Tests
Manual Testing
Pre-PR verify run:
make test(2347 passed, 67.7% coverage),make build(binary produced) both green. All 4 changed YAML files parse cleanly and pass repo pre-commit hooks (yamllint, markdownlint, shellcheck). Tag-derivation logic dry-run confirmedv1.10.3→v1+v1.10, and thev*.*.*trigger + regex guard correctly exclude floating aliases while still building releases for historical pre-release tags. (Lint shows only pre-existing findings in a sibling workspace; one pre-existing HIGH ininternal/supplychain/check/lockfile.gois untouched Go code, not part of this YAML/docs diff.)Reviewer Notes
This PR is YAML + Markdown only — no Go source changes. Note that the reusable-workflow
uses:references intentionally stay on@main(pinning them to@v1would create a release-order chicken-and-egg). The actual Marketplace publish is a one-time manual GitHub UI step (can't be automated) and is documented indocs/DISTRIBUTION-SETUP.md. CHANGELOG entries use(#PR)placeholders — happy to update with this PR's number.Checklist