Skip to content
This repository was archived by the owner on May 31, 2026. It is now read-only.

chore(TestingKit): workflow hygiene — ubuntu-24.04, permissions #67

Open
KooshaPari wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(TestingKit): workflow hygiene — ubuntu-24.04, permissions #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/cargo-deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ permissions:
contents: read
jobs:
cargo-deny:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: EmbarkStudios/cargo-deny-action@v2
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# Generated CI workflow - calls reusable phenotype workflow
permissions:
contents: read
pull-requests: read
name: CI

on:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ permissions:
jobs:
analyze:
name: Analyze Rust
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
actions: read
contents: read
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# Generated coverage workflow - calls reusable phenotype workflow
permissions:
contents: read
pull-requests: read
name: Coverage

on:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ permissions:

jobs:
dependency-review:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@v6
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/fr-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,11 @@
name: fr-coverage
permissions:
contents: read
pull-requests: read
on: [pull_request]
jobs:
fr:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/journey-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# =============================================================================
permissions:
contents: read

Check warning on line 3 in .github/workflows/journey-gate.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this read permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=KooshaPari_TestingKit&issues=AZ5ttnU6Hm9rv6KfjMx-&open=AZ5ttnU6Hm9rv6KfjMx-&pullRequest=67
pull-requests: read

Check warning on line 4 in .github/workflows/journey-gate.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this read permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=KooshaPari_TestingKit&issues=AZ5ttnU6Hm9rv6KfjMx_&open=AZ5ttnU6Hm9rv6KfjMx_&pullRequest=67
# Journey Gate — Reusable Workflow
# =============================================================================
# Canonical source: phenotype-infra/docs/governance/ci-journey-gate.yml
Expand Down Expand Up @@ -50,7 +53,7 @@
jobs:
journey-gate:
name: Journey Verification
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 15

steps:
Expand Down Expand Up @@ -233,7 +236,7 @@
# --------------------------------------------------------------------------
stub-mode:
name: Journey Gate — No Manifests Found
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
needs: journey-gate
if: needs.journey-gate.result == 'failure' && needs.journey-gate.outputs.MANIFEST_COUNT == '0'
steps:
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,11 @@
name: quality-gate
permissions:
contents: read
pull-requests: read
on: [push, pull_request]
jobs:
gate:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ permissions: read-all
jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
security-events: write
id-token: write
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/trufflehog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
name: Trufflehog Secrets Scan
permissions:
contents: read
pull-requests: read
on:
push:
branches: [main]
pull_request:

jobs:
trufflehog:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
Expand Down
15 changes: 15 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Pre-commit hooks for TestingKit
# Install: pre-commit install
# Run manually: pre-commit run --all-files

repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
- id: check-json
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since this repository contains TOML configuration files (such as deny.toml and potentially Cargo.toml in the Rust subdirectory), it is highly recommended to include the check-toml hook to validate TOML syntax during pre-commit checks.

      - id: check-json
      - id: check-toml

- id: check-added-large-files
- id: check-merge-conflict
- id: detect-private-key
Loading