diff --git a/.github/workflows/bash-tests.yml b/.github/workflows/bash-tests.yml index 8b607ac..e937ad6 100644 --- a/.github/workflows/bash-tests.yml +++ b/.github/workflows/bash-tests.yml @@ -23,10 +23,15 @@ jobs: name: ShellCheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Run ShellCheck - uses: ludeeus/action-shellcheck@2.0.0 + # ludeeus/action-shellcheck 2.0.0 + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 with: scandir: "." severity: warning @@ -35,7 +40,11 @@ jobs: name: Syntax Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Check bash syntax run: | @@ -62,7 +71,11 @@ jobs: matrix: bash-version: ["4.4", "5.0", "5.1", "5.2"] steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Test with bash version env: @@ -91,10 +104,15 @@ jobs: name: Unit Tests (bats) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Setup bats - uses: bats-core/bats-action@4.0.0 + # bats-core/bats-action 4.0.0 + uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 - name: Run bats tests run: | @@ -104,4 +122,3 @@ jobs: echo "No bats tests found in tests/ directory" echo "Skipping unit tests" fi - diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml index fd1d616..2271ae6 100644 --- a/.github/workflows/pr-automation.yml +++ b/.github/workflows/pr-automation.yml @@ -13,26 +13,26 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get changed files id: changed-files run: | - # Get list of changed files FILES=$(gh pr diff "$PR_NUMBER" --name-only) - echo "files<> $GITHUB_OUTPUT - echo "$FILES" >> $GITHUB_OUTPUT - echo "EOF" >> $GITHUB_OUTPUT + { + echo "files<> "$GITHUB_OUTPUT" env: PR_NUMBER: ${{ github.event.pull_request.number }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Auto-label based on files run: | - PR_NUMBER=${{ github.event.pull_request.number }} - FILES="${{ steps.changed-files.outputs.files }}" - - # Area labels based on file paths if echo "$FILES" | grep -q "^src/api/\|^api/"; then gh pr edit "$PR_NUMBER" --add-label "area:api" || true fi @@ -53,27 +53,23 @@ jobs: gh pr edit "$PR_NUMBER" --add-label "area:tests" || true fi - # Check for breaking changes in commits - COMMITS=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER/commits --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true) + COMMITS=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true) if [ -n "$COMMITS" ]; then gh pr edit "$PR_NUMBER" --add-label "type:breaking" || true fi - # Documentation only if echo "$FILES" | grep -v "^docs/\|\.md$" | grep -q .; then : else gh pr edit "$PR_NUMBER" --add-label "documentation" || true fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + FILES: ${{ steps.changed-files.outputs.files }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Auto-assign reviewers based on files run: | - PR_NUMBER=${{ github.event.pull_request.number }} - FILES="${{ steps.changed-files.outputs.files }}" - - # Assign reviewers based on code areas if echo "$FILES" | grep -q "^src/frontend/\|^components/\|^ui/"; then gh pr edit "$PR_NUMBER" --add-reviewer "frontend-team" || true fi @@ -90,14 +86,12 @@ jobs: gh pr edit "$PR_NUMBER" --add-reviewer "devops-team" || true fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + FILES: ${{ steps.changed-files.outputs.files }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Welcome first-time contributors run: | - PR_NUMBER=${{ github.event.pull_request.number }} - AUTHOR=${{ github.event.pull_request.user.login }} - - # Check if this is the author's first PR PR_COUNT=$(gh pr list --author "$AUTHOR" --state all --limit 1 --json number --jq 'length') if [ "$PR_COUNT" -eq 1 ]; then @@ -120,4 +114,6 @@ jobs: Thanks again for contributing! 🎉' fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + AUTHOR: ${{ github.event.pull_request.user.login }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5a38a51..a08f3bf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,7 @@ name: Release on: push: tags: - - 'v*' + - "v*" workflow_dispatch: permissions: @@ -15,18 +15,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Extract version from tag id: get_version - run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT" - name: Generate release notes id: release_notes + env: + VERSION: ${{ steps.get_version.outputs.version }} run: | - # Extract changes for this version from CHANGELOG - VERSION="${{ steps.get_version.outputs.version }}" - echo "## What's Changed\n" > release_notes.md + printf '%s\n\n' "## What's Changed" > release_notes.md if grep -A 50 "## \[$VERSION\]" CHANGELOG.md; then sed -n "/## \[$VERSION\]/,/## /p" CHANGELOG.md | sed '$d' | sed '1d' >> release_notes.md @@ -36,8 +39,9 @@ jobs: cat release_notes.md - - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + - name: Create GitHub Release # zizmor: ignore[superfluous-actions] + # softprops/action-gh-release v3.0.3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 with: tag_ref: ${{ github.ref }} name: Release ${{ steps.get_version.outputs.version }} diff --git a/clickhouse/.github/workflows/sync-rules.yml b/clickhouse/.github/workflows/sync-rules.yml index c0f28e1..c2b6fa1 100644 --- a/clickhouse/.github/workflows/sync-rules.yml +++ b/clickhouse/.github/workflows/sync-rules.yml @@ -1,9 +1,9 @@ name: Sync Rules from ClickHouse/agent-skills on: - workflow_dispatch: # Allow manual trigger + workflow_dispatch: schedule: - - cron: '0 0 * * 0' # Run weekly on Sunday at midnight UTC + - cron: "0 0 * * 0" # Run weekly on Sunday at midnight UTC permissions: contents: write @@ -14,58 +14,58 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout this repository - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: token: ${{ secrets.GITHUB_TOKEN }} + persist-credentials: false - name: Checkout ClickHouse/agent-skills - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: repository: ClickHouse/agent-skills path: agent-skills ref: main + persist-credentials: false - name: Copy rule files run: | - # Copy all rule files from agent-skills to our skill directory cp -r agent-skills/skills/clickhouse-best-practices/rules/* skills/clickhouse/rules/ - name: Update version run: | - # Increment patch version in SKILL.md current_version=$(grep 'Version.*' skills/clickhouse/SKILL.md | head -1 | sed 's/.*Version.*: \([0-9.]*\).*/\1/') echo "Current version: $current_version" - # Increment patch version IFS='.' read -r major minor patch <<< "$current_version" new_patch=$((patch + 1)) new_version="$major.$minor.$new_patch" echo "New version: $new_version" - # Update SKILL.md sed -i "s/\*\*Version\*\*: $current_version/\*\*Version\*\*: $new_version/" skills/clickhouse/SKILL.md - # Update plugin.json sed -i "s/\"version\": \"$current_version\"/\"version\": \"$new_version\"/" .claude-plugin/plugin.json - name: Check for changes id: check-changes run: | if git diff --quiet; then - echo "has_changes=false" >> $GITHUB_OUTPUT + echo "has_changes=false" >> "$GITHUB_OUTPUT" else - echo "has_changes=true" >> $GITHUB_OUTPUT + echo "has_changes=true" >> "$GITHUB_OUTPUT" fi - name: Create Pull Request if: steps.check-changes.outputs.has_changes == 'true' - uses: peter-evans/create-pull-request@v8 + # peter-evans/create-pull-request v8.1.1 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 with: token: ${{ secrets.GITHUB_TOKEN }} - commit-message: 'feat(clickhouse): sync rules from ClickHouse/agent-skills' + commit-message: "feat(clickhouse): sync rules from ClickHouse/agent-skills" committer: GitHub author: github-actions[bot] - title: 'feat(clickhouse): sync rules from ClickHouse/agent-skills' + title: "feat(clickhouse): sync rules from ClickHouse/agent-skills" body: | ## Sync from ClickHouse/agent-skills