From 83cbce291b0a1c3492598585af5f738b893ae293 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 18:53:53 +0000 Subject: [PATCH 1/4] fix(ci): pin actions/checkout v7 for Super-linter Hash-pin checkout v7.0.1 and the other uses in the same workflow files so zizmor unpinned-uses and YAML_PRETTIER pass. Co-Authored-By: duyetbot --- .github/workflows/bash-tests.yml | 31 ++++++++++++++++----- .github/workflows/pr-automation.yml | 18 +++++++----- .github/workflows/release.yml | 14 ++++++---- clickhouse/.github/workflows/sync-rules.yml | 23 +++++++++------ 4 files changed, 58 insertions(+), 28 deletions(-) diff --git a/.github/workflows/bash-tests.yml b/.github/workflows/bash-tests.yml index 8b607ac..e937ad6 100644 --- a/.github/workflows/bash-tests.yml +++ b/.github/workflows/bash-tests.yml @@ -23,10 +23,15 @@ jobs: name: ShellCheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Run ShellCheck - uses: ludeeus/action-shellcheck@2.0.0 + # ludeeus/action-shellcheck 2.0.0 + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 with: scandir: "." severity: warning @@ -35,7 +40,11 @@ jobs: name: Syntax Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Check bash syntax run: | @@ -62,7 +71,11 @@ jobs: matrix: bash-version: ["4.4", "5.0", "5.1", "5.2"] steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Test with bash version env: @@ -91,10 +104,15 @@ jobs: name: Unit Tests (bats) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Setup bats - uses: bats-core/bats-action@4.0.0 + # bats-core/bats-action 4.0.0 + uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 - name: Run bats tests run: | @@ -104,4 +122,3 @@ jobs: echo "No bats tests found in tests/ directory" echo "Skipping unit tests" fi - diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml index fd1d616..59978b6 100644 --- a/.github/workflows/pr-automation.yml +++ b/.github/workflows/pr-automation.yml @@ -13,16 +13,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get changed files id: changed-files run: | # Get list of changed files FILES=$(gh pr diff "$PR_NUMBER" --name-only) - echo "files<> $GITHUB_OUTPUT - echo "$FILES" >> $GITHUB_OUTPUT - echo "EOF" >> $GITHUB_OUTPUT + { + echo "files<> "$GITHUB_OUTPUT" env: PR_NUMBER: ${{ github.event.pull_request.number }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -94,9 +99,6 @@ jobs: - name: Welcome first-time contributors run: | - PR_NUMBER=${{ github.event.pull_request.number }} - AUTHOR=${{ github.event.pull_request.user.login }} - # Check if this is the author's first PR PR_COUNT=$(gh pr list --author "$AUTHOR" --state all --limit 1 --json number --jq 'length') @@ -120,4 +122,6 @@ jobs: Thanks again for contributing! 🎉' fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + AUTHOR: ${{ github.event.pull_request.user.login }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5a38a51..5b7a4d4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,7 @@ name: Release on: push: tags: - - 'v*' + - "v*" workflow_dispatch: permissions: @@ -15,18 +15,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Extract version from tag id: get_version - run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT" - name: Generate release notes id: release_notes run: | # Extract changes for this version from CHANGELOG VERSION="${{ steps.get_version.outputs.version }}" - echo "## What's Changed\n" > release_notes.md + printf '%s\n\n' "## What's Changed" > release_notes.md if grep -A 50 "## \[$VERSION\]" CHANGELOG.md; then sed -n "/## \[$VERSION\]/,/## /p" CHANGELOG.md | sed '$d' | sed '1d' >> release_notes.md @@ -37,7 +40,8 @@ jobs: cat release_notes.md - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + # softprops/action-gh-release v3.0.3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 with: tag_ref: ${{ github.ref }} name: Release ${{ steps.get_version.outputs.version }} diff --git a/clickhouse/.github/workflows/sync-rules.yml b/clickhouse/.github/workflows/sync-rules.yml index c0f28e1..91fc077 100644 --- a/clickhouse/.github/workflows/sync-rules.yml +++ b/clickhouse/.github/workflows/sync-rules.yml @@ -1,9 +1,9 @@ name: Sync Rules from ClickHouse/agent-skills on: - workflow_dispatch: # Allow manual trigger + workflow_dispatch: # Allow manual trigger schedule: - - cron: '0 0 * * 0' # Run weekly on Sunday at midnight UTC + - cron: "0 0 * * 0" # Run weekly on Sunday at midnight UTC permissions: contents: write @@ -14,16 +14,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout this repository - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: token: ${{ secrets.GITHUB_TOKEN }} + persist-credentials: false - name: Checkout ClickHouse/agent-skills - uses: actions/checkout@v6 + # actions/checkout v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: repository: ClickHouse/agent-skills path: agent-skills ref: main + persist-credentials: false - name: Copy rule files run: | @@ -52,20 +56,21 @@ jobs: id: check-changes run: | if git diff --quiet; then - echo "has_changes=false" >> $GITHUB_OUTPUT + echo "has_changes=false" >> "$GITHUB_OUTPUT" else - echo "has_changes=true" >> $GITHUB_OUTPUT + echo "has_changes=true" >> "$GITHUB_OUTPUT" fi - name: Create Pull Request if: steps.check-changes.outputs.has_changes == 'true' - uses: peter-evans/create-pull-request@v8 + # peter-evans/create-pull-request v8.1.1 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 with: token: ${{ secrets.GITHUB_TOKEN }} - commit-message: 'feat(clickhouse): sync rules from ClickHouse/agent-skills' + commit-message: "feat(clickhouse): sync rules from ClickHouse/agent-skills" committer: GitHub author: github-actions[bot] - title: 'feat(clickhouse): sync rules from ClickHouse/agent-skills' + title: "feat(clickhouse): sync rules from ClickHouse/agent-skills" body: | ## Sync from ClickHouse/agent-skills From e28ff195fb30f0e916c570a9deee0331bda07c7f Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 18:55:48 +0000 Subject: [PATCH 2/4] style(ci): drop narrating comments from pinned workflows Co-Authored-By: duyetbot --- .github/workflows/pr-automation.yml | 6 ------ .github/workflows/release.yml | 1 - clickhouse/.github/workflows/sync-rules.yml | 7 +------ 3 files changed, 1 insertion(+), 13 deletions(-) diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml index 59978b6..3624235 100644 --- a/.github/workflows/pr-automation.yml +++ b/.github/workflows/pr-automation.yml @@ -21,7 +21,6 @@ jobs: - name: Get changed files id: changed-files run: | - # Get list of changed files FILES=$(gh pr diff "$PR_NUMBER" --name-only) { echo "files< release_notes.md diff --git a/clickhouse/.github/workflows/sync-rules.yml b/clickhouse/.github/workflows/sync-rules.yml index 91fc077..c2b6fa1 100644 --- a/clickhouse/.github/workflows/sync-rules.yml +++ b/clickhouse/.github/workflows/sync-rules.yml @@ -1,7 +1,7 @@ name: Sync Rules from ClickHouse/agent-skills on: - workflow_dispatch: # Allow manual trigger + workflow_dispatch: schedule: - cron: "0 0 * * 0" # Run weekly on Sunday at midnight UTC @@ -31,25 +31,20 @@ jobs: - name: Copy rule files run: | - # Copy all rule files from agent-skills to our skill directory cp -r agent-skills/skills/clickhouse-best-practices/rules/* skills/clickhouse/rules/ - name: Update version run: | - # Increment patch version in SKILL.md current_version=$(grep 'Version.*' skills/clickhouse/SKILL.md | head -1 | sed 's/.*Version.*: \([0-9.]*\).*/\1/') echo "Current version: $current_version" - # Increment patch version IFS='.' read -r major minor patch <<< "$current_version" new_patch=$((patch + 1)) new_version="$major.$minor.$new_patch" echo "New version: $new_version" - # Update SKILL.md sed -i "s/\*\*Version\*\*: $current_version/\*\*Version\*\*: $new_version/" skills/clickhouse/SKILL.md - # Update plugin.json sed -i "s/\"version\": \"$current_version\"/\"version\": \"$new_version\"/" .claude-plugin/plugin.json - name: Check for changes From 48b19ff2ae427608c1959c614ff1150a8393dfcd Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 19:01:06 +0000 Subject: [PATCH 3/4] fix(ci): clear leftover zizmor findings on touched workflows Move interpolations into env and create releases with gh so Super-linter treats zizmor as clean. Co-Authored-By: duyetbot --- .github/workflows/pr-automation.yml | 12 +++++------- .github/workflows/release.yml | 18 +++++++----------- 2 files changed, 12 insertions(+), 18 deletions(-) diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml index 3624235..2271ae6 100644 --- a/.github/workflows/pr-automation.yml +++ b/.github/workflows/pr-automation.yml @@ -33,9 +33,6 @@ jobs: - name: Auto-label based on files run: | - PR_NUMBER=${{ github.event.pull_request.number }} - FILES="${{ steps.changed-files.outputs.files }}" - if echo "$FILES" | grep -q "^src/api/\|^api/"; then gh pr edit "$PR_NUMBER" --add-label "area:api" || true fi @@ -56,7 +53,7 @@ jobs: gh pr edit "$PR_NUMBER" --add-label "area:tests" || true fi - COMMITS=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER/commits --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true) + COMMITS=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true) if [ -n "$COMMITS" ]; then gh pr edit "$PR_NUMBER" --add-label "type:breaking" || true fi @@ -67,13 +64,12 @@ jobs: gh pr edit "$PR_NUMBER" --add-label "documentation" || true fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + FILES: ${{ steps.changed-files.outputs.files }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Auto-assign reviewers based on files run: | - PR_NUMBER=${{ github.event.pull_request.number }} - FILES="${{ steps.changed-files.outputs.files }}" - if echo "$FILES" | grep -q "^src/frontend/\|^components/\|^ui/"; then gh pr edit "$PR_NUMBER" --add-reviewer "frontend-team" || true fi @@ -90,6 +86,8 @@ jobs: gh pr edit "$PR_NUMBER" --add-reviewer "devops-team" || true fi env: + PR_NUMBER: ${{ github.event.pull_request.number }} + FILES: ${{ steps.changed-files.outputs.files }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Welcome first-time contributors diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1711acc..bd1ee9f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,8 +26,9 @@ jobs: - name: Generate release notes id: release_notes + env: + VERSION: ${{ steps.get_version.outputs.version }} run: | - VERSION="${{ steps.get_version.outputs.version }}" printf '%s\n\n' "## What's Changed" > release_notes.md if grep -A 50 "## \[$VERSION\]" CHANGELOG.md; then @@ -39,15 +40,10 @@ jobs: cat release_notes.md - name: Create GitHub Release - # softprops/action-gh-release v3.0.3 - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 - with: - tag_ref: ${{ github.ref }} - name: Release ${{ steps.get_version.outputs.version }} - body_path: release_notes.md - draft: false - prerelease: false - generate_release_notes: false - fail_on_unmatched_files: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ steps.get_version.outputs.version }} + run: | + gh release create "${GITHUB_REF_NAME}" \ + --title "Release ${VERSION}" \ + --notes-file release_notes.md From 484457c54cbb28d92620e6c268171ac560fe659d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 19:03:22 +0000 Subject: [PATCH 4/4] fix(ci): ignore superfluous-actions on pinned action-gh-release Keep the SHA-pinned release action. zizmor 1.23.1 accepts the ignore on the step name line. Co-Authored-By: duyetbot --- .github/workflows/release.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd1ee9f..a08f3bf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,11 +39,16 @@ jobs: cat release_notes.md - - name: Create GitHub Release + - name: Create GitHub Release # zizmor: ignore[superfluous-actions] + # softprops/action-gh-release v3.0.3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 + with: + tag_ref: ${{ github.ref }} + name: Release ${{ steps.get_version.outputs.version }} + body_path: release_notes.md + draft: false + prerelease: false + generate_release_notes: false + fail_on_unmatched_files: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: ${{ steps.get_version.outputs.version }} - run: | - gh release create "${GITHUB_REF_NAME}" \ - --title "Release ${VERSION}" \ - --notes-file release_notes.md