From 40f487b697a52ce9f7b34836c013f7d3c32d3d84 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 15:52:29 +0000 Subject: [PATCH] chore(sync): synced file(s) with cplieger/ci --- .github/workflows/ci.yaml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/coverage.yml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/security.yml | 2 +- cliff.toml | 10 ++++++++++ tests/image-smoke.sh | 24 ++++++++++++++++++------ 8 files changed, 34 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 89770e7..cfa0296 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -33,4 +33,4 @@ concurrency: jobs: ci: - uses: cplieger/ci/.github/workflows/ci.yaml@f32f5781220cca329df97b3df578363747e04259 # v2 + uses: cplieger/ci/.github/workflows/ci.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c5245c4..b5169d7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -16,4 +16,4 @@ jobs: security-events: write contents: read actions: read - uses: cplieger/ci/.github/workflows/codeql.yaml@f32f5781220cca329df97b3df578363747e04259 # v2 + uses: cplieger/ci/.github/workflows/codeql.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2 diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 13b3b11..8e285ea 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -27,4 +27,4 @@ jobs: # NOTE: pin this @SHA to the ci release tag that first contains # coverage.yaml when cutting that tag (see ci.md "Updating and propagating"). # Renovate then tracks the `# v2` comment and bumps the digest thereafter. - uses: cplieger/ci/.github/workflows/coverage.yaml@f32f5781220cca329df97b3df578363747e04259 # v2 + uses: cplieger/ci/.github/workflows/coverage.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 30d567c..0dcba06 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -63,7 +63,7 @@ jobs: id-token: write attestations: write security-events: write - uses: cplieger/ci/.github/workflows/release.yaml@f32f5781220cca329df97b3df578363747e04259 # v2 + uses: cplieger/ci/.github/workflows/release.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2 # Forward only the two Docker Hub publish credentials the reusable pipeline # actually declares and consumes, rather than `secrets: inherit` (which # exposes every repo secret to the reusable-workflow trust boundary). Both diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4f64b6b..949c038 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -52,6 +52,6 @@ jobs: retention-days: 5 - name: Upload SARIF to code-scanning - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: sarif_file: results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 13137f9..d5adcc0 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -22,4 +22,4 @@ jobs: permissions: contents: read security-events: write - uses: cplieger/ci/.github/workflows/security-scan.yaml@f32f5781220cca329df97b3df578363747e04259 # v2 + uses: cplieger/ci/.github/workflows/security-scan.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2 diff --git a/cliff.toml b/cliff.toml index d315adf..769dd04 100644 --- a/cliff.toml +++ b/cliff.toml @@ -63,6 +63,16 @@ exclude_paths = [ ".gitignore", ".gitattributes", ".editorconfig", + # punused adjudications: the repo-owned whitelist the go-ci unused-export gate + # reads. Dev-only, never in an artifact, and an adjudication-only commit ships + # nothing — but it is the one dotfile here a `refactor:`-typed commit plausibly + # touches alone (deleting dead code and recording the survivors is one change; + # recording them alone is the follow-up), and `refactor:` is a RELEASING type. + # `**/` not bare: go-ci reads this file relative to its working-directory, so a + # nested Go module's copy lives at /.punused-ignore and the root-anchored + # form would miss it (measured on the pinned cliff v2.13.1 — bare excludes the + # root file only, `**/` excludes both, and a real code commit still bumps). + "**/.punused-ignore", ] commit_parsers = [ diff --git a/tests/image-smoke.sh b/tests/image-smoke.sh index 17fdf7e..f27da8d 100644 --- a/tests/image-smoke.sh +++ b/tests/image-smoke.sh @@ -36,6 +36,12 @@ # wait shares the SMOKE_TIMEOUT deadline: the container must # be healthy AND have logged the pattern before it expires. # +# A .conf that creates host state of its own (a `mktemp -d` fixture dir, a +# generated key) overrides the smoke_cleanup() function to remove it; the +# harness's EXIT trap calls it after removing the container, so acquisition and +# release live side by side in the .conf and every invocation - local or CI - +# leaves nothing behind. +# # The harness also sets $SMOKE_DIR (this script's own absolute directory) # before sourcing the .conf, so an app that needs a config/fixture file on disk # can bind-mount a committed fixture dir, e.g.: @@ -55,12 +61,13 @@ SMOKE_APP_NAME="" SMOKE_TIMEOUT="" SMOKE_RUN_ARGS="" SMOKE_LOG_PATTERN="" -# Initialised because both post-loop verdicts read it, and the wait loop's body is -# skippable: SMOKE_TIMEOUT="0" passes the non-negative-integer check above, so the -# deadline can already have passed at the first test and `status` would be unbound -# under set -u. An empty value reports honestly ("last status: ") instead of dying -# with an unbound-variable error that names nothing useful. -status="" +# Default app cleanup hook: a .conf that creates host state overrides it. Defined +# BEFORE the source so the EXIT trap can always call it, and so a .conf that +# creates nothing needs no boilerplate. +# shellcheck disable=SC2329 # invoked indirectly via the EXIT trap's cleanup() +smoke_cleanup() { + : +} CONF="$SMOKE_DIR/image-smoke.conf" if [ -f "$CONF" ]; then # shellcheck disable=SC1090 # per-app config path, resolved at runtime @@ -90,6 +97,9 @@ cleanup() { docker inspect --format '{{ if .State.Health }}{{ range .State.Health.Log }}exit={{ .ExitCode }}: {{ .Output }}{{ end }}{{ end }}' "$NAME" 2>/dev/null >&2 || true fi docker rm -f "$NAME" >/dev/null 2>&1 || true + # The app's own fixture teardown, after the container that consumed it is gone. + # Never allowed to change the run's verdict. + smoke_cleanup || true } trap cleanup EXIT @@ -99,6 +109,8 @@ docker run -d --name "$NAME" $SMOKE_RUN_ARGS "$IMG" >/dev/null start=$(date +%s) deadline=$((start + TIMEOUT)) +# Pre-set so both post-loop verdicts have a state to name: a SMOKE_TIMEOUT of 0 +# skips the loop body entirely. status=starting while [ "$(date +%s)" -lt "$deadline" ]; do # Fail fast on an early exit: poll .State.Running before the health status so