From 92a3b5be2fffbb191f64ebc5585092a5c1cc6f39 Mon Sep 17 00:00:00 2001 From: Artur Stolear Date: Fri, 14 Aug 2026 11:15:42 +0200 Subject: [PATCH] build: use self-repository references --- .github/actionlint.yaml | 7 ++++++ .github/workflows/_artifacts_linux.yml | 4 +-- .github/workflows/_artifacts_windows.yml | 2 +- .github/workflows/_build.yml | 2 +- .github/workflows/_docker.yml | 13 ++++++---- .github/workflows/_docker_manifests.yml | 9 ++++--- .github/workflows/_prepare.yml | 2 +- .github/workflows/_publish.yml | 5 +++- .github/workflows/_unit_tests.yml | 2 +- .github/workflows/actionlint.yml | 2 ++ .github/workflows/ci.yml | 32 +++++++++++++----------- .github/workflows/docs.yml | 4 +-- 12 files changed, 52 insertions(+), 32 deletions(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000000..ec87cf74e1 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,7 @@ +paths: + .github/workflows/**/*.{yml,yaml}: + ignore: + # TODO: Remove when actionlint supports GitHub's $/ self-repository syntax. + # https://github.com/rhysd/actionlint/issues/711 + - 'reusable workflow call "\$/.+" at "uses" is not following the format' + - 'specifying action "\$/.+" in invalid format because ref is missing' diff --git a/.github/workflows/_artifacts_linux.yml b/.github/workflows/_artifacts_linux.yml index e3bdfad99a..d781b761b4 100644 --- a/.github/workflows/_artifacts_linux.yml +++ b/.github/workflows/_artifacts_linux.yml @@ -39,7 +39,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 name: Download nuget packages @@ -54,7 +54,7 @@ jobs: path: ${{ github.workspace }}/artifacts/packages/native - name: Set up Docker - uses: ./.github/actions/docker-setup + uses: $/.github/actions/docker-setup # NOSONAR -- $/ resolves to the running commit. # Run both backends concurrently in the same job (GitHub Actions parallel steps). # Each ArtifactsTest sub-test runs in ephemeral --rm containers, so the runs are independent. diff --git a/.github/workflows/_artifacts_windows.yml b/.github/workflows/_artifacts_windows.yml index 0f37de0f46..b23905891a 100644 --- a/.github/workflows/_artifacts_windows.yml +++ b/.github/workflows/_artifacts_windows.yml @@ -26,7 +26,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 name: Download nuget packages diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index a03c95d6b0..8267da2369 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -26,7 +26,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: '[Build]' shell: pwsh diff --git a/.github/workflows/_docker.yml b/.github/workflows/_docker.yml index 9dcf7eca89..95d0ab1a1e 100644 --- a/.github/workflows/_docker.yml +++ b/.github/workflows/_docker.yml @@ -16,6 +16,9 @@ on: publish_images: required: true type: boolean + secrets: + OP_SERVICE_ACCOUNT_TOKEN: + required: false env: DOTNET_INSTALL_DIR: "./.dotnet" @@ -45,7 +48,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 name: Download nuget packages @@ -54,14 +57,14 @@ jobs: path: ${{ github.workspace }}/artifacts/packages/nuget - name: Set up Docker - uses: ./.github/actions/docker-setup + uses: $/.github/actions/docker-setup # NOSONAR -- $/ resolves to the running commit. # Run both backends concurrently in the same job (GitHub Actions parallel steps). # Each uses an ephemeral --rm container, so the two runs don't interfere. - name: Docker Test (libgit2) if: success() && inputs.publish_images == false background: true - uses: ./.github/actions/docker-test + uses: $/.github/actions/docker-test # NOSONAR -- $/ resolves to the running commit. with: arch: ${{ inputs.arch }} docker_distro: ${{ matrix.docker_distro }} @@ -71,7 +74,7 @@ jobs: - name: Docker Test (managed) if: success() && inputs.publish_images == false background: true - uses: ./.github/actions/docker-test + uses: $/.github/actions/docker-test # NOSONAR -- $/ resolves to the running commit. with: arch: ${{ inputs.arch }} docker_distro: ${{ matrix.docker_distro }} @@ -90,7 +93,7 @@ jobs: - name: Docker Publish if: success() && inputs.publish_images - uses: ./.github/actions/docker-publish + uses: $/.github/actions/docker-publish # NOSONAR -- $/ resolves to the running commit. with: arch: ${{ inputs.arch }} docker_distro: ${{ matrix.docker_distro }} diff --git a/.github/workflows/_docker_manifests.yml b/.github/workflows/_docker_manifests.yml index 498827799d..e016838357 100644 --- a/.github/workflows/_docker_manifests.yml +++ b/.github/workflows/_docker_manifests.yml @@ -10,6 +10,9 @@ on: publish_manifests: required: true type: boolean + secrets: + OP_SERVICE_ACCOUNT_TOKEN: + required: false env: DOTNET_INSTALL_DIR: "./.dotnet" @@ -39,10 +42,10 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: Set up Docker - uses: ./.github/actions/docker-setup + uses: $/.github/actions/docker-setup # NOSONAR -- $/ resolves to the running commit. - name: Load DockerHub credentials if: inputs.publish_manifests @@ -52,7 +55,7 @@ jobs: op_service_account_token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - name: Docker Manifests - uses: ./.github/actions/docker-manifests + uses: $/.github/actions/docker-manifests # NOSONAR -- $/ resolves to the running commit. if: inputs.publish_manifests with: docker_distro: ${{ matrix.docker_distro }} diff --git a/.github/workflows/_prepare.yml b/.github/workflows/_prepare.yml index 339ce976f8..891160f001 100644 --- a/.github/workflows/_prepare.yml +++ b/.github/workflows/_prepare.yml @@ -73,7 +73,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: '[Matrix]' id: set_matrix diff --git a/.github/workflows/_publish.yml b/.github/workflows/_publish.yml index 643697a0db..6abed48ba2 100644 --- a/.github/workflows/_publish.yml +++ b/.github/workflows/_publish.yml @@ -4,6 +4,9 @@ on: publish_packages: required: true type: boolean + secrets: + OP_SERVICE_ACCOUNT_TOKEN: + required: false env: DOTNET_INSTALL_DIR: "./.dotnet" @@ -37,7 +40,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 name: Download nuget packages diff --git a/.github/workflows/_unit_tests.yml b/.github/workflows/_unit_tests.yml index 568caf01ae..58d5f19f23 100644 --- a/.github/workflows/_unit_tests.yml +++ b/.github/workflows/_unit_tests.yml @@ -40,7 +40,7 @@ jobs: with: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: '[Unit Test]' uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index c687eb2bb1..b78f5d2455 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -11,6 +11,7 @@ on: paths: - '.github/workflows/**' - '.github/actions/**' + - '.github/actionlint.yaml' pull_request: branches: @@ -20,6 +21,7 @@ on: paths: - '.github/workflows/**' - '.github/actions/**' + - '.github/actionlint.yaml' permissions: contents: read diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bdc5ba3d7c..e116313f5f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -44,7 +44,7 @@ jobs: name: Prepare permissions: contents: read - uses: ./.github/workflows/_prepare.yml + uses: $/.github/workflows/_prepare.yml # NOSONAR -- $/ resolves to the running commit. publish_flags: name: Publish Flags @@ -69,7 +69,7 @@ jobs: needs: [ prepare ] permissions: contents: read - uses: ./.github/workflows/_build.yml + uses: $/.github/workflows/_build.yml # NOSONAR -- $/ resolves to the running commit. unit_test: name: Test @@ -77,18 +77,17 @@ jobs: permissions: contents: read id-token: write - uses: ./.github/workflows/_unit_tests.yml + uses: $/.github/workflows/_unit_tests.yml # NOSONAR -- $/ resolves to the running commit. with: dotnet_versions: ${{ needs.prepare.outputs.dotnet_versions }} publish_coverage: ${{ fromJson(needs.publish_flags.outputs.can_publish) }} - secrets: inherit artifacts_windows_test: name: Artifacts Windows needs: [ build ] permissions: contents: read - uses: ./.github/workflows/_artifacts_windows.yml + uses: $/.github/workflows/_artifacts_windows.yml # NOSONAR -- $/ resolves to the running commit. artifacts_linux_test: needs: [ prepare, build ] @@ -103,7 +102,7 @@ jobs: runner: ubuntu-24.04 - arch: arm64 runner: ubuntu-24.04-arm - uses: ./.github/workflows/_artifacts_linux.yml + uses: $/.github/workflows/_artifacts_linux.yml # NOSONAR -- $/ resolves to the running commit. with: runner: ${{ matrix.runner }} arch: ${{ matrix.arch }} @@ -125,14 +124,15 @@ jobs: - arch: arm64 runner: ubuntu-24.04-arm - uses: ./.github/workflows/_docker.yml + uses: $/.github/workflows/_docker.yml # NOSONAR -- $/ resolves to the running commit. with: runner: ${{ matrix.runner }} arch: ${{ matrix.arch }} docker_distros: ${{ needs.prepare.outputs.docker_distros }} dotnet_versions: ${{ needs.prepare.outputs.dotnet_versions }} publish_images: ${{ fromJson(needs.publish_flags.outputs.can_publish) }} - secrets: inherit + secrets: + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} docker_linux_manifests: needs: [ prepare, docker_linux_images, publish_flags ] @@ -140,12 +140,13 @@ jobs: permissions: contents: read packages: write - uses: ./.github/workflows/_docker_manifests.yml + uses: $/.github/workflows/_docker_manifests.yml # NOSONAR -- $/ resolves to the running commit. with: docker_distros: ${{ needs.prepare.outputs.docker_distros }} dotnet_versions: ${{ needs.prepare.outputs.dotnet_versions }} publish_manifests: ${{ fromJson(needs.publish_flags.outputs.can_publish) }} - secrets: inherit + secrets: + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} publish: name: Publish @@ -154,10 +155,11 @@ jobs: contents: read id-token: write packages: write - uses: ./.github/workflows/_publish.yml + uses: $/.github/workflows/_publish.yml # NOSONAR -- $/ resolves to the running commit. with: publish_packages: ${{ fromJson(needs.publish_flags.outputs.can_publish) }} - secrets: inherit + secrets: + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} release: name: Release @@ -184,14 +186,14 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: Restore Artifacts - uses: ./.github/actions/artifacts-restore + uses: $/.github/actions/artifacts-restore # NOSONAR -- $/ resolves to the running commit. - name: Attestation if: env.CAN_PUBLISH == 'true' - uses: ./.github/actions/artifacts-attest + uses: $/.github/actions/artifacts-attest # NOSONAR -- $/ resolves to the running commit. - name: Load DockerHub credentials id: dockerhub-creds diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index ca0ceeeb66..eb25016956 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -91,7 +91,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: Get npm cache directory shell: bash @@ -152,7 +152,7 @@ jobs: fetch-depth: 0 - name: Restore State - uses: ./.github/actions/cache-restore + uses: $/.github/actions/cache-restore # NOSONAR -- $/ resolves to the running commit. - name: Get npm cache directory shell: bash