Commit Graph

75 Commits

Author SHA1 Message Date
nathannaveen
cac6194acd chore: Set permissions for GitHub actions
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: nathannaveen <42319948+nathannaveen@users.noreply.github.com>
2022-06-13 00:58:13 +00:00
Javi Martín
7015f41e3a Add kanban automation for new pull requests
So now, newly opened pull requests will automatically be added to the
"Reviewing" column, while newly opened draft pull requests will
automatically be added to the "Doing" column.

I've added the "reopened" event just in case (and was indeed very useful
while testing this feature), although we rarely reopen pull requests.

Note that this only works on pull requests that aren't already in the
project; that is, if a pull request is already in the "Doing" column,
closing it and reopening it will *not* move it to the "Reviewing
column".

So it looks like we won't easily be able to extend this feature in order
to automatically move pull requests when they're marked as ready for
review.
2022-06-08 15:49:03 +02:00
Javi Martín
a5eada79c0 Fix Pronto on Dependabot pull requests
As explained in "GitHub Actions: Workflows triggered by Dependabot PRs
will run with read-only permissions" [1], we need to consider Dependabot
pull requests as external pull requests.

[1] https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
2021-04-23 00:14:16 +02:00
taitus
9272873cf8 Fix checkout in Pronto on external pull requests
Since the target branch was in a different repository, the action failed
since it couldn't find the reference.

The code here is based on a recent change in Pronto [1] and with a comparison
between the repo.url property of pull_request.head and pull_request.base
to determine if the pull request was created from a forked repository

[1] https://github.com/prontolabs/pronto/commit/4fe28418b6
2021-04-21 16:39:07 +02:00
Senén Rodero Rodríguez
079fd829a3 Setup a workflow to check Dockerfile build
Based on https://docs.docker.com/ci-cd/github-actions/
2021-04-15 12:53:35 +02:00
Javi Martín
eb4ee891c4 Reduce tests timeout in GitHub Actions
Sometimes a test gets stuck and and we have to wait until it times out
in order to check which files were being tested at the time.

The default timeout is six hours. I'm reducing it to one hour which
should still be plenty of time even on repositories with no knapsack
token.
2021-04-07 14:41:06 +02:00
Javi Martín
45693e084b Integrate coveralls with github actions
Somehow I thought it worked automatically, but we had to provide the
token.

The configuration is based on Coveralls instructions to run parallel
builds [1].

Alternatively we could use the Coveralls GitHub Action [2] which
slightly simplifies the workflow configuration and removes the
dependency of the coveralls gem. However, it also adds a dependency on
simplecov-lcov and requires configuring it to renerate LCOV files on
each run, so the benefits of using it are not that big.

[1] https://docs.coveralls.io/parallel-build-webhook
[2] https://github.com/coverallsapp/github-action/
2021-04-02 20:33:23 +02:00
Javi Martín
a504921eca Upload screenshots of failures with GitHub Actions 2021-04-02 20:30:20 +02:00
Javi Martín
a8d6b9b330 Disable dependabot
Due to a bug in dependabot (see issue 2198 in the
`dependabot/dependabot-core` repository), Dependabot would open pull
requests on every fork, which would be inconvenient.

So we're disabling the updates until this issue is fixed; since we
currently have almost 50 open pull requests, it shouldn't affect us that
much.
2021-03-20 22:36:49 +01:00
dependabot-preview[bot]
f6bddcb32b Create Dependabot config file 2021-03-20 14:52:16 +00:00
Javi Martín
f9d04b07c1 Don't install ESLint for github actions
These lines were added when we were trying the pronto-eslint_npm gem,
which isn't maintained anymore and is not compatible with the latest
Pronto version.

Since we're now using the pronto-eslint gem, and this gem depends on the
eslintrb gem (which includes ESLint), we don't need these lines anymore.
2021-03-08 15:49:13 +01:00
Javi Martín
c6a90b266d Use Pronto to check code conventions
This way developers can run the checks on their machines and using
`bundle exec` we guarantee the right versions of all our gems are being
used; with Hound we can only use the versions supported by their
service.

When including the pronto-erb_lint gem, we're getting errors in
development where our ERB does not follow the conventions Better HTML
expects. Since we only use Better HTML because ERB Lint depends on it,
and right now we are not ready to follow its conventions, we're
disabling it.

Note pronto depends on rugged, which requires CMake and pkg-config to
build the `libgit2` library it depends on. CMake and pkg-config are
installed by default in some GNU/Linux distributions like Ubuntu, but
might not be installed on other systems, so we're adding them as
development dependencies.
2021-03-02 15:48:24 +01:00
Javi Martín
cb596a8163 Fix build status badge
As mentioned in the GitHub Actions documentation [1]

> Note: Referencing the workflow file using the file path does not work
  if the workflow has a name.

[1] https://docs.github.com/en/free-pro-team@latest/actions/managing-workflow-runs/adding-a-workflow-status-badge
2020-11-23 15:06:20 +01:00
Javi Martín
9c4d24d767 Use Knapscack Pro to run tests in parallel
Just like we used to do with Travis.

The configuration was taken from the Knapsack Pro documentation [1].

[1] https://docs.knapsackpro.com/2019/github-actions-ci-config-for-ruby-on-rails-project-with-mysql-redis-elasticsearch-how-to-run-parallel-tests
2020-11-23 14:00:36 +01:00
Javi Martín
375134ea04 Run the test suite using GitHub Actions
Using GitHub Actions has a few advantages over using Travis CI:

* More jobs can be run in parallel
* All CONSUL repositories on GitHub will be configured automatically

Besides, Travis have recently changed their policy twice. First, they
announced their site for free software projects would be shut down but
free software projects could still use their site for private projects.
And then, they limited the usage of their services for free software
projects.

Just like we used to do with Travis, we're enabling builds for pull
requests but not for pushed branches.

We're also building the master branch. Even if we never push to the
master branch directly, we're aware other CONSUL repositories do, so
we're running the tests for this case.
2020-11-23 14:00:33 +01:00
Javi Martín
6a5e5729dd Simplify pull request template 2018-12-07 13:57:32 +01:00
Arun Kumar
e4d5307c06 Add issue template 2018-07-04 02:50:16 -05:00
decabeza
24f0418ddf Updates pull resquest template 2018-06-08 15:10:21 +02:00
Bertocq
d0c7bae364 Improve Github's Pull Request Template file
The actual PR template feels more like bureaucracy than an actual guide
or checklist to help the PR author explain all important thigs that any
reviewer or changelog reader may need to understand.

We'll be moving most of the redundant things (like remembering tests are
needed, or explaning how things where implemented with a clear and
granular commit history) into a Wiki/Doc entry.

For regular contributors there is no need for reminders, we need to
improve new contributors landing with good guides and lowering the bar
for first PR's
2018-03-06 11:05:31 +01:00
Bertocq
9579a751ab Improve flaky issue template 2018-02-07 02:03:17 +01:00
Bertocq
b54b27da79 Add travis failed build link to flakie spec issue template 2018-02-06 13:12:24 +01:00
Bertocq
b39c1b5992 Recommend trying mobile viewport & screenshot on PR template 2018-02-03 18:30:14 +01:00
Bertocq
86b27b5bac Add github issue template for flaky specs 2018-02-03 14:47:54 +01:00
Bertocq
167df16567 Fix Github Pull Request template
Why:

* The template tried to specify a placeholder for the title, but instead it was used as first line in the description
* The template tried to specify a guide for each section with a `>` character to imply it was a comment, but people didn't remove it

How:

* Removing the first line specifying the title placeholder that has no use
* Changing the `>` character on each section guide for a `-` that can be easily reused for enumerations
2017-06-25 01:37:42 +02:00
Bertocq
e377314b52 Add .github/PULL_REQUEST_TEMPLATE file to be used as default template when manually creating a PR at github 2017-06-10 23:39:17 +02:00