chore(ci): CI/release hygiene batch (Dependabot, CODEOWNERS, SECURITY.md, concurrency, action pinning)#350
Open
hampsterx wants to merge 6 commits intofloci-io:mainfrom
Open
chore(ci): CI/release hygiene batch (Dependabot, CODEOWNERS, SECURITY.md, concurrency, action pinning)#350hampsterx wants to merge 6 commits intofloci-io:mainfrom
hampsterx wants to merge 6 commits intofloci-io:mainfrom
Conversation
Commit 494cff2 ("chore: release 1.5.2") moved .github/workflows/semver.yml to .github/semver.yml as part of a manual version bump, which silently disabled semantic-release. GitHub Actions only picks up workflow files under .github/workflows/. Every merge to main since 1.5.2 has lacked CHANGELOG.md coverage because no bot ran. Also add `main` to the branches list in .releaserc.json and the workflow push trigger so semantic-release actually runs on main going forward. Work has been landing directly on main and needs a corresponding release path. The next run will generate CHANGELOG entries for everything merged since 1.5.2 and emit a new tag (likely 1.6.0, driven by the `feat:` appconfig commit in the backlog).
Weekly Dependabot updates for the Maven and GitHub Actions ecosystems. Minor/patch updates are grouped into a single PR per ecosystem to keep review noise low, majors still land as individual PRs so breaking changes get surfaced on their own.
Scopes .github/, .releaserc.json, and the Dockerfiles to @hectorvent so any change to CI, release automation, or the container build surface always pings the maintainer for review. Other paths are left unscoped and fall through to the repo's normal review rules.
Adds a root-level security policy so GitHub's Security tab exposes the private vulnerability reporting flow and supported-versions UI. The content mirrors the existing "Reporting Security Issues" section in CONTRIBUTING.md and links back to it to avoid drift.
Adds a concurrency block to every workflow and a timeout-minutes to every
job. Previously only the compatibility matrix had a timeout, so a stuck
job in ci/edge/release/semver could burn the full 6h runner budget
before GitHub killed it.
- ci, compatibility, docs, edge: cancel-in-progress on
workflow+ref, so pushing a new commit to a branch cancels the prior
PR run instead of letting both finish.
- release: per-tag group (workflow+ref), so back-to-back tag pushes
(e.g. 1.5.3 and 1.6.0 landing minutes apart) run in parallel rather
than cancelling each other. Re-runs of the same tag still supersede.
- semver: semver-${ref} group, so racing version bumps on main
serialize rather than both trying to tag and push back.
Timeouts are sized above current observed runtimes (native builds
~15min, JVM builds ~3min) with headroom for transient slowdowns.
Pins every third-party GitHub Action to a full commit SHA with the original version tag preserved in a trailing comment. Actions maintained by GitHub itself (actions/checkout, actions/setup-java, actions/setup-python, actions/upload-artifact, actions/download-artifact) are intentionally left on version tags because the risk/effort trade-off is different. Pins: - cycjimmy/semantic-release-action v4.2.2 (semver.yml) - docker/build-push-action v6 (compatibility, edge, release) - docker/login-action v3 (edge, release) - docker/setup-buildx-action v3 (compatibility, edge, release) - test-summary/action v2 (compatibility) - graalvm/setup-graalvm v1 (release) Closes a supply-chain risk where a compromised or retagged third-party action could silently execute new code in a privileged workflow (release and semver both hold secrets). Dependabot's github-actions ecosystem updates SHA-pinned actions automatically, so this doesn't create manual upgrade work.
hectorvent
reviewed
Apr 11, 2026
| on: | ||
| push: | ||
| branches: | ||
| - 'main' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Batch of low-risk CI/release hygiene improvements surfaced during a second-opinion scan with Codex and Gemini. Each commit stands alone and can be cherry-picked if any item draws pushback.
Changes (5 commits)
1. Dependabot config (
.github/dependabot.yml)Weekly updates for Maven and GitHub Actions ecosystems. Patch/minor updates grouped per ecosystem to reduce PR noise, majors still land individually so breaking changes get surfaced on their own. No Docker base image scanning (can be added later).
2. CODEOWNERS (
.github/CODEOWNERS)Scopes
.github/**,.releaserc.json,/pom.xml, and the Dockerfiles to@hectorventso any change to CI, release automation, or the container build surface always pings the maintainer for review. No global owner, so the rest of the tree falls through to normal review rules. Expand with more owners as the maintainer roster grows.3. SECURITY.md (root)
Surfaces the existing "Reporting Security Issues" section from
CONTRIBUTING.mdat the repo root so GitHub's Security tab exposes the policy UI and private vulnerability reporting flow. Supported-versions wording is deliberately unpinned ("current stable release line") so it doesn't drift as new minors land.4. Concurrency groups and timeouts (all workflows)
Adds
concurrencyblocks to every workflow andtimeout-minutesto every job. Currently only the compatibility matrix has a timeout, so a stuck job in ci/edge/release/semver could burn up to 6h of runner time before GitHub kills it.ci,compatibility,docs,edge: per-workflow+ref group withcancel-in-progress: true, so pushing a new commit to a branch cancels the prior PR run instead of letting both finish.release: per-tag group (workflow+ref), so back-to-back tag pushes (e.g.1.5.3and1.6.0landing minutes apart) run in parallel rather than cancelling each other. Re-runs of the same tag still supersede.semver:semver-${ref}static-prefixed group on the ref, so racing version bumps on main serialize rather than both trying to tag and push back.Timeouts sized above current observed runtimes (native builds ~15min, JVM builds ~3min) with headroom for transient slowdowns.
5. Pin third-party actions to SHAs
Pins every third-party GitHub Action to an immutable commit SHA with the original version tag preserved as a trailing comment:
cycjimmy/semantic-release-action@16ca923e6ccbb50770c415a0ccd43709a8c5f7a4(v4.2.2)docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8(v6)docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9(v3)docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f(v3)test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86(v2)graalvm/setup-graalvm@60c26726de13f8b90771df4bc1641a52a3159994(v1)actions/*(checkout, setup-java, setup-python, upload-artifact, download-artifact) are intentionally left on version tags. They are maintained by GitHub itself, have a much smaller attack surface than third-party marketplace actions, and the dependabotgithub-actionsecosystem will keep SHA-pinned third-party actions current automatically. Happy to pin them too if the maintainer prefers consistent hygiene.Not included
These came up in the scan but are M-effort tool/policy choices the maintainer should decide on rather than having forced on them in a drive-by PR:
Happy to open these as separate issues if there's interest.
Review passes done locally
fix/restore-semantic-release): flagged SECURITY.md email fallback (no address) and hardcoded1.5.xversion. Both addressed before opening this PR. Confirmed release-tag concurrency semantics correct.fix/restore-semantic-release): flagged missingpom.xmlin CODEOWNERS and missing SECURITY.md email address. Both addressed. Verified all six pinned SHAs against upstream tags and confirmed they match.Test plan
.github/workflows/ci.ymlis touched, so this may no-op, which is expected)semver.yml, verify the new concurrency group serializes correctly and the pinnedcycjimmy/semantic-release-actionSHA is picked up@hectorvent