diff --git a/.github/workflows/openaev-auto-label.yml b/.github/workflows/openaev-auto-label.yml new file mode 100644 index 00000000..b20f7aae --- /dev/null +++ b/.github/workflows/openaev-auto-label.yml @@ -0,0 +1,14 @@ +name: "[OpenAEV] Auto Label" +on: + pull_request: + branches: [main, release/current] + types: [opened, reopened] +permissions: + contents: read + pull-requests: write +jobs: + auto-label: + runs-on: ubuntu-latest + steps: + - name: "Auto Label" + uses: FiligranHQ/filigran-ci-tools/actions/auto-label@main diff --git a/.github/workflows/openaev-check-signed-commit.yml b/.github/workflows/openaev-check-signed-commit.yml new file mode 100644 index 00000000..4903484e --- /dev/null +++ b/.github/workflows/openaev-check-signed-commit.yml @@ -0,0 +1,13 @@ +name: "[OpenAEV] Check Signed Commits in PR" +on: + pull_request_target: + branches: [main, release/current] +permissions: + contents: read + pull-requests: write +jobs: + check-signed-commits: + runs-on: ubuntu-latest + steps: + - name: Check signed commits in PR + uses: FiligranHQ/filigran-ci-tools/actions/check-signed-commit@main diff --git a/.github/workflows/openaev-validate-pr-title.yml b/.github/workflows/openaev-validate-pr-title.yml new file mode 100644 index 00000000..b6cc0d01 --- /dev/null +++ b/.github/workflows/openaev-validate-pr-title.yml @@ -0,0 +1,20 @@ + name: "[OpenAEV] Validate PR title Worker" + on: + pull_request: + branches: [main, release/current] + types: [opened, edited, reopened, ready_for_review, synchronize] + jobs: + validate-pr-title: + runs-on: ubuntu-latest + steps: + - name: "Generate a token" + id: generate-token + if: github.event.pull_request.head.repo.full_name == github.repository + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.OPENAEV_PR_CHECKS_APP_ID }} + private-key: ${{ secrets.OPENAEV_PR_CHECKS_PRIVATE_KEY }} + - name: "Validate PR title and create check" + uses: FiligranHQ/filigran-ci-tools/actions/pr-title-check@main + with: + token: ${{ steps.generate-token.outputs.token }} diff --git a/.github/workflows/validate-pr-title.yml b/.github/workflows/validate-pr-title.yml deleted file mode 100644 index f9160265..00000000 --- a/.github/workflows/validate-pr-title.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: "Validate PR Title" - -on: - pull_request: - types: [ opened, edited, reopened, ready_for_review, synchronize ] - -jobs: - validate-pr-title: - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - - steps: - - name: Check PR title format - shell: bash - run: | - TITLE="${{ github.event.pull_request.title }}" - echo "PR title: $TITLE" - - # Regex for: - # [category/subcategory] type(scope?): description (#123?) - PATTERN='^\[([a-z]+(/[a-z]+)*)\] (feat|fix|chore|docs|style|refactor|perf|test|build|ci|revert)(\([a-z]+\))?: [a-z].*( \(#[0-9]+\))$' - - if [[ ! "$TITLE" =~ $PATTERN ]]; then - echo "❌ Invalid PR title." - echo "Required format:" - echo "[category] type(scope?): description (#123)" - exit 1 - fi - - echo "✅ PR title is valid." \ No newline at end of file diff --git a/renovate.json b/renovate.json index e1d1c913..32cfd97f 100644 --- a/renovate.json +++ b/renovate.json @@ -1,34 +1,31 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "config:recommended" + "config:recommended", + "docker:enableMajor" ], "labels": [ "dependencies", "filigran team" ], - "prConcurrentLimit": 2, - "baseBranches": ["release/current", "main"], + "minimumReleaseAge": "3 days", + "prHourlyLimit": 2, + "prConcurrentLimit": 20, + "timezone": "Europe/Paris", + "schedule": [ + "* 0-4,22-23 * * 1-5", + "* * * * 0,6" + ], + "updateNotScheduled": false, + "rebaseWhen": "conflicted", + "commitMessageAction": "update", + "commitMessagePrefix": "[tool] chore(deps):", "packageRules": [ { - "matchUpdateTypes": [ - "minor" + "matchPaths": [ + "*/**" ], - "prPriority": 5 - }, - { - "matchBaseBranches": ["release/current"], - "commitMessageSuffix": null - }, - { - "matchJsonata": ["$exists(isVulnerabilityAlert)"], - "matchBaseBranches": ["release/current"], - "enabled": false - }, - { - "matchJsonata": ["$not($exists(isVulnerabilityAlert))"], - "matchBaseBranches": ["main"], - "enabled": false + "commitMessagePrefix": "[injectors] chore(deps):" } ] -} +} \ No newline at end of file