Propagate changes from main into development - #1294
Merged
Merged
Conversation
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Jeremy <jhatfield82@gmail.com>
The repo's default branch is development, but release-please-action defaults its target-branch input to the repository default branch via the API regardless of which branch the push trigger fired on. Since release-please-config.json/.release-please-manifest.json only exist on main (by design), the action was looking for them on development and failing with "Missing required manifest config."
Lets a human manually re-fire branch propagation (main -> development) when the workflow_run trigger doesn't fire on its own, without needing to re-run the upstream Docker Build workflow. The job's `if:` condition is extended to admit workflow_dispatch runs, since github.event.workflow_run is unset in that context.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Resolves PR #1281 conflicts. Toolchain/CI pin conflicts took nightly's newer values (Go 1.27.0, GOTOOLCHAIN auto, codeql-action v4.37.8, semgrep 1.174.0); release-please-manifest.json took main's bot-owned 0.37.2. Lockfiles (go.sum, package-lock.json) regenerated via `go mod tidy` / `npm install` rather than hand-merged.
Drop bump-patch-for-minor-pre-major so pre-1.0 versioning follows normal semver: feat -> minor, fix -> patch. bump-minor-pre-major is kept so a stray breaking-change commit (e.g. a dependency bump) only lands a minor rather than forcing a major; major bumps stay a deliberate manual action. Claude-Session: https://claude.ai/code/session_01XfkhuRWYYhzp3fYJfckeYm
The integration-test and security-scan workflows each rebuilt the full multi-stage Docker image from scratch on every run with no caching, on ephemeral runners. A recent development merge (Go 1.27 + dependency bumps) pushed the cold build past crowdsec-integration.yml's 15-minute job timeout (Actions run 33391516355); the same workflow passed in 6-9 minutes days earlier. Add a shared .github/actions/build-charon-image composite action that builds via Buildx with GitHub Actions layer cache (type=gha), loading charon:local for the downstream test/scan steps. caddy-builder and crowdsec-builder stay uncached (no-cache-filters) so the CVE-patched dependency stages always resolve fresh, matching docker-build.yml and e2e-tests-split.yml; every other stage is now layer-cached. - crowdsec / cerberus / rate-limit / waf integration workflows use it - security-pr.yml and supply-chain-pr.yml use it for their local builds, preserving their existing conditions and step outputs - bump the three 15m integration timeouts to 20m as cold-cache insurance - replace stale "build once, test many" header comments that no longer described these locally-building workflows Claude-Session: https://claude.ai/code/session_01HV8H7d9XQpEo9njKq5B33s
Wikid82
marked this pull request as ready for review
August 31, 2026 17:02
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
Author
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
Follow-up to 7627a64. Two problems surfaced on the first runs: 1. build-charon-image forced caddy-builder / crowdsec-builder to rebuild every run (no-cache-filters), copied from docker-build.yml. Those are the most expensive stages, so warm-cache runs saved little and the Trivy Binary Scan job (security-pr.yml) still blew its cap (Actions run 33417073118, cancelled at 10m). None of this action's callers publish a released artifact and the scan jobs read the built binary/filesystem/SBOM against a scan-time DB, so caching those layers cannot hide a CVE in a pinned dep. Default no-cache-filters to empty so every stage is GHA layer-cached. 2. security-pr.yml (10m) and supply-chain-pr.yml (15m) kept their old caps, which never fit a cold image build. Bump both to 20m, matching the integration workflows, as cold-cache headroom. Claude-Session: https://claude.ai/code/session_01HV8H7d9XQpEo9njKq5B33s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.github/skills/examples/gorm-scanner-ci-workflow.ymlAutomated PR to propagate changes from main into development.
Triggered by push to main.