From 317c26eec0c55732f4d2008ecf3303066615b4c2 Mon Sep 17 00:00:00 2001 From: Teakowa Date: Sun, 25 Oct 2026 06:32:34 +0800 Subject: [PATCH 1/2] ci: enforce release-job timeouts and add workflow lint Add timeout-minutes to the release-plz-crates release and release-pr jobs per the rust-ci rule, and add an actionlint workflow usable both as this repository's self-check and as a reusable workflow for callers. The self-check surfaced two pre-existing errors in release-plz-crates.yml: remove the invalid `concurrency.queue` key (job-level concurrency only accepts group and cancel-in-progress; `cancel-in-progress: false` already serializes the runs) and declare `CARGO_REGISTRY_TOKEN` so the release-environment fallback resolves under workflow_call. State in ci-platform.md that GitHub-owned actions/* also fall under the third-party full-SHA pin mandate, since their tags move the same way. Refs #124 --- .github/workflows/actionlint.yml | 26 ++++++++++++++++++++++++ .github/workflows/release-plz-crates.yml | 6 +++++- docs/ci-platform.md | 3 ++- 3 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/actionlint.yml diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml new file mode 100644 index 0000000..6b4aed2 --- /dev/null +++ b/.github/workflows/actionlint.yml @@ -0,0 +1,26 @@ +name: Actionlint + +on: + workflow_call: + push: + branches: ["main"] + paths: + - ".github/workflows/**" + pull_request: + branches: ["main"] + paths: + - ".github/workflows/**" + +jobs: + actionlint: + name: Lint workflows + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Run actionlint + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 diff --git a/.github/workflows/release-plz-crates.yml b/.github/workflows/release-plz-crates.yml index 14aca24..93b2bcc 100644 --- a/.github/workflows/release-plz-crates.yml +++ b/.github/workflows/release-plz-crates.yml @@ -16,6 +16,9 @@ on: cargo-registry-token: description: Optional crates.io token passed by callers without a release environment secret required: false + CARGO_REGISTRY_TOKEN: + description: Crates.io token resolved from the release environment when the caller does not pass one + required: false jobs: package-preflight: @@ -43,11 +46,11 @@ jobs: releases: ${{ steps.release-plz.outputs.releases }} releases_created: ${{ steps.release-plz.outputs.releases_created }} runs-on: ubuntu-latest + timeout-minutes: 30 environment: release concurrency: group: wrightkit-release-plz-publication cancel-in-progress: false - queue: max permissions: contents: write pull-requests: read @@ -74,6 +77,7 @@ jobs: if: github.repository_owner == 'wrightkit' needs: release runs-on: ubuntu-latest + timeout-minutes: 30 concurrency: group: wrightkit-release-plz-pr-${{ github.ref }} cancel-in-progress: false diff --git a/docs/ci-platform.md b/docs/ci-platform.md index 7e8cf3b..af9ae0d 100644 --- a/docs/ci-platform.md +++ b/docs/ci-platform.md @@ -24,7 +24,8 @@ change reaches every repository without a pin bump; the workflow's inputs and outputs are the compatibility surface, and a breaking change updates its callers in the same rollout. Every third-party action is pinned to a full commit SHA, because it runs with the caller's credentials and a moved tag or branch would -change what executes without a review. +change what executes without a review. GitHub-owned `actions/*` actions count +as third-party for this mandate: their tags move the same way. Callers pass only declared inputs and explicitly named secrets; they must not use arbitrary command hooks or `secrets: inherit` for the crate release workflow. From acba018c239dc38be5beda03effd94192a4c9f7e Mon Sep 17 00:00:00 2001 From: Teakowa Date: Sun, 25 Oct 2026 06:40:40 +0800 Subject: [PATCH 2/2] ci: clarify CARGO_REGISTRY_TOKEN precedence in the declared secret --- .github/workflows/release-plz-crates.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-plz-crates.yml b/.github/workflows/release-plz-crates.yml index 93b2bcc..19bfa1a 100644 --- a/.github/workflows/release-plz-crates.yml +++ b/.github/workflows/release-plz-crates.yml @@ -17,7 +17,7 @@ on: description: Optional crates.io token passed by callers without a release environment secret required: false CARGO_REGISTRY_TOKEN: - description: Crates.io token resolved from the release environment when the caller does not pass one + description: Crates.io token resolved from the release environment, preferred over cargo-registry-token required: false jobs: