From aee71164364d0149cb75056fb4c7051729ed44b4 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 11:59:36 -0500 Subject: [PATCH 1/5] chore: upgrade actions to Node 24 runtime (SHA-pinned) --- .github/workflows/feature-branch.yml | 10 +++++----- .github/workflows/validate-codeowners.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/feature-branch.yml b/.github/workflows/feature-branch.yml index 6ebbbc6..b2b38fd 100644 --- a/.github/workflows/feature-branch.yml +++ b/.github/workflows/feature-branch.yml @@ -32,24 +32,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod - name: Test Snapshot Release - uses: goreleaser/goreleaser-action@v5 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: distribution: goreleaser version: latest args: release --config ./dev.goreleaser.yaml --clean --snapshot - name: Upload Test Release Assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: github-status-updater path: dist/* @@ -59,7 +59,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code at current commit" - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build id: build diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index cc1e159..3b742ba 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code at current commit" - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: mszostok/codeowners-validator@v0.7.1 if: github.event.pull_request.head.repo.full_name == github.repository name: "Full check of CODEOWNERS" From 6adbad39ecad4b8dd32d03ead8e1910ff0881cca Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:38:24 -0500 Subject: [PATCH 2/5] fix: migrate dev.goreleaser.yaml to GoReleaser v2 config schema --- dev.goreleaser.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dev.goreleaser.yaml b/dev.goreleaser.yaml index ea08b30..9d49af4 100644 --- a/dev.goreleaser.yaml +++ b/dev.goreleaser.yaml @@ -1,3 +1,5 @@ +version: 2 + builds: - env: # goreleaser does not work with CGO, it could also complicate @@ -24,7 +26,7 @@ builds: - '-s -w' archives: - - format: binary + - formats: [binary] name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}' checksum: @@ -36,4 +38,4 @@ release: # draft: true changelog: - skip: true \ No newline at end of file + disable: true From efc17cdaa9d3240f8d58a1e9415365df6565dfda Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:38:24 -0500 Subject: [PATCH 3/5] fix: use shared codeowners workflow for org team validation --- .github/workflows/validate-codeowners.yml | 30 ++++++----------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml index 3b742ba..b9272b7 100644 --- a/.github/workflows/validate-codeowners.yml +++ b/.github/workflows/validate-codeowners.yml @@ -4,26 +4,12 @@ on: pull_request: +permissions: + contents: read + jobs: - validate-codeowners: - runs-on: ubuntu-latest - steps: - - name: "Checkout source code at current commit" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: mszostok/codeowners-validator@v0.7.1 - if: github.event.pull_request.head.repo.full_name == github.repository - name: "Full check of CODEOWNERS" - with: - # For now, remove "files" check to allow CODEOWNERS to specify non-existent - # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos - # checks: "files,syntax,owners,duppatterns" - checks: "syntax,owners,duppatterns" - owner_checker_allow_unowned_patterns: "false" - # GitHub access token is required only if the `owners` check is enabled - github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" - - uses: mszostok/codeowners-validator@v0.7.1 - if: github.event.pull_request.head.repo.full_name != github.repository - name: "Syntax check of CODEOWNERS" - with: - checks: "syntax,duppatterns" - owner_checker_allow_unowned_patterns: "false" + ci-codeowners: + uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main + with: + is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + secrets: inherit From dd5d95f78e0c1edacb4f06fcbe85c43cbe6e1e70 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:44:49 -0500 Subject: [PATCH 4/5] fix: bump docker-build-push to v3 (SHA-pinned) The 1.15.1 composite's metadata step has a shell syntax error that breaks ci-docker on every branch; v3 fixes it and the inputs in use (registry/organization/repository/login/password/platforms) are unchanged. --- .github/workflows/feature-branch.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/feature-branch.yml b/.github/workflows/feature-branch.yml index b2b38fd..b090390 100644 --- a/.github/workflows/feature-branch.yml +++ b/.github/workflows/feature-branch.yml @@ -63,7 +63,7 @@ jobs: - name: Build id: build - uses: cloudposse/github-action-docker-build-push@1.15.1 + uses: cloudposse/github-action-docker-build-push@02993d675b44dcc7082e6de7485c1ff8740bce9d # v3.1.0 with: registry: ghcr.io organization: "${{ github.event.repository.owner.login }}" From 95186cfa81a133b41c6a7e9fafae3475cbbbb0d6 Mon Sep 17 00:00:00 2001 From: "John C. Bland II" Date: Thu, 13 Aug 2026 12:49:00 -0500 Subject: [PATCH 5/5] fix: disable docker-build-push summary (null-CMD jq bug upstream) --- .github/workflows/feature-branch.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/feature-branch.yml b/.github/workflows/feature-branch.yml index b090390..f6557af 100644 --- a/.github/workflows/feature-branch.yml +++ b/.github/workflows/feature-branch.yml @@ -65,6 +65,8 @@ jobs: id: build uses: cloudposse/github-action-docker-build-push@02993d675b44dcc7082e6de7485c1ff8740bce9d # v3.1.0 with: + # v3's step-summary generation fails on images without a CMD (jq join on null); disable until fixed upstream + summary: "false" registry: ghcr.io organization: "${{ github.event.repository.owner.login }}" repository: "${{ github.event.repository.name }}"