Skip to content

Commit d4b8d3d

Browse files
aviralgarg05aviralgarg05
authored
ci: make DCO advisory and run workflows on PR synchronize (#123)
* ci: make DCO advisory and run workflows on PR synchronize - convert DCO check to advisory non-blocking mode - add/align synchronize triggers for PR workflows - add PR-safe validation jobs for release/stale/reminder flows * ci: make PR docker validation non-blocking
1 parent 05fe9c3 commit d4b8d3d

11 files changed

Lines changed: 107 additions & 11 deletions

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
push:
55
branches: [main]
66
pull_request:
7+
types: [opened, reopened, synchronize]
78
branches: [main]
89

910
permissions:

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
push:
55
branches: [main]
66
pull_request:
7+
types: [opened, reopened, synchronize]
78
branches: [main]
89
schedule:
910
- cron: "0 0 * * 1" # Weekly on Monday

‎.github/workflows/dco.yml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: DCO Check
22

33
on:
44
pull_request:
5+
types: [opened, reopened, synchronize, edited]
56
branches: [main]
67

78
permissions:
@@ -17,20 +18,32 @@ jobs:
1718
- uses: actions/checkout@v4
1819
with:
1920
fetch-depth: 0
20-
- name: Check DCO Sign-off
21+
- name: Check DCO Sign-off (non-blocking)
2122
run: |
2223
commits=$(git log --format='%H %s' origin/${{ github.base_ref }}..HEAD)
2324
failed=0
25+
missing=""
2426
while IFS= read -r line; do
27+
[ -z "$line" ] && continue
2528
hash=$(echo "$line" | awk '{print $1}')
2629
msg=$(git log -1 --format='%B' "$hash")
2730
if ! echo "$msg" | grep -q "Signed-off-by:"; then
28-
echo "Missing Signed-off-by in commit: $hash"
31+
echo "::warning::Missing Signed-off-by in commit: $hash"
32+
missing="${missing}"$'\n'"- ${hash}"
2933
failed=1
3034
fi
3135
done <<< "$commits"
3236
if [ $failed -eq 1 ]; then
33-
echo "DCO check failed. Please sign off your commits with 'git commit -s'"
34-
exit 1
37+
echo "DCO sign-off missing in one or more commits."
38+
echo "For now this check is advisory; recommended fix: rebase and use 'git commit -s'."
39+
{
40+
echo "### DCO Advisory"
41+
echo "Missing sign-off commits detected:${missing}"
42+
echo ""
43+
echo "Recommended fix:"
44+
echo "- Rebase your branch and amend commits with: \`git commit --amend -s\`"
45+
echo "- For multiple commits use interactive rebase and sign each commit."
46+
} >> "$GITHUB_STEP_SUMMARY"
47+
exit 0
3548
fi
3649
echo "All commits have DCO sign-off"

‎.github/workflows/dependency-review.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: "Dependency Review"
22

33
on:
44
pull_request:
5+
types: [opened, reopened, synchronize]
56
branches: [main]
67

78
permissions:

‎.github/workflows/docker-release.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Build and Release Docker Image
33
on:
44
release:
55
types: [created]
6+
pull_request:
7+
types: [opened, reopened, synchronize]
8+
branches: [main]
69

710
jobs:
811
build:
@@ -15,16 +18,19 @@ jobs:
1518
uses: docker/setup-buildx-action@v3
1619

1720
- name: Docker Hub account login
21+
if: github.event_name == 'release'
1822
uses: docker/login-action@v3
1923
with:
2024
username: ${{ secrets.DOCKERHUB_USERNAME }}
2125
password: ${{ secrets.DOCKERHUB_TOKEN }}
2226

2327
- name: Extract release tag
28+
if: github.event_name == 'release'
2429
id: meta
2530
run: echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
2631

2732
- name: Build and push Docker image
33+
if: github.event_name == 'release'
2834
uses: docker/build-push-action@v6
2935
with:
3036
context: .
@@ -36,3 +42,12 @@ jobs:
3642
${{ secrets.DOCKERHUB_USERNAME }}/nexumdb:${{ github.sha }}
3743
cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/nexumdb:buildcache
3844
cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/nexumdb:buildcache,mode=max
45+
46+
- name: PR Docker build validation
47+
if: github.event_name == 'pull_request'
48+
continue-on-error: true
49+
uses: docker/build-push-action@v6
50+
with:
51+
context: .
52+
file: Dockerfile
53+
push: false

‎.github/workflows/pr-commenter.yml‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: PR Auto Commenter
22

33
on:
44
pull_request:
5-
types: [opened, reopened]
5+
types: [opened, reopened, synchronize]
66

77
permissions:
88
pull-requests: write
@@ -34,7 +34,10 @@ jobs:
3434
const hasCIChanges = changedFiles.some(f => f.startsWith('.github/workflows/'));
3535
const hasTestChanges = changedFiles.some(f => f.includes('test'));
3636
37-
let comment = `## Thank you for your contribution, @${prAuthor}!\n\n`;
37+
const marker = '<!-- nexum-pr-auto-comment -->';
38+
39+
let comment = `${marker}\n`;
40+
comment += `## Thank you for your contribution, @${prAuthor}!\n\n`;
3841
comment += `### PR Analysis\n\n`;
3942
comment += `**Files Changed:** ${files.length}\n`;
4043
comment += `**Components:**\n`;
@@ -75,9 +78,29 @@ jobs:
7578
comment += `**Tip:** CodeRabbit will automatically review your PR. Address any feedback before requesting human review.\n`;
7679
comment += `New to contributing? Check out [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md) for guidelines.\n`;
7780
78-
await github.rest.issues.createComment({
81+
const { data: comments } = await github.rest.issues.listComments({
7982
owner: context.repo.owner,
8083
repo: context.repo.repo,
8184
issue_number: prNumber,
82-
body: comment
85+
per_page: 100
8386
});
87+
88+
const existing = comments.find(c =>
89+
c.user.type === 'Bot' && c.body && c.body.includes(marker)
90+
);
91+
92+
if (existing) {
93+
await github.rest.issues.updateComment({
94+
owner: context.repo.owner,
95+
repo: context.repo.repo,
96+
comment_id: existing.id,
97+
body: comment
98+
});
99+
} else {
100+
await github.rest.issues.createComment({
101+
owner: context.repo.owner,
102+
repo: context.repo.repo,
103+
issue_number: prNumber,
104+
body: comment
105+
});
106+
}

‎.github/workflows/pr-review-reminder.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
name: PR Review Reminder
22

33
on:
4+
pull_request:
5+
types: [opened, reopened, synchronize]
6+
branches: [main]
47
schedule:
58
# Run every 6 hours
69
- cron: '0 */6 * * *'
@@ -11,8 +14,16 @@ permissions:
1114
contents: read
1215

1316
jobs:
17+
pr-sync-check:
18+
runs-on: ubuntu-latest
19+
if: github.event_name == 'pull_request'
20+
steps:
21+
- name: PR sync trigger acknowledged
22+
run: echo "PR synchronize trigger received for review reminder workflow."
23+
1424
remind-reviewers:
1525
runs-on: ubuntu-latest
26+
if: github.event_name != 'pull_request'
1627
steps:
1728
- name: Check for PRs awaiting review
1829
uses: actions/github-script@v7

‎.github/workflows/release-please.yml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
push:
55
branches:
66
- main
7+
pull_request:
8+
types: [opened, reopened, synchronize]
9+
branches:
10+
- main
711
# Also allow manual trigger
812
workflow_dispatch:
913

@@ -12,10 +16,23 @@ permissions:
1216
pull-requests: write
1317

1418
jobs:
19+
release-config-check:
20+
runs-on: ubuntu-latest
21+
if: github.event_name == 'pull_request'
22+
permissions:
23+
contents: read
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v4
27+
28+
- name: Validate release-please config files
29+
run: |
30+
jq empty release-please-config.json
31+
jq empty .release-please-manifest.json
32+
1533
release-please:
1634
runs-on: ubuntu-latest
17-
# Only run if NOT from bots or automated PR merges
18-
if: github.event_name == 'workflow_dispatch' || (github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]' && !contains(github.event.head_commit.message, 'Merge pull request'))
35+
if: github.event_name != 'pull_request' && (github.event_name == 'workflow_dispatch' || (github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]' && !contains(github.event.head_commit.message, 'Merge pull request')))
1936
steps:
2037
- uses: googleapis/release-please-action@v4
2138
id: release

‎.github/workflows/sbom.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Generate SBOM
33
on:
44
release:
55
types: [published]
6+
pull_request:
7+
types: [opened, reopened, synchronize]
8+
branches: [main]
69
workflow_dispatch:
710

811
permissions:

‎.github/workflows/stale.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
name: Stale Issues and PRs
22

33
on:
4+
pull_request:
5+
types: [opened, reopened, synchronize]
6+
branches: [main]
47
schedule:
58
- cron: "30 1 * * *" # Run daily at 1:30 AM UTC
69
workflow_dispatch:
@@ -10,8 +13,16 @@ permissions:
1013
pull-requests: write
1114

1215
jobs:
16+
pr-sync-check:
17+
runs-on: ubuntu-latest
18+
if: github.event_name == 'pull_request'
19+
steps:
20+
- name: PR sync trigger acknowledged
21+
run: echo "PR synchronize trigger received for stale workflow."
22+
1323
stale:
1424
runs-on: ubuntu-latest
25+
if: github.event_name != 'pull_request'
1526
steps:
1627
- uses: actions/stale@v9
1728
with:

0 commit comments

Comments
 (0)
⚡