From a731ce68622c1f0186c33a31106de76c05f622cb Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 19:19:57 +0200 Subject: [PATCH 1/4] chore(ci): adopt shared workflows and central Renovate preset - renovate.json -> central preset (maintainers-launchpad) - security.yml (Trivy + CycloneDX SBOM) - close_invalid_prs.yml --- .github/workflows/close_invalid_prs.yml | 10 +++++ .github/workflows/security.yml | 55 +++++++++++++++++++++++++ renovate.json | 2 +- 3 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/close_invalid_prs.yml create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/close_invalid_prs.yml b/.github/workflows/close_invalid_prs.yml new file mode 100644 index 00000000..bd99444f --- /dev/null +++ b/.github/workflows/close_invalid_prs.yml @@ -0,0 +1,10 @@ +name: Close invalid PRs + +on: + pull_request_target: + types: [opened] + +jobs: + close: + uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 00000000..e2958753 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,55 @@ +name: Security + +# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained +# on purpose: it needs no build tool and no registry credentials, so it is the +# baseline security gate for every repository regardless of language. +on: + pull_request: + push: + branches: [main] + schedule: + - cron: "37 3 * * 1" + workflow_dispatch: +permissions: + contents: read + security-events: write + +jobs: + trivy: + name: Trivy scan + uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1 + with: + scan-type: "fs" + scanners: "vuln,secret" + severity: "CRITICAL,HIGH" + # Report-only for now, so adopting this does not turn CI red on day one. + fail-on-findings: false + upload-sarif: true + secrets: inherit + + sbom: + name: CycloneDX SBOM + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Upload SBOM + uses: actions/upload-artifact@v4 + with: + name: sbom-cyclonedx + path: bom.json + if-no-files-found: error + retention-days: 90 diff --git a/renovate.json b/renovate.json index b0099b7e..f99991bc 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>onelitefeathernet/renovate:default(onelitefeathernet/maintainers-launchpad)" + "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/maintainers-launchpad)" ] } From 64c989a67d82614e3bcb3be86e1efa9d70908882 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:21:00 +0200 Subject: [PATCH 2/4] chore(ci): add release-please, PR linting and release SBOMs - pr-lint.yml - commitlint.config.mjs - SBOM job appended to release-please.yml --- .github/workflows/pr-lint.yml | 17 +++++++++++++++++ .github/workflows/release-please.yml | 28 ++++++++++++++++++++++++++++ commitlint.config.mjs | 3 +++ 3 files changed, 48 insertions(+) create mode 100644 .github/workflows/pr-lint.yml create mode 100644 commitlint.config.mjs diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml new file mode 100644 index 00000000..759b37b8 --- /dev/null +++ b/.github/workflows/pr-lint.yml @@ -0,0 +1,17 @@ +name: PR Lint + +# Conventional Commits on the PR title and every commit on the branch. +# release-please parses those commit types to decide the version bump and to +# build the changelog - a non-conventional commit silently produces neither. +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 239ddc24..685997e2 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -61,3 +61,31 @@ jobs: # release-please tags always sit on main's linear history, so the # release branch only ever moves forward. No force push. git push origin "HEAD:refs/heads/release" + + sbom: + name: Attach SBOM to release + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Generate CycloneDX SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + exit-code: '0' + + - name: Attach SBOM to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" bom.json --clobber diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 00000000..0616fb93 --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ['@commitlint/config-conventional'], +}; From c0c6732627fb892dbe60a129cdd70760da6b6ef3 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:23:29 +0200 Subject: [PATCH 3/4] fix(ci): make the release SBOM job actually run The inline release-please job did not expose its outputs, so the downstream `needs.release-please.outputs.release_created` gate was always empty and the job was skipped on every release without ever failing. --- .github/workflows/release-please.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 685997e2..d5e8574e 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -34,6 +34,10 @@ concurrency: jobs: release-please: + outputs: + release_created: ${{ steps.release.outputs.release_created }} + tag_name: ${{ steps.release.outputs.tag_name }} + version: ${{ steps.release.outputs.version }} runs-on: ubuntu-latest timeout-minutes: 5 steps: From bd87ebf43199cc5b6eb56ff83ac1e566578b9826 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 21:15:13 +0200 Subject: [PATCH 4/4] fix(ci): restore Renovate platform presets and anchor the version in build.gradle.kts - bootstrap-sha set from tip of main (no version tag yet) --- release-please-config.json | 62 ++++++++++++++++++++++++++++++-------- 1 file changed, 50 insertions(+), 12 deletions(-) diff --git a/release-please-config.json b/release-please-config.json index 15bd4937..022113c5 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -11,18 +11,56 @@ "package-name": "onelitefeather.net", "changelog-path": "CHANGELOG.md", "changelog-sections": [ - { "type": "feat", "section": "Features" }, - { "type": "fix", "section": "Bug Fixes" }, - { "type": "perf", "section": "Performance" }, - { "type": "refactor", "section": "Refactors" }, - { "type": "revert", "section": "Reverts" }, - { "type": "docs", "section": "Documentation" }, - { "type": "ci", "section": "Continuous Integration" }, - { "type": "build", "section": "Build System", "hidden": true }, - { "type": "test", "section": "Tests", "hidden": true }, - { "type": "style", "section": "Styles", "hidden": true }, - { "type": "chore", "section": "Chores", "hidden": true } + { + "type": "feat", + "section": "Features" + }, + { + "type": "fix", + "section": "Bug Fixes" + }, + { + "type": "perf", + "section": "Performance" + }, + { + "type": "refactor", + "section": "Refactors" + }, + { + "type": "revert", + "section": "Reverts" + }, + { + "type": "docs", + "section": "Documentation" + }, + { + "type": "ci", + "section": "Continuous Integration" + }, + { + "type": "build", + "section": "Build System", + "hidden": true + }, + { + "type": "test", + "section": "Tests", + "hidden": true + }, + { + "type": "style", + "section": "Styles", + "hidden": true + }, + { + "type": "chore", + "section": "Chores", + "hidden": true + } ] } - } + }, + "bootstrap-sha": "669c2863e85d11b0d8edc7e707029d70b9cddcfb" }