From afac1dbb978221df6e082322d1228c8d5cacdb97 Mon Sep 17 00:00:00 2001 From: James Maes Date: Fri, 9 Oct 2026 10:39:31 -0500 Subject: [PATCH] ci: retire the gates the standards' reusable workflows superseded dependency-review.yml is replaced by `pr / dependency-review` from pr-gates.yml, and the CI workflow and its jobs take the standard context names (`ci / build-test`, `ci / format`, `ci / ui-tests`) that CONTRIBUTING.md and the protect-main ruleset refer to. Merge only after the ruleset's required checks no longer name the old contexts (see #66): a required check that never reports would otherwise block every pull request. Relates to #63 and #66 Co-Authored-By: Claude Fable 5.1 Signed-off-by: James Maes --- .github/workflows/ci.yml | 8 +-- .github/workflows/dependency-review.yml | 69 ------------------------- docs/RELEASING.md | 2 +- 3 files changed, 5 insertions(+), 74 deletions(-) delete mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e59cc00..7e2a6e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ # Build bar: `dotnet build gclo.slnx -p:Platform=x64` must produce ZERO warnings, # which -warnaserror enforces (this also fails the build on NuGetAudit # vulnerability warnings, so known-vulnerable packages break CI). -name: CI +name: ci on: push: @@ -32,7 +32,7 @@ concurrency: jobs: build-test: - name: Build and test (x64) + name: build-test runs-on: windows-latest timeout-minutes: 30 steps: @@ -116,7 +116,7 @@ jobs: # (the Release workflow) can make it advisory so a flaky UI run cannot block # an immutable tag that main itself would have accepted. On push/PR events the # input is unset, so the job fails the workflow exactly as before. - name: UI end-to-end tests (x64) + name: ui-tests runs-on: windows-latest timeout-minutes: 30 continue-on-error: ${{ inputs.ui-tests-advisory == true }} @@ -155,7 +155,7 @@ jobs: if-no-files-found: warn format: - name: Format (style gate) + name: format runs-on: windows-latest timeout-minutes: 20 steps: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml deleted file mode 100644 index 8d26e2a..0000000 --- a/.github/workflows/dependency-review.yml +++ /dev/null @@ -1,69 +0,0 @@ -# Superseded by pr-gates.yml (`pr / dependency-review`, K22-CI-01); kept only -# until the protect-main ruleset lists the new required contexts (#66), then -# removed. -# -# Blocks pull requests that add dependencies with known vulnerabilities or with -# licenses outside the allowlist below. Only dependencies *added or changed* by -# the PR are checked (via the GitHub dependency graph diff), so existing -# dependencies never retroactively fail this gate. -name: Dependency Review - -on: - pull_request: - -permissions: - contents: read - -jobs: - dependency-review: - name: Dependency review - # No build happens here, so the cheaper Linux runner is fine. - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - # Needed for comment-summary-in-pr. - pull-requests: write - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Dependency review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 - with: - # Fail on ANY known vulnerability, even low severity. - fail-on-severity: low - comment-summary-in-pr: on-failure - # Anything not on this list fails the check. This repo is MIT, so we - # accept permissive licenses plus GPL-2.0 "with linking exception" - # style grants (e.g. libgit2's license). Extend deliberately - a new - # license here is a legal decision, not a build fix. - allow-licenses: >- - MIT, - MIT-0, - Apache-2.0, - BSD-2-Clause, - BSD-3-Clause, - 0BSD, - ISC, - MS-PL, - Unlicense, - CC0-1.0, - GPL-2.0-only WITH Classpath-exception-2.0, - GPL-2.0-or-later WITH Classpath-exception-2.0, - GPL-2.0-only WITH GCC-exception-2.0 - # Packages whose nuspec declares the license as a FILE rather than an - # SPDX expression, which the dependency graph reports as "unknown" / - # NOASSERTION and would otherwise fail every version bump. All three have - # shipped in gclo since the first commit, so this is not a new license - # decision - it records what they actually are: - # LibGit2Sharp MIT (App_Readme/LICENSE.md) - # Microsoft.WindowsAppSDK Microsoft Software License Terms (license.txt) - # Microsoft.Windows.SDK.BuildTools Windows SDK license (aka.ms/WinSDKLicenseURL) - # Vulnerability scanning still applies to them; only the license check is skipped. - allow-dependencies-licenses: >- - pkg:nuget/LibGit2Sharp, - pkg:nuget/Microsoft.WindowsAppSDK, - pkg:nuget/Microsoft.Windows.SDK.BuildTools diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 2161077..566bcc8 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -134,7 +134,7 @@ Both install the same asset, `gclo-cli-win-x64.zip`, by URL and SHA-256. - **Verify tag** — validate the tag, derive version/channel, and check that the tagged commit is contained in `main`. A tag on any other commit fails here and nothing is built or published. - - **Gates** — the full `CI` workflow, exactly as a pull request runs it: + - **Gates** — the full `ci` workflow, exactly as a pull request runs it: x64 build with warnings as errors, 100% line coverage on `gclo.Engine` / `gclo.ViewModels` / `gclo`, and the formatting gate. The FlaUI UI smoke suite runs as well but is **advisory** for a release, -- 2.54.0