Release v5.6.0#514
Open
mkolasinski-splunk wants to merge 29 commits into
Open
Conversation
## Summary - Fast-forwards `develop` to match `main` (tip: `36d2c0f`) - Brings in 20 commits that landed on `main` since last sync (#492), including fixes for PAT/GitHub App auth, spl2 tests, ubuntu 16.04 EOL drop, and manifests pin - No unique commits on `develop` that are missing from `main` 🤖 Generated with [Claude Code](https://claude.com/claude-code)
## What Bumps all GitHub Actions still bundling the deprecated Node 20 runtime to their first major version that targets Node 24, resolving the `Node.js 20 is deprecated` warnings across all jobs in this workflow family. | Action | Before | After | |---|---|---| | `actions/checkout` | v4 | v5 | | `actions/setup-python` | v5 | v6 | | `actions/download-artifact` | v4 | v7 | | `actions/upload-artifact` | v4 | v6 | | `actions/cache` | v4 | v5 | | `amannn/action-semantic-pull-request` | v5.5.3 | v6.1.1 | | `aws-actions/configure-aws-credentials` | v4 | v6 | | `dorny/test-reporter` | v1.9.1 | v3.0.0 | | `geekyeggo/delete-artifact` | v5 | v6 | | `softprops/action-gh-release` | v2 | v3 | Applied consistently across all four workflow files: - `reusable-build-test-release.yml` - `build-test-release.yaml` - `reusable-publish-to-splunkbase.yml` - `reusable-validate-deploy-docs.yml` ### Left unchanged (already Node 24, or docker/composite) `setup-java@v5`, `create-github-app-token@v3`, `amazon-ecr-login@v2`, `svenstaro/upload-release-action@v2`, and all docker/composite actions (`splunk/*`, `fsfe/reuse-action`, `pre-commit/action`, `trufflehog`, `skywalking-eyes`). ## Testing Ran the full `build-test-release` pipeline on `splunk-add-on-for-microsoft-cloud-services` pointed at this branch — **pipeline succeeded**, and the Node 20 deprecation warnings are gone from every job that consumes these actions (build, setup, meta, unit tests, all appinspect jobs, etc.). https://github.com/splunk/splunk-add-on-for-microsoft-cloud-services/actions/runs/28662878022 ### Known remaining warnings (out of scope — external sources) - `pre-commit` job → `actions/cache@v4` is hardcoded inside `pre-commit/action@v3.0.1` (latest release). - `semgrep / sast-scan` job → `checkout@v4` / `upload-artifact@v4` come from `splunk/sast-scanning/.github/workflows/sast-scan.yml@main` (separate repo; addressed here: splunk/sast-scanning#7). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
…n ADDON-88924 (#513) ## Summary - Splits the single monolithic `run-spl2-tests` box-test job into a matrix, one job per pipeline subdirectory under `package/default/data/spl2/` (discovered dynamically in `setup-workflow`), plus a `__root__` shard for any top-level `*.test.json`/`*.test.spl2` fixtures. - Each shard is scoped with `--test_dir` (using `spl2-testing-framework`'s existing directory-scoping support — no framework changes needed); `--code_dir` stays pointed at the full tree so module resolution still works for TAs that don't duplicate pipeline code per-subdirectory. - Motivated by the AWS TA SPL2 suite, where one pipeline (`aws_cloudtrail`) accounts for ~78% of all box tests and made the single job take 4+ hours; sharding lets pipelines with skewed test-count distributions run concurrently instead of serially. ## Test plan - [x] Verify against `splunk-add-on-for-amazon-web-services` (`feature/spl2-content-for-aws-ta`) via a throwaway PR pointing `build-test-release.yml`'s `uses:` at this branch — confirm shard discovery finds `aws_cloudtrail`/`aws_cloudwatch`/`aws_cloudwatchlogs_vpcflow`/`__root__`, all four run in parallel, and total test count/pass-fail matches the current single-job baseline. [link](https://github.com/splunk/splunk-add-on-for-amazon-web-services/actions/runs/28942569538/job/85878959228a) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
## Summary - Add `actions/upload-artifact@v4` step to `run-spl2-tests` job so test results are preserved as downloadable artifacts after each run - Matches the artifact upload pattern already used in `run-knowledge-tests` and `run-unit-tests` - Artifact named `spl2 test results`, contains the `test-results/` directory with JUnit XML output ## Test plan - [ ] Verify CI runs `run-spl2-tests` and produces a downloadable `spl2 test results` artifact - [ ] Confirm artifact contains `test-results/report.xml` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…sable release workflow (#503) ## Summary This PR updates the reusable add-on build-test-release workflow to split FOSSA findings into separate license and vulnerability checks, improve release gating, and document the new workflow behavior. JIRA Link - []https://splunk.atlassian.net/browse/ADDON-87374 ## Changes - Extends `fossa-scan` to run `fossa test --debug` in a dedicated step (only when analyze succeeds) and upload its output as the `fossa-test-output` artifact - Adds separate lightweight FOSSA CI jobs that parse `fossa-test-output`: - `fossa-license-test` — extracts and counts issues from the `COMPLIANCE ISSUES` section - `fossa-vulnerability-test` — extracts and counts issues from the `SECURITY ISSUES` section - Exposes separate pipeline outputs for: - active license issues - active vulnerability issues - release-blocking vulnerability issues - Publishes separate job summaries for license and vulnerability findings. - Updates `pre-publish` release gating so release paths can block independently on: - unresolved vulnerability issues - Keeps merge-to-develop and other non-release workflows usable by reporting split FOSSA results without enforcing release gating there. - Updates README documentation for the new split FOSSA jobs and release gating behavior. ### Checklist - [X] `README.md` has been updated - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [X] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Tested TA GitHub Actions run: 1. Successful FOSSA Tests for Apache web server TA - []https://github.com/splunk/splunk-add-on-for-apache-web-server/actions/runs/29075781494 2. Crowdstrike TA FOSSA tests failure - []https://github.com/splunk/splunk-add-on-for-crowdstrike-fdr/actions/runs/29077637023 3. Salesforce TA FOSSA tests failure - []https://github.com/splunk/splunk-add-on-for-salesforce/actions/runs/29077050887 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
### Description This PR bumps matrix version to 3.2 including Splunk 10.4 ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)
## Summary
- Adds a step to the `validate-pr-title` job that enforces `ADDON-XXXXX`
(5–6 digit Jira ticket number) in the PR title, failing with a clear
`::error::` annotation if missing (runs after the existing semantic PR
title check).
- Adds a new `comment-on-jira` job: on push to `main`/`develop`, scans
commit messages for `ADDON-XXXXX` references and posts a comment on each
referenced ticket linking back to the commit (and originating PR, if
found), worded to match the existing GitLab→Jira integration convention
(`{author} mentioned this issue in a commit of {repo} on branch
{branch}:`).
- Auth via `ATLASSIAN_EMAIL`/`ATLASSIAN_TOKEN` secrets (hardcoded
`https://splunk.atlassian.net` base URL), matching the naming convention
already used by `addonfactory-docs-on-github-integration`; posts via raw
Jira REST API v3 + ADF body rather than `atlassian/gajira-comment`
(which has a known RCE, CVE-2020-14189).
- Never fails the workflow: a failed Jira API call only logs a
`::warning::`.
## Test plan
- [x] Open a PR without `ADDON-XXXXX` in the title → job fails with the
error message
- [x] Open a PR with `ADDON-12345` or `ADDON-123456` in the title → job
passes
- [x] Verify existing semantic PR title validation still works
- [x] **Live end-to-end verification against
`splunk/test-addonfactory-repo`** (sandbox repo, temporarily pointed at
this branch, reverted to `v5.4` after each round), commenting on real
ticket [ADDON-88759](https://splunk.atlassian.net/browse/ADDON-88759):
- `pull_request` event → `comment-on-jira` correctly `skipped` (job only
fires on `push`)
- Push directly to `main`, no originating PR → comment posted with
commit link only, no "via PR" clause
([run](https://github.com/splunk/test-addonfactory-repo/actions/runs/28979594348))
- Push to `main` via squash-merged PR → comment posted with commit link
**and** correct PR link
([run](https://github.com/splunk/test-addonfactory-repo/actions/runs/28979730875),
[PR #374](splunk/test-addonfactory-repo#374))
- Push with a mix of a ticket-referencing and a non-referencing commit →
only the referencing commit produced a comment (dedup/skip logic
confirmed)
([run](https://github.com/splunk/test-addonfactory-repo/actions/runs/28980385679))
- Bug found and fixed during testing: initial run 403'd on the PR lookup
(job only had `contents: read`) and leaked the raw error JSON into the
comment's link `href`
([run](https://github.com/splunk/test-addonfactory-repo/actions/runs/28978879858),
see resulting [malformed
comment](https://splunk.atlassian.net/browse/ADDON-88759)) — fixed by
adding `pull-requests: read` and guarding the `gh api` failure path
(`1c8ba82`)
- Final wording verified live: "mkolasinski-splunk mentioned this issue
in a commit of splunk/test-addonfactory-repo on branch main:"
([run](https://github.com/splunk/test-addonfactory-repo/actions/runs/28980385679))
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds a fossa-ignore-vulnerabilities workflow_call input (JSON array of "package@version" strings) so callers can filter out known false positives, such as urllib3@1.26.19, before the fossa-vulnerability-test job counts issues and fails. ### Description (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here) Co-authored-by: Claude <noreply@anthropic.com>
### Description Utilise new feature of spl2-testing-base and add --cli_cache to speed up spl2 tests executin ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)
… to main] (#519) ## Summary - GS Scorecard tool remains available via `execute_gs_scorecard` label — developers can still use it - Scorecard results (pass/fail/missing) are now reported as `::warning::` instead of `::error::` and never cause the job to fail - Removed the `pre-publish` gate that blocked releases when scorecard was skipped on PRs to main - Fixes cases where scorecard flags checks as not checked, unintentionally blocking releases https://github.com/splunk/splunk-add-on-for-cisco-esa/actions/runs/27544575031/job/81415137332?pr=480#step:9:268 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- ### Description (PR description goes here) ### Checklist - [ ] `README.md` has been updated or is not required - [ ] push trigger tests - [ ] manual release test - [ ] automated releases test - [ ] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (for each selected checkbox, the corresponding test results link should be listed here)
…t selection (#522) ## Summary Generate and publish Swagger artifacts for add-ons with UCC modinput tests even when the UCC test job is not selected. ## Root cause Swagger artifact upload was tied to `execute-ucc_modinput`. When that test job was skipped, TACO later failed because the build-specific S3 prefix did not contain `swagger_client`. ## Changes - Detect whether `tests/ucc_modinput_functional` exists. - Use that capability, rather than test selection, when uploading and downloading the OpenAPI artifact. - Preserve existing UCC test-selection behavior. ## Validation - Parsed workflow YAML. - Ran diff whitespace checks. ## Related - ADDON-89264
…8928) (#523) ## Summary ADDON-88928: PR/push targeting `release/*` branches was running Splunk tests against latest-Splunk-only instead of the full supported matrix. The `meta` job's `determine_splunk` step only special-cased `main`/`develop`, so `release/*` fell into the latest-only `else` branch — exactly where full-matrix coverage matters most before cutting a release. ## Change - `reusable-build-test-release.yml`: extend the `determine_splunk` condition to also treat `release/*` as full-matrix — for PR (`base_ref`) and for push (`ref_name`, gated by `execute-tests-on-push-to-release` to match the existing push gate). - `README.md`: document the `release/*` full-matrix behavior. ## Validated (test-addonfactory-repo) - PR into a `release/*` base (test-addonfactory-repo#376): `meta` job succeeded; the job-summary consumed the **full 5-version matrix** `[10.2.5, 10.0.8, 9.4.13, 9.3.14, 10.4.1]` instead of latest-only `[10.4.1]`. AC confirmed. - A control PR against unmodified `@develop` reproduced a pre-existing `startup_failure` (missing `GH_TOKEN_ADMIN` passthrough in the caller), proving the failure was environmental and independent of this change; adding the passthrough unblocked the run. JIRA: https://splunk.atlassian.net/browse/ADDON-88928 --------- Co-authored-by: Claude <noreply@anthropic.com>
…DDON-89094) (#524) ## Summary - Bump GitHub Action pins: `actions/checkout@v7`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, `actions/cache@v6.1.0`, `fsfe/reuse-action@v6.0.0`, `trufflesecurity/trufflehog@v3.95.9`, `splunk/appinspect-cli-action@v2.13.0`; normalize `matrix-action@v3.1` → `@v3.2`. - Bump `POETRY_VERSION` to `2.4.1` and `POETRY_EXPORT_PLUGIN_VERSION` to `1.10.0` (latest on PyPI as of this bump). - Bump the `python-version` input default from `3.9` to `3.13`, since poetry 2.4.1 requires Python >=3.10. README updated to match. ## Validation Two-tier validation against `splunk/test-addonfactory-repo`, branched off the PR that repoints test-repo `main` at `@release/5.6.0` (splunk/test-addonfactory-repo#378) to inherit `GH_TOKEN_ADMIN` and the release-pinned reusable workflow. - Control run (python-version 3.9, all other bumps applied): all jobs green, including `quality-appinspect-cloud` — https://github.com/splunk/test-addonfactory-repo/actions/runs/29605639162 - Validation run (python-version 3.13): https://github.com/splunk/test-addonfactory-repo/actions/runs/29637138898 - `run-unit-tests`: **PASS** — confirms the poetry/Python version fix (poetry 2.4.1 requires >=3.10; the prior default of 3.9 broke `pip install poetry==2.4.1`). - `quality-appinspect-cloud`: fails on `check_all_python_files_are_well_formed`, flagging vendored third-party files (`lib/pkg_resources/_vendor/...`) in the test-repo's fixture TA. This is expected: with `PYTHON_VERSION=3.13` appinspect now validates against the 3.13 interpreter, and the fixture TA's vendored libs aren't 3.13-clean. The workflow is behaving correctly (validating against the interpreter the TA will actually run on); this is a property of the fixture TA, not a workflow defect. Real consumer TAs address this via `.appinspect.expect.yaml`. - `run-ui-tests (10.4.1, ...)`: fails on a Selenium `TimeoutException: Could not log in to the Splunk instance` after retries — an infra flake unrelated to this change. - `Validate PR title`: fails on both this run and the control run — pre-existing, unrelated (semantic-PR check on the throwaway validation PR's title). ## Test plan - [x] Control run confirms all other bumps validated clean - [x] Validation run confirms `run-unit-tests` green under python-version 3.13 - [x] appinspect-cloud failure root-caused to fixture-TA vendored libs, not a workflow defect - [x] UI test failure confirmed to be Splunk-login-timeout infra flake, unrelated
## Summary - `dorny/test-reporter@v3.0.0` (bumped in #512) defaults `use-actions-summary` to `true`, which skips check-run creation entirely — the code path that sets the `url`/`url_html` outputs never runs. That's why the Test Report stage's rendering changed and why `job_summary.txt`'s report-link column went empty. - Sets `use-actions-summary: false` on all 8 `Test Report` steps to restore v1.9.1 behavior: check run created, `url_html` populated, `job_summary.txt` -> artifact -> aggregated Report Link table works as before. ## Test plan - [x] YAML validated (`yaml.safe_load`) - [ ] Confirm a downstream TA run shows a populated Report Link in the aggregated summary table
…526) ## Summary - Sibling validation for ADDON-87662 (Splunk 9.4 `python.version` support in `server.conf`) passed against real TAs via throwaway sibling PRs (not for merge): [salesforce#897](splunk/splunk-add-on-for-salesforce#897), [aws#1707](splunk/splunk-add-on-for-amazon-web-services#1707), [sysmon#369](splunk/splunk-add-on-for-microsoft-sysmon#369). - Bumps default pins so `release/5.6.0` actually picks up the capability: - `k8s-manifests-branch` default `v4.2` -> `v4.3` (postStart hook sets `python.version` in `server.conf` for Splunk 9.4 variants) — [ta-automation-k8s-manifests#148](splunk/ta-automation-k8s-manifests#148) - `wfe-test-runner-action@v5.2` -> `@main` (`server-conf-python-version` input) — [wfe-test-runner-action#50](splunk/wfe-test-runner-action#50) (no release tag yet, pinning to `main` for now) - `addonfactory-test-matrix-action@v3.2` -> `@v3.3` (`supportedSplunkModinput` output with `python.version` variants) — [addonfactory-test-matrix-action#213](splunk/addonfactory-test-matrix-action#213) ## Test plan - [x] YAML validated (`yaml.safe_load`) - [ ] Confirm downstream TA CI run picks up python.version variants correctly
Splits run-unit-tests into run-unit-tests-py39 and run-unit-tests-py313 so TAs are validated against both supported interpreters in CI, since release/5.6.0 had bumped the python-version input default to 3.13, which silently skipped installing dependencies for TAs still constrained to <3.10 in poetry. Reverts the input default back to 3.9.
POETRY_VERSION 2.4.1 and POETRY_EXPORT_PLUGIN_VERSION 1.10.0 require Python >=3.10, which breaks every job now that python-version defaults back to 3.9 (and breaks the new run-unit-tests-py39 job outright). Poetry dropped 3.9 support starting at 2.3.0; 2.2.1 is the latest release still supporting both 3.9 and 3.13, paired with poetry-plugin-export 1.9.0 (last version requiring poetry>=3.9).
run-unit-tests-py39/py313 should gate publishing, not the build job itself, so build can proceed in parallel with unit tests instead of waiting on them.
…g build Adds build-py313 mirroring the build job's compile/package steps under Python 3.13, without uploading artifacts or publishing anywhere downstream - it only verifies the package builds successfully. run-unit-tests-py39 is now a required upstream of build, and run-unit-tests-py313 is now a required upstream of build-py313, so each Python version's unit tests gate its own build job. Both build and build-py313 gate pre-publish.
…508) - `run-modinput-tests` and `run-ucc-modinput-tests` jobs use new `matrix_splunkModinput` output (from `addonfactory-test-matrix-action`) which contains two entries for Splunk 9.4: `serverConfPythonVersion: python3` and `serverConfPythonVersion: force_python3` — resulting in two separate test runs per modinput job - All other test types (btool, knowledge, ui, upgrade, scripted inputs, spl2) use `matrix_Splunk` (standard output, no variants) — single run per Splunk version as before - `server-conf-python-version` is passed to `wfe-test-runner-action` only for modinput and ucc-modinput jobs; all other jobs pass empty string - Default values restored: `k8s-manifests-branch` → `v4.2`, `addonfactory-test-matrix-action` → `@v3.1`, `wfe-test-runner-action` → `@v5.2` ## Why Splunk 9.4 requires explicit `python.version` configuration in `server.conf [general]`. Only modinput tests are affected — they execute scripted inputs whose Python version is controlled by this setting. Running two variants (`python3` and `force_python3`) ensures the add-on works under both configurations. Other test types (btool, knowledge, UI) do not interact with the Python runtime selection and do not benefit from duplicate runs. ## Dependencies Requires the following PRs to be merged and tagged first: - `splunk/addonfactory-test-matrix-action` — provides `supportedSplunkModinput` output - `splunk/wfe-test-runner-action` — provides `server-conf-python-version` input forwarding - `splunk/ta-automation-k8s-manifests` — applies `python.version` in the Splunk pod ## Test plan - [x] Verify PR to `main` triggers 2 modinput runs for Splunk 9.4 (`python3` and `force_python3`) - [x] Verify all other test types have 1 run per Splunk version (no duplicate 9.4 runs) - [x] Verify `btool server list general | grep python` returns correct value in each modinput run - [x] Verify non-9.4 Splunk versions are unaffected --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Marcin Kolasinski <mkolasinski@splunk.com> Co-authored-by: mkolasinski-splunk <105011638+mkolasinski-splunk@users.noreply.github.com>
Fixes stale defaults (k8s-manifests-branch, python-version, gs-image-version), documents spl2-generate and fossa-ignore-vulnerabilities inputs, and notes the modinput python.version matrix variants and split unit-test jobs.
### Description Release 5.6.0 of the reusable workflow. - **ADDON-87662 / ADDON-88928** — Modinput tests now support running against multiple `python.version` server.conf variants (`python3`, `force_python3`) per Splunk version, driven by `addonfactory-test-matrix-action@v3.3`'s `supportedSplunkModinput` output and forwarded via `wfe-test-runner-action@v5.3`'s new `server-conf-python-version` input. Applies to `run-modinput-tests` and `run-ucc-modinput-tests`. - **ADDON-89094** — Ensures the full supported Splunk matrix (not just latest) runs on PRs to and pushes on `release/*`/`main` branches. - **ADDON-88923** — Restores the check-run URL in test report steps. - Unit tests now run separately on Python 3.9 and 3.13 (`run-unit-tests-py39`, `run-unit-tests-py313`), with a new `build-py313` job depending on the matching unit test job; `build` remains gated on the 3.9 run. Poetry pinned to a version compatible with both. - Action pin bumps (`k8s-manifests-branch` → `v4.3`, `gs-image-version` → `1.2`, poetry `2.2.1`, `poetry-plugin-export` `1.9.0`) and `python-version` default reverted to `3.9`. Tests: splunk/splunk-add-on-for-box#819 splunk/splunk-add-on-for-crowdstrike-fdr#988 splunk/splunk-add-on-for-salesforce#899 splunk/splunk-add-on-for-amazon-web-services#1710 ### Checklist - [x] `README.md` has been updated or is not required - [x] push trigger tests - [ ] manual release test - [x] automated releases test - [x] pull request trigger tests - [ ] schedule trigger tests - [ ] workflow errors/warnings reviewed and addressed ### Testing done (pending)
## Summary
- Removes `GH_TOKEN_ADMIN` (service account PAT) from the
`workflow_call` secrets — it is no longer accepted by callers
- Adds a **Generate app token** step at the start of the `publish` job
using `actions/create-github-app-token@v3` with
`GH_APP_CLIENT_ID`/`GH_APP_PRIVATE_KEY`, consistent with every other job
in this workflow
- Passes `steps.app-token.outputs.token` to
`splunk/semantic-release-action` (git push + tag to `main`) and
`softprops/action-gh-release` (custom-version releases)
## Why the PAT didn't work
The `main` branch ruleset on consumer repos has a bypass actor for the
`splunk-ta-helper` GitHub App. A PAT from the service account is not the
app, so pushes from semantic-release were rejected with 403. The
short-lived app token passes the bypass check.
## Callers must remove `GH_TOKEN_ADMIN` from their secrets block
```yaml
# remove this line from your workflow
GH_TOKEN_ADMIN: ${{ secrets.GH_TOKEN_ADMIN }}
```
Ensure `SPLUNK_TA_HELPER_APP_ID` / `SPLUNK_TA_HELPER_PRIVATE_KEY` are
set as repo secrets and passed as `GH_APP_CLIENT_ID` /
`GH_APP_PRIVATE_KEY`.
## Test plan
- [ ] Trigger a push to `main` on a consumer repo and verify the
`publish` job completes (semantic-release pushes signed tag + commit
without 403)
- [ ] Trigger a `workflow_dispatch` with `custom-version` set and verify
`action-gh-release` creates the release successfully
- [ ] Confirm `GH_TOKEN_ADMIN` secret can be removed from consumer repos
after adopting this version
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…#528) ## Summary - Add yamlfmt as a pre-commit hook (with a `.yamlfmt` config preserving multi-line `run:` blocks) so YAML formatting is configured and enforceable, not just linted. - Expand `.gitignore` beyond `actionlint`/`.idea` to cover editors/IDEs, OS files, local env/secrets, and logs/temp. - Replace the single `.github/CODEOWNERS` wildcard with explicit per-path rules whose union covers every tracked file, keeping the wildcard only as a trailing fallback. Addresses the top action items from an agent-readiness assessment of this repo (`formatter`, `gitignore_comprehensive` blocking Level 1; `codeowners` blocking Level 2). ## Test plan - [x] `pre-commit run --all-files` passes (check-merge-conflict, yamlfmt, actionlint all green) - [x] `yamlfmt -lint` is idempotent (no further changes) after the one-time reformat - [x] Confirmed the yamlfmt diff is whitespace/quote-style only — no `run:` blocks collapsed, no semantic changes to workflow YAML - [x] `git check-ignore -v` confirms new `.gitignore` rules match `.DS_Store`, `.env`, `*.log`, `tmp/`, `.vscode/` - [x] Verified every tracked file in the repo matches a non-wildcard CODEOWNERS rule Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
(PR description goes here)
Checklist
README.mdhas been updated or is not requiredTesting done
(for each selected checkbox, the corresponding test results link should be listed here)