From 046c78db754e04da2109f330318783d9ca2eddac Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:01:37 +0300 Subject: [PATCH 1/2] ci: run the scan and link check in verify Replace the Scan and Links caller workflows with the shared putdotio/.github scan and links actions as the last steps of the verify job. A manual dispatch without a release tag now verifies and scans full history without starting the release job. Drop .gitleaksignore: Gitleaks no longer runs on this public repository. --- .github/workflows/ci.yml | 11 ++++++++--- .github/workflows/links.yml | 19 ------------------- .github/workflows/scan.yml | 19 ------------------- .gitleaksignore | 6 ------ docs/DISTRIBUTION.md | 2 ++ 5 files changed, 10 insertions(+), 47 deletions(-) delete mode 100644 .github/workflows/links.yml delete mode 100644 .github/workflows/scan.yml delete mode 100644 .gitleaksignore diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 331b733..a864d5e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,8 +8,8 @@ on: workflow_dispatch: inputs: release_tag: - description: Existing stable tag to resume or reconcile, for example v1.5.1 - required: true + description: Existing stable tag to resume or reconcile, for example v1.5.1; leave empty to only verify and scan full history + required: false type: string concurrency: @@ -46,12 +46,17 @@ jobs: - name: Verify repository run: vp run verify + - uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 + + - if: ${{ !cancelled() }} + uses: putdotio/.github/.github/actions/scan@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 + release: if: >- ${{ github.ref == 'refs/heads/main' && ( - github.event_name == 'workflow_dispatch' || + (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && !contains(github.event.head_commit.message, '[skip ci]')) ) }} diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml deleted file mode 100644 index 7cadb4a..0000000 --- a/.github/workflows/links.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: Links - -on: - pull_request: - push: - branches: - - main - -concurrency: - group: links-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -permissions: {} - -jobs: - links: - permissions: - contents: read - uses: putdotio/.github/.github/workflows/frontend-links.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0 diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml deleted file mode 100644 index 486e0b2..0000000 --- a/.github/workflows/scan.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: Scan - -on: - pull_request: - schedule: - - cron: "41 6 * * 1" - workflow_dispatch: - -permissions: {} - -concurrency: - group: scan-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - scan: - permissions: - contents: read - uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0 diff --git a/.gitleaksignore b/.gitleaksignore deleted file mode 100644 index 3c0f8ef..0000000 --- a/.gitleaksignore +++ /dev/null @@ -1,6 +0,0 @@ -# RFC 6238 TOTP test-vector secret ("12345678901234567890" in base32), published in the RFC. -5fd541504783ecb5c77b405777af09a67fb3d3ce:src/internal/totp.test.ts:generic-api-key:6 -5fd541504783ecb5c77b405777af09a67fb3d3ce:src/internal/totp.test.ts:generic-api-key:36 - -# Placeholder Sentry key (0-9a-f twice) in the fixture DSN for org o1, project 123. -17cf2fe9eb269a6d11d97e80cc50603a3bafae1f:src/internal/crash-reporting.test.ts:generic-api-key:477 diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 4ceccaf..303e4a4 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -6,6 +6,8 @@ Every merge to `main` should already be releasable. GitHub Actions owns npm publishing, GitHub Releases, release assets, and Homebrew tap updates. [`ci.yml`](../.github/workflows/ci.yml) runs `vp run verify` (which includes `smoke:pack`) on the secretless job, then `vp run build` and `semantic-release` on the `release` job. +The `verify` job ends with the shared [links and scan actions](https://github.com/putdotio/.github#actionsscan): an offline check of relative Markdown links and anchors on every run, and Actionlint and Zizmor when a push to `main` changes `.github/`. GitHub secret scanning and push protection cover secrets in this public repository. Dispatch `CI` without a tag to verify and lint every workflow without touching a release. + semantic-release publishes npm, writes the version tag, and creates a draft GitHub Release. Binary jobs build from that exact tag and upload all six archive and checksum assets while the Release is mutable. A final job verifies the exact From 2b8bee118e2b5afb0427fcd9205fd46591b6cb00 Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:10:25 +0300 Subject: [PATCH 2/2] docs: say the link check runs on every event --- docs/DISTRIBUTION.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 303e4a4..46569c5 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -6,7 +6,7 @@ Every merge to `main` should already be releasable. GitHub Actions owns npm publishing, GitHub Releases, release assets, and Homebrew tap updates. [`ci.yml`](../.github/workflows/ci.yml) runs `vp run verify` (which includes `smoke:pack`) on the secretless job, then `vp run build` and `semantic-release` on the `release` job. -The `verify` job ends with the shared [links and scan actions](https://github.com/putdotio/.github#actionsscan): an offline check of relative Markdown links and anchors on every run, and Actionlint and Zizmor when a push to `main` changes `.github/`. GitHub secret scanning and push protection cover secrets in this public repository. Dispatch `CI` without a tag to verify and lint every workflow without touching a release. +The `verify` job ends with the shared [links and scan actions](https://github.com/putdotio/.github#actionsscan): an offline check of relative Markdown links and anchors on every event, and Actionlint and Zizmor when a push to `main` changes `.github/`. GitHub secret scanning and push protection cover secrets in this public repository. Dispatch `CI` without a tag to verify and lint every workflow without touching a release. semantic-release publishes npm, writes the version tag, and creates a draft GitHub Release. Binary jobs build from that exact tag and upload all six archive