From 74de92e85e8b9ed68ecc136c0e56b6fb881b0ea8 Mon Sep 17 00:00:00 2001 From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com> Date: Sat, 31 Oct 2026 19:57:12 +0000 Subject: [PATCH 1/4] chore: pass step outputs through env and apply zizmor and actionlint fixes - self-test.yml: the linter step outputs reach the scripts through env instead of ${{ }} inside run (zizmor template-injection). - release.yml: drop the branches filter under the release event, which GitHub ignores (actionlint). - Add the org zizmor config (cpp-linter/* may use any ref) and a 7-day Dependabot cooldown. --- .github/dependabot.yml | 2 ++ .github/workflows/release.yml | 1 - .github/workflows/self-test.yml | 14 ++++++++++---- .github/zizmor.yml | 8 ++++++++ 4 files changed, 20 insertions(+), 5 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e1b2ae63..2b2b0ead 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 10 groups: actions: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b224df2..a1bfaf1b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,7 +2,6 @@ name: Release on: release: - branches: [main] types: [released] workflow_dispatch: inputs: diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index 6ffeee1e..f726a133 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -74,11 +74,15 @@ jobs: - name: Fail fast?! # if: steps.linter.outputs.checks-failed > 0 + env: + CHECKS_FAILED: ${{ steps.linter.outputs.checks-failed }} + TIDY_CHECKS_FAILED: ${{ steps.linter.outputs.clang-tidy-checks-failed }} + FORMAT_CHECKS_FAILED: ${{ steps.linter.outputs.clang-format-checks-failed }} run: | echo "some linter checks failed" - echo "total checks-failed: ${{ steps.linter.outputs.checks-failed }}" - echo "clang-tidy checks-failed: ${{ steps.linter.outputs.clang-tidy-checks-failed }}" - echo "clang-format checks-failed: ${{ steps.linter.outputs.clang-format-checks-failed }}" + echo "total checks-failed: $CHECKS_FAILED" + echo "clang-tidy checks-failed: $TIDY_CHECKS_FAILED" + echo "clang-format checks-failed: $FORMAT_CHECKS_FAILED" # for actual deployment # run: exit 1 @@ -127,6 +131,8 @@ jobs: step-summary: false - name: Assert auto-fix committed the formatting changes + env: + FORMAT_CHECKS_FAILED: ${{ steps.linter.outputs.clang-format-checks-failed }} run: | set -euo pipefail @@ -164,7 +170,7 @@ jobs: exit 1 fi - failed='${{ steps.linter.outputs.clang-format-checks-failed }}' + failed="$FORMAT_CHECKS_FAILED" if [ "${failed:-0}" != "0" ]; then echo "::error title=auto-fix::clang-format still reports $failed issue(s) after auto-fix" exit 1 diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..bf8fd1a0 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,8 @@ +rules: + unpinned-uses: + config: + policies: + actions/*: ref-pin + github/*: ref-pin + dependabot/*: ref-pin + cpp-linter/*: any From 6c257755acd6189c3d0de95128c0366462b7691d Mon Sep 17 00:00:00 2001 From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:01:53 +0000 Subject: [PATCH 2/4] chore: run the pre-commit workflow again when a PR title is edited The workflow checks the PR title, but did not run on the edited event, so fixing a rejected title left the check failing until the next push. ccache-wheel and cpp-linter/.github already run on edited. --- .github/workflows/pre-commit.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 104ce5b9..27560dab 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -4,6 +4,8 @@ on: push: branches: [main] pull_request: + # edited: check the PR title again after it is changed + types: [opened, synchronize, reopened, edited] branches: [main] permissions: {} From 99cd60cbbe13f042e3fc8fa91e17fa842a062b94 Mon Sep 17 00:00:00 2001 From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:06:11 +0000 Subject: [PATCH 3/4] chore: drop per-repo zizmor config and run the fail-fast step in bash --- .github/workflows/self-test.yml | 1 + .github/zizmor.yml | 8 -------- 2 files changed, 1 insertion(+), 8 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index f726a133..386b063a 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -74,6 +74,7 @@ jobs: - name: Fail fast?! # if: steps.linter.outputs.checks-failed > 0 + shell: bash env: CHECKS_FAILED: ${{ steps.linter.outputs.checks-failed }} TIDY_CHECKS_FAILED: ${{ steps.linter.outputs.clang-tidy-checks-failed }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index bf8fd1a0..00000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,8 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - actions/*: ref-pin - github/*: ref-pin - dependabot/*: ref-pin - cpp-linter/*: any From 4c7b21abfbeecb06fee6b35f3a6624a6e27b4961 Mon Sep 17 00:00:00 2001 From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:27:39 +0000 Subject: [PATCH 4/4] chore: treat checks-failed as a string in the commented-out condition --- .github/workflows/self-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index 386b063a..c3a6130e 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -73,7 +73,7 @@ jobs: extra-args: -std=c++14 -Wall - name: Fail fast?! - # if: steps.linter.outputs.checks-failed > 0 + # if: ${{ !contains(fromJSON('["0", ""]'), steps.linter.outputs.checks-failed) }} shell: bash env: CHECKS_FAILED: ${{ steps.linter.outputs.checks-failed }}