Repository navigation
👷 ci: shared workflows and dependency hygiene - #294
Merged
Merged
Conversation
The custom mise-update workflow bumped JDKs with no release age cooldown. Renovate's mise manager with the 7-day minimumReleaseAge does the same job and matches the jetbrains-fish config, so the two plugins stay in step. The JDK major bump stays disabled as in jetbrains-fish.
The GitHub release job ran outside the release environment, so its tag policy did not apply. Move it inside, and grant the marketplace job contents: read like jetbrains-fish. The release environment has no required reviewers, so no new approval gate.
gaborbernat
force-pushed
the
ci/hygiene-2026-11
branch
from
November 4, 2026 01:52
9baa016 to
7e2fe9c
Compare
Renovate should only open pull requests. The dependency dashboard is an issue it keeps updating, so turn it off. The mise manager and the 7 day minimum release age stay as they are.
The shared jetbrains-plugin-check reusable builds, verifies against the PY and PY 263 EAP IDEs, and runs the UI tests, replacing the local build, verify and UI test jobs. Lint and unit tests stay here, and the gate aggregates them with the shared check.
The GitHub Actions analysis moves to the shared CodeQL reusable. Kotlin stays local because the manual Gradle compile has no slot in the shared workflow.
6.5.2 fixes the development plugin archive glob and the mirror README rev update.
Build, signing, Marketplace staging and publishing, release notes, the GitHub Release and the post-release version bump run on the shared reusables. The post-release bump moves from a workflow_run follow-up into the release workflow, after the GitHub Release, so it no longer needs to find the tag run. The marketplace verification stages the public archive with the shared action.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Plugin builds, checks, CodeQL and releases now run on the shared
tox-dev/github-workflowspipeline, pinned to its 6.5.2 release. The layout matches jetbrains-fish.jetbrains-plugin-checkbuilds, verifies against the PY and PY 263 EAP IDEs, and runs the UI tests. The local build, verify and UI test jobs go away. Lint and unit tests stay here.🚦 Required checks passaggregates the shared check with lint and unit tests through therequired-checksaction. The name the rulesets require is unchanged.post-release.yamland intorelease.yaml, after the GitHub Release job. The Marketplace upload job stays here because thereleaseenvironment holds its token.verifymode, instead of the localrelease-creatorcall.The branch also keeps the earlier hygiene:
setup-uvmoves to v10.3.3, the mise bump moves to Renovate withdependencyDashboardset tofalse, and the GitHub Release job runs in thereleaseenvironment.Impact
The release signs with the
CERTIFICATE_CHAINsecret, as before. Tag releases now runverifyPluginand the UI tests before signing. A prerelease tag such asv1.2.3-beta.1publishes to itsbetaMarketplace channel.The post-release version bump opens its PR from the release run instead of a separate
🚀 Releasefollow-up. Its branch name and title are unchanged.Required checks keep their names:
pre-commit.ci - pr,📝 News fragment, and🚦 Required checks pass. The CodeQL and plugin check job names change, and none of them is required.