[docs] Make CI maintenance expectations explicit - #5672
Conversation
maru-ava
added
the
documentation
d9a2f89 to
5357057
Compare
b8ab901 to
b533975
Compare
8fdd396 to
de7b1ad
Compare
4d722e8 to
41d64db
Compare
There was a problem hiding this comment.
Pull request overview
This PR documents CI conventions for the repository and backs them with additional mechanical linting, while updating existing workflows/actions to comply with the new “pin third-party actions by SHA” rule.
Changes:
- Add
docs/ci.mdand wire it into the docs index to make CI maintenance expectations explicit. - Strengthen
scripts/actionlint.shto reject floating refs for non-actions/*external actions. - Update workflows and a composite action to pin third-party actions to full commit SHAs; add a workflow helper script for tgz packaging and switch the workflow to use it.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
scripts/workflow-build-tgz-pkg.sh |
New CI helper script to build and upload tgz artifacts for avalanchego and subnet-evm. |
scripts/actionlint.sh |
Adds a repository-wide check to forbid floating refs for third-party actions outside actions/*. |
docs/README.md |
Adds CI documentation entry to the docs index. |
docs/ci.md |
New cross-cutting CI conventions doc (runner labels, pinning actions, CI organization). |
.github/workflows/firewood-chaos-test.yml |
Pins aws-actions/configure-aws-credentials to a commit SHA. |
.github/workflows/claude-review.yml |
Pins anthropics/claude-code-action to a commit SHA. |
.github/workflows/build-macos-release.yml |
Pins aws-actions/configure-aws-credentials to a commit SHA. |
.github/workflows/build-linux-packages.yml |
Pins aws-actions/configure-aws-credentials to a commit SHA. |
.github/workflows/build-linux-binaries.yml |
Pins aws-actions/configure-aws-credentials and switches tgz packaging step to ./scripts/workflow-build-tgz-pkg.sh. |
.github/README.md |
New overview of GitHub-specific repository configuration with pointers to CI docs. |
.github/actions/c-chain-reexecution-benchmark/action.yml |
Pins aws-actions/configure-aws-credentials and benchmark-action/github-action-benchmark to commit SHAs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
b1e88c1 to
16f19fc
Compare
JonathanOppenheimer
left a comment
JonathanOppenheimer
left a comment
There was a problem hiding this comment.
Reads very well to me -- the only real actionable thing here, is I don't believe we want to replace the repositories readme.
JuanLeon2
left a comment
JuanLeon2
left a comment
There was a problem hiding this comment.
Thank you for doing this.
I made some comments. None of them are blockers. I am approving.
|
|
||
| ## Principles | ||
|
|
||
| - **Minimize work done only in CI.** Put repository operations that contributors |
There was a problem hiding this comment.
quibble: a lot of work is typically only done from/within CI, even if it is defined in Taskfile.yml and invoked thereto from Github Actions. An inexperienced person might construe this principle to be something like "if this would typically be done only in CI don't do it at all". Not sure how to address this quibble and therefore maybe leave things as they are.
Perhaps emphasize DRY instead. ANythign worth doing in CI -- other than pure git ops? -- should also be doable locally. And there should be only one version.
There was a problem hiding this comment.
Updated headline to 'Define locally runnable operations outside CI'
| A full [commit SHA](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions) | ||
| is immutable. A tag can move. | ||
|
|
||
| Add a `# v<version>` comment after every pinned SHA. The comment identifies the |
There was a problem hiding this comment.
Not sure what you mean?
Document the CI conventions that keep workflow behavior reproducible and supply-chain updates reviewable and ensure mechanical checks where reasonable to do so. Change-Id: Ib194e94678b49acd6278845558d00f09ac8445ce
Change-Id: I71cd7107e2525391795823caff0b1f89d41a1dbc
Change-Id: I8aa29fb7382a963d6409bb36ba3309cd11c7284c
Why this should be merged
Document the CI conventions that keep workflow behavior reproducible and supply-chain updates reviewable and ensure mechanical checks where reasonable to do so.