Conversation
ppkarwasz
left a comment
ppkarwasz
left a comment
There was a problem hiding this comment.
Looks good to me, but there are some small points worth correcting.
| name: Analyze | ||
| runs-on: ubuntu-latest | ||
| uses: apache/logging-parent/.github/workflows/codeql-analysis-reusable.yaml@gha/v0 |
There was a problem hiding this comment.
The logging-parent repo does not have any Java code, this is why codeql-analysis was copy-pasted and slightly adapted, instead of using the codeql-analysis-reusable.
| directory: "/" | ||
| schedule: | ||
| interval: daily | ||
| interval: monthly |
There was a problem hiding this comment.
GitHub Actions might need to be updated more often than monthly, but I would apply the recommended cooldown period. In our case, the cooldown period allows the INFRA team to review and allow the new version of the action.
| interval: monthly | |
| interval: weekly | |
| cooldown: | |
| default-days: 7 |
| schedule: | ||
| interval: monthly |
There was a problem hiding this comment.
Same as above: weekly, but with a cooldown.
| schedule: | |
| interval: monthly | |
| schedule: | |
| interval: weekly | |
| cooldown: | |
| default-days: 7 |
| "node_modules/dunder-proto": { | ||
| "version": "1.0.1", | ||
| "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", | ||
| "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", | ||
| "license": "MIT", | ||
| "dependencies": { | ||
| "call-bind-apply-helpers": "^1.0.1", | ||
| "es-errors": "^1.3.0", | ||
| "gopd": "^1.2.0" | ||
| }, | ||
| "engines": { | ||
| "node": ">= 0.4" | ||
| } | ||
| }, |
There was a problem hiding this comment.
I am not sure, why this PR updates the lock file.
| <exclude>.github/ISSUE_TEMPLATE/*.md</exclude> | ||
| <exclude>.github/pull_request_template.md</exclude> | ||
| <!-- `.logging-parent-bom-activator` activates the `bom` Maven profile: --> | ||
| <exclude>.logging-parent-bom-activator</exclude> |
There was a problem hiding this comment.
Nit: alternatively we can use the shortest possible license declaration:
SPDX-License-Identifier: Apache-2.0
2 participants
Document that GHA workflows are moved to
gha/v0, remove mention of automated dependabot PR merge, and dust off some other basic infrastructure.