Skip to content

Ci hardening - #608

Merged
Techassi merged 10 commits into
stackabletech:mainfrom
Saul-STFC:CI-Hardening
Aug 7, 2026
Merged

Ci hardening#608
Techassi merged 10 commits into
stackabletech:mainfrom
Saul-STFC:CI-Hardening

Conversation

@Saul-STFC

@Saul-STFC Saul-STFC commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

This PR introduces a collection of 'correctness fixes' and 'hygiene' improvements to the CI templates:

Including:

  • Fix failure condition to check actual job results e.g a skipped job will silently pass
  • Add missing job dependencies to notify and validate all required jobs in finished
  • Guard build-container-image, publish, provenance, preflight and notify jobs with github.repository_owner == 'stackabletech' so fork PRs no longer queue runners or attempt to push images
  • Pinned deps to latest hashes
  • Some other small hardening improvements

* ci: Bump actions/checkout to v7.0.0
* ci: Add explicit permissions to jobs
* ci: Conditionally install host dependencies without cache
* ci: Conditionally set rust-cache lookup-only
* ci: Skip publish jobs for forks
* ci: Remove checkout step from notify job
@Techassi
Techassi self-requested a review July 14, 2026 18:10
* Prevent notification on cancelled workflows
* Update failure condition to check job results
* Add missing job dependencies to notify job
* Validate required jobs in finished job
* Fix detect-changes globs to cover subdirectory Rust sources
* Match dependency versions across templates
* Guard publish/provenance jobs with stackabletech owner check
* Fix daily security workflow
@Saul-STFC
Saul-STFC marked this pull request as ready for review July 20, 2026 09:24
@sbernauer sbernauer moved this to Development: In Review in Stackable Engineering Aug 4, 2026

@Techassi Techassi left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good to me, thanks!

Just a few minor comments.

Comment thread template/.github/workflows/general_daily_security.yml
Comment thread .github/workflows/generate_prs.yml Outdated
Comment thread .github/workflows/generate_prs.yml Outdated
Comment thread template/.github/workflows/build.yaml.j2
Techassi
Techassi previously approved these changes Aug 5, 2026
@Techassi

Techassi commented Aug 5, 2026

Copy link
Copy Markdown
Member

Ah, seems like a yamllint issue must be fixed.

@Techassi

Techassi commented Aug 6, 2026

Copy link
Copy Markdown
Member

Oh man, now a merge conflict must be resolved 🙈

@Saul-STFC

Copy link
Copy Markdown
Contributor Author

Oh man, now a merge conflict must be resolved 🙈

I've just seen this now :/ ... but fixed :)

Techassi
Techassi previously approved these changes Aug 7, 2026
@Saul-STFC

Copy link
Copy Markdown
Contributor Author

@Techassi just had to merge another commit due to a conflict

@Techassi
Techassi added this pull request to the merge queue Aug 7, 2026
Merged via the queue into stackabletech:main with commit c627577 Aug 7, 2026
2 checks passed
@sbernauer sbernauer moved this from Development: In Review to Development: Done in Stackable Engineering Aug 11, 2026
@lfrancke lfrancke moved this from Development: Done to Done in Stackable Engineering Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

4 participants