8000 Starter-workflow by whartondylan · Pull Request #2910 · actions/starter-workflows · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Starter-workflow #2910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open

Starter-workflow #2910

wants to merge 20 commits into from

Conversation

whartondylan
Copy link
@whartondylan whartondylan commented Jun 13, 2025 •
edited
Loading

Pre-requisites

  • Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.

Tasks

For all workflows, the workflow:

  • Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
  • Should use sentence case for the names of workflows and steps (for example, "Run tests").
  • Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
  • Should include comments in the workflow for any parts that are not obvious or could use clarification.
  • Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

  • Should be preserved under the ci directory.
  • Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
  • Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
  • Packaging workflows should run on release with types: [ created ].
  • Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

For Code Scanning workflows, the workflow:

  • Should be preserved under the code-scanning directory.
  • Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
    • name: Name of the Code Scanning integration.
    • creator: Name of the organization/user producing the Code Scanning integration.
    • description: Short description of the Code Scanning integration.
    • categories: Array of languages supported by the Code Scanning integration.
    • iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
  • Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

  • This workflow must only use actions that are produced by GitHub, in the actions organization, or
  • This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file: 
    # This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
  • Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
  • Automation and CI workflows cannot be dependent on a paid service or product.

dependabot bot and others added 17 commits June 7, 2025 14:16
@dependabot
Bump actions/stale from 8 to 9
86cf415 
Bumps [actions/stale](https://github.com/actions/stale) from 8 to 9.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v8...v9)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump pozil/auto-assign-issue from 1.11.0 to 2.2.0
f323ffd 
Bumps [pozil/auto-assign-issue](https://github.com/pozil/auto-assign-issue) from 1.11.0 to 2.2.0.
- [Release notes](https://github.com/pozil/auto-assign-issue/releases)
- [Commits](pozil/auto-assign-issue@v1.11.0...v2.2.0)

---
updated-dependencies:
- dependency-name: pozil/auto-assign-issue
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump kentaro-m/auto-assign-action from 1.2.2 to 2.0.0
061d97b 
Bumps [kentaro-m/auto-assign-action]
8000
(https://github.com/kentaro-m/auto-assign-action) from 1.2.2 to 2.0.0.
- [Release notes](https://github.com/kentaro-m/auto-assign-action/releases)
- [Commits](kentaro-m/auto-assign-action@v1.2.2...v2.0.0)

---
updated-dependencies:
- dependency-name: kentaro-m/auto-assign-action
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/setup-python from 4 to 5
8fa0109 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@whartondylan
Merge pull request #4 from whartondylan/dependabot/github_actions/act…
273d5eb 
…ions/setup-python-5

Bump actions/setup-python from 4 to 5
@whartondylan
Merge pull request #1 from whartondylan/dependabot/github_actions/act…
98bd225 
…ions/stale-9

Bump actions/stale from 8 to 9
@whartondylan
Merge pull request #3 from whartondylan/dependabot/github_actions/ken…
384aebf 
…taro-m/auto-assign-action-2.0.0

Bump kentaro-m/auto-assign-action from 1.2.2 to 2.0.0
@whartondylan
Merge pull request #2 from whartondylan/dependabot/github_actions/poz…
13d671b 
…il/auto-assign-issue-2.2.0

Bump pozil/auto-assign-issue from 1.11.0 to 2.2.0
@whartondylan
Create npm-grunt.yml
be497a5
@whartondylan @github-advanced-security
Potential fix for code scanning alert no. 6: Workflow does not contai…
291b931 
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@whartondylan
Merge pull request #5 from whartondylan/alert-autofix-6
64aee48 
Potential fix for code scanning alert no. 6: Workflow does not contain permissions
@whartondylan @github-advanced-security
Potential fix for code scanning alert no. 4: Workflow does not contai…
9efeeff 
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@whartondylan
Merge pull request #6 from whartondylan/alert-autofix-4
2216061 
Potential fix for code scanning alert no. 4: Workflow does not contain permissions
@whartondylan @github-advanced-security
Potential fix for code scanning alert no. 5: Workflow does not contai…
b8a9d2f 
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@whartondylan
Merge pull request #7 from whartondylan/alert-autofix-5
b7aa44b 
Potential fix for code scanning alert no. 5: Workflow does not contain permissions
@whartondylan @github-advanced-security
Potential fix for code scanning alert no. 3: Workflow does not contai…
e9b9c99 
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@whartondylan
Merge pull request #8 from whartondylan/alert-autofix-3
2c6cc5a 
Potential fix for code scanning alert no. 3: Workflow does not contain permissions
@whartondylan whartondylan requested review from a team as code owners June 13, 2025 18:24
majdialharbi989
majdialharbi989 reviewed Jun 16, 2025
View reviewed changes
.github/workflows/auto-assign-issues.yml
@@ -1,5 +1,9 @@
name: Issue assignment
Copy link
@majdialharbi989 majdialharbi989 Jun 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
name: Issue assignment
name: Issue assignment
Suggested change
name: Issue assignment
name: Issue assignment

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
name: Issue assignment
name: Issue assignment

MAJDI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@majdialharbi989 majdialharbi989 majdialharbi989 left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@whartondylan @majdialharbi989
0