ci: align workflows with fleet standard (ConductionNL/.github) - #17
Conversation
Wires the repo to the ConductionNL/.github reusable workflows so the two org-required check contexts are reported on every PR.
contents: read plus the issues/pull-requests write the Quality Report PR comment needs (resolves CodeQL actions/missing-workflow-permissions).
WilcoLouwerse
left a comment
WilcoLouwerse
left a comment
There was a problem hiding this comment.
APPROVE — clean CI/CD alignment with the fleet standard (least-privilege permissions, concurrency cancel-in-progress, ConductionNL/.github caller path, standard job IDs).
The caller's permissions block is a static ceiling for every job in the called quality.yml — including disabled ones — so it must cover the widest declared grant (journeydoc/update-baseline/features-extract need contents/actions write; the Quality Report comment needs issues/pull-requests write). Also satisfies CodeQL actions/missing-workflow-permissions and cancels superseded runs.
WilcoLouwerse
left a comment
WilcoLouwerse
left a comment
There was a problem hiding this comment.
Re-review na dismissal: fleet CI-standardisatie via ConductionNL/.github shared workflows (branch-protection + quality), permission ceiling toegevoegd, features.json regen via committed pre-commit hook. Diff blijft binnen .github/workflows/, .githooks/, composer.json, package.json. Aanvullende commits sinds vorige review zijn on-topic (permission ceiling, hook, features regen, merge in van base).
Failing CI-checks zijn geen blocker — de CI-migratie is precies wat deze PR fixt en eventuele resterende faalscenario's zijn z'n eigen scope.
APPROVE.
3 participants
What
Aligns this repo's CI with the fleet standard shared workflows in
ConductionNL/.github(reference: openregister).
Depending on the branch this fixes/adds:
branch-protection.ymlwith caller job idbranch-protection→ check reports asbranch-protection / check-branch(required by the org ruleset)code-quality.ymlas a thin wrapper around the sharedquality.yml→ checks report asquality / …Conduction/.githubreferences (org doesn't exist; correct org isConductionNL)Why
Required checks match on exact names. Wrong job ids, the org typo, and legacy workflow
names left PRs hanging on "Expected — waiting for status to be reported".
The corrected checks run on this PR itself (PR workflows run from the source branch),
so a green merge box here is the proof it works.
After merge
Update the branch protection of
main/betato require the newquality / …contextsand remove any stale
PHP Quality/Frontend Qualityentries.