From db3e91486ee31bd43c699bc4a73016b2de9f0dfb Mon Sep 17 00:00:00 2001 From: Florence Njeri Date: Sat, 22 Aug 2026 00:44:26 +0200 Subject: [PATCH 1/4] define permissions and pin actions to SHA --- .github/workflows/bump.yml | 7 +- .github/workflows/local-generate-files.yml | 16 ++- .github/workflows/manual_netlify_preview.yml | 97 +++++++++++++++++++ .github/workflows/pr-review-checklist.yml | 9 +- .../pr-testing-with-test-project.yml | 35 +++++-- .github/workflows/release-with-changesets.yml | 28 ++++-- .github/workflows/update-docs-in-website.yml | 28 ++++-- .../workflows/update-maintainers-trigger.yaml | 1 + .github/workflows/update-maintainers.yml | 30 ++++-- .github/workflows/verify-docs-up-to-date.yml | 2 +- 10 files changed, 211 insertions(+), 42 deletions(-) create mode 100644 .github/workflows/manual_netlify_preview.yml diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml index 77b3a97938..b9474cb25c 100644 --- a/.github/workflows/bump.yml +++ b/.github/workflows/bump.yml @@ -1,12 +1,13 @@ name: Bump package version in dependent repos on: + workflow_dispatch: # It cannot run on release event as when release is created then version is not yet bumped in package.json # This means we cannot extract easily latest version and have a risk that package is not yet on npm push: branches: - master - +permissions: {} jobs: bump-in-dependent-projects: name: Bump this package in repositories that depend on it @@ -14,7 +15,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repo - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Bumping latest version of this package in other repositories uses: derberg/npm-dependency-manager-for-your-github-org@1eafd3bf3974f21d395c1abac855cb04b295d570 # using v6.-.- https://github.com/derberg/npm-dependency-manager-for-your-github-org/releases/tag/v6 with: diff --git a/.github/workflows/local-generate-files.yml b/.github/workflows/local-generate-files.yml index 90139bb7f5..1120a8bbac 100644 --- a/.github/workflows/local-generate-files.yml +++ b/.github/workflows/local-generate-files.yml @@ -1,10 +1,13 @@ # this workflow runs after releases to generate some files like for example api.md name: Autogenerate API files -on: +on: + workflow_dispatch: release: types: - published + +permissions: {} jobs: version_bump: @@ -12,22 +15,25 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # target branch of release. More info https://docs.github.com/en/rest/reference/repos#releases # in case release is created from release branch then we need to checkout from given branch # if @semantic-release/github is used to publish, the minimum version is 7.2.0 for proper working ref: ${{ github.event.release.target_commitish }} + persist-credentials: false + - name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "${{ steps.lockversion.outputs.version }}" + cache: '' # disable default npm cache which prevents cache-poisoning on release artifacts - name: Install dependencies run: npm ci - name: Assets generation @@ -44,7 +50,7 @@ jobs: branch: assets-update/${{github.event.release.tag_name}} - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel name: Report workflow run status to Slack - uses: 8398a7/action-slack@v3 + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 with: status: ${{ job.status }} fields: repo,action,workflow diff --git a/.github/workflows/manual_netlify_preview.yml b/.github/workflows/manual_netlify_preview.yml new file mode 100644 index 0000000000..440f1d49aa --- /dev/null +++ b/.github/workflows/manual_netlify_preview.yml @@ -0,0 +1,97 @@ +name: Docs Preview Deploy (Netlify) + +on: + workflow_run: + workflows: ["Docs Preview Build (Netlify)"] + types: [completed] + +permissions: + contents: read + pull-requests: write # only for the comment step + actions: read # to download artifacts from the triggering run + +jobs: + deploy: + if: > + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' + runs-on: ubuntu-latest + # Require a maintainer review before any secret is exposed: + environment: docs-preview + steps: + - name: Download built site artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: docs-preview-site + path: site + github-token: ${{ secrets.GITHUB_TOKEN }} + run-id: ${{ github.event.workflow_run.id }} + + - name: Download PR metadata artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: docs-preview-pr-meta + path: pr-meta + github-token: ${{ secrets.GITHUB_TOKEN }} + run-id: ${{ github.event.workflow_run.id }} + + - name: Read PR number + id: pr + run: | + set -euo pipefail + PR=$(cat pr-meta/pr-number.txt | tr -dc '0-9') + if [ -z "$PR" ]; then echo "Invalid PR number"; exit 1; fi + echo "number=$PR" >> "$GITHUB_OUTPUT" + + - name: Setup Node + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: 'lts/*' + + - name: Install jq + run: | + sudo apt-get update && sudo apt-get install -y jq + + - name: Install Netlify CLI + run: npm i -g netlify-cli@23.9.5 + + - name: Deploy docs draft preview to Netlify + id: deploy + env: + NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }} + NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }} + PR_NUMBER: ${{ steps.pr.outputs.number }} + run: | + set -euo pipefail + # Prefer the static export; only fall back to .next when it's absent. + if [ -d "site/out" ]; then + DEPLOY_DIR="site/out" + elif [ -d "site/.next" ]; then + DEPLOY_DIR="site/.next" + else + echo "No deployable directory found (expected site/out or site/.next)"; exit 1 + fi + + DEPLOY_JSON=$(netlify deploy \ + --auth "$NETLIFY_AUTH_TOKEN" \ + --site "$NETLIFY_SITE_ID" \ + --dir "$DEPLOY_DIR" \ + --message "generator repo PR #${PR_NUMBER}" \ + --draft \ + --json) + + echo "$DEPLOY_JSON" + URL=$(echo "$DEPLOY_JSON" | jq -r '.deploy_url') + echo "url=$URL" >> "$GITHUB_OUTPUT" + + - name: Comment preview URL on PR + if: success() + uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + pr-number: ${{ steps.pr.outputs.number }} + comment-tag: netlify-docs-preview + message: | + 🚀 **Docs preview deployed** + Below link points directly to the generator docs preview. May the force be with you! + → ${{ steps.deploy.outputs.url }}/docs/tools/generator diff --git a/.github/workflows/pr-review-checklist.yml b/.github/workflows/pr-review-checklist.yml index c63792ab51..cbc3b2f79c 100644 --- a/.github/workflows/pr-review-checklist.yml +++ b/.github/workflows/pr-review-checklist.yml @@ -1,10 +1,13 @@ name: PR Review Checklist on: + workflow_dispatch: pull_request_target: types: - opened +permissions: {} + jobs: pr-review-list: name: Post PR Review Checklist @@ -14,9 +17,13 @@ jobs: github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot-preview[bot]') runs-on: ubuntu-latest + permissions: + pull-requests: write # permission to create-or-update-comment posts to the PR thread steps: - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # read-only; only used to access .github/pr-review-checklist.md - name: Post initial PR checklist uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 #v4.0.0 https://github.com/peter-evans/create-or-update-comment/releases/tag/v4.0.0 diff --git a/.github/workflows/pr-testing-with-test-project.yml b/.github/workflows/pr-testing-with-test-project.yml index 72dff12ca8..4c1fecaa11 100644 --- a/.github/workflows/pr-testing-with-test-project.yml +++ b/.github/workflows/pr-testing-with-test-project.yml @@ -2,16 +2,23 @@ name: Test using test project on: + workflow_dispatch: pull_request: types: [opened, reopened, synchronize, ready_for_review] - +# Revokes default permissions since all jobs only need read access. +permissions: {} jobs: changes: runs-on: ubuntu-latest + permissions: + contents: read # checkout + pull-requests: read # paths-filter reads PR diff outputs: should_test: ${{ steps.should_run.outputs.shouldrun }} steps: - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Checks paths-filter uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 https://github.com/dorny/paths-filter/releases/tag/v4.0.1 id: filter @@ -38,7 +45,7 @@ jobs: startsWith(github.event.pull_request.title, 'ci: update of files from global .github repo') || startsWith(github.event.pull_request.title, 'chore(release):') )) || - (github.actor == 'allcontributors[bot]' && + (github.actor_id == '46447321' && startsWith(github.event.pull_request.title, 'docs: add') ) ) @@ -50,12 +57,18 @@ jobs: needs: changes name: Test generator as dependency with Node 24 runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Log should_test value across jobs #it has to stay here for some time for debugging + env: + SHOULD_TEST: ${{ needs.changes.outputs.should_test }} run: | - echo "should_test value: ${{ needs.changes.outputs.should_test }}" + echo "should_test value: ${SHOULD_TEST}" - if: needs.changes.outputs.should_test == 'true' name: Run test run: NODE_VERSION=24 docker compose up --abort-on-container-exit --force-recreate @@ -66,6 +79,8 @@ jobs: needs: changes name: Acceptance tests (${{ matrix.language }}) runs-on: ubuntu-latest + permissions: + contents: read strategy: fail-fast: false @@ -74,16 +89,20 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Log should_test value across jobs #it has to stay here for some time for debugging + env: + SHOULD_TEST: ${{ needs.changes.outputs.should_test }} run: | - echo "should_test value: ${{ needs.changes.outputs.should_test }}" + echo "should_test value: ${SHOULD_TEST}" - name: Check package-lock version if: needs.changes.outputs.should_test == 'true' # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} diff --git a/.github/workflows/release-with-changesets.yml b/.github/workflows/release-with-changesets.yml index 4302cc389e..7973e5f8d2 100644 --- a/.github/workflows/release-with-changesets.yml +++ b/.github/workflows/release-with-changesets.yml @@ -2,10 +2,14 @@ name: Release on: + workflow_dispatch: push: branches: - master +# revoke default permissions +permissions: {} + jobs: test-nodejs: # We just check the message of the first commit as there is always just one commit because we squash into one before merging @@ -20,6 +24,8 @@ jobs: startsWith( github.event.commits[0].message, 'feat!:' )) name: Test NodeJS release on ${{ matrix.os }} runs-on: ${{ matrix.os }} + permissions: + contents: read # no write permissions needed for testing strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] @@ -30,7 +36,9 @@ jobs: git config --global core.eol lf shell: bash - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Check if Node.js project and has package.json id: packagejson run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT @@ -38,13 +46,13 @@ jobs: - if: steps.packagejson.outputs.exists == 'true' name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} - if: steps.packagejson.outputs.exists == 'true' name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "${{ steps.lockversion.outputs.version }}" registry-url: "https://registry.npmjs.org" @@ -62,7 +70,7 @@ jobs: run: npm test --if-present - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel name: Report workflow run status to Slack - uses: 8398a7/action-slack@v3 + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 with: status: ${{ job.status }} fields: repo,action,workflow @@ -84,20 +92,22 @@ jobs: git config --global core.autocrlf false git config --global core.eol lf - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Check if Node.js project and has package.json id: packagejson run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT shell: bash - if: steps.packagejson.outputs.exists == 'true' name: Check package-lock version - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master with: node-version: ${{ vars.NODE_VERSION }} id: lockversion - if: steps.packagejson.outputs.exists == 'true' name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "${{ steps.lockversion.outputs.version }}" - if: steps.packagejson.outputs.exists == 'true' @@ -112,7 +122,7 @@ jobs: - if: steps.packagejson.outputs.exists == 'true' name: Publish to any of NPM, Github, and Docker Hub #this step has 2 goals, it is either identifying that there is changeset file created and then this action creates a PR with version bump that will trigger release - or if it sees there is no changeset, and there are versions changes in package.json files, it publish new versions to NPM is they are not there yet - uses: changesets/action@v1 + uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b #v1.8.0 id: release with: # `changeset version` only rewrites package.json/CHANGELOG files; it never runs an @@ -133,7 +143,7 @@ jobs: GIT_COMMITTER_EMAIL: info@asyncapi.io - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci Slack channel name: Report workflow run status to Slack - uses: 8398a7/action-slack@v3 + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 with: status: ${{ job.status }} fields: repo,action,workflow diff --git a/.github/workflows/update-docs-in-website.yml b/.github/workflows/update-docs-in-website.yml index 7501f25655..6225e8016f 100644 --- a/.github/workflows/update-docs-in-website.yml +++ b/.github/workflows/update-docs-in-website.yml @@ -1,6 +1,7 @@ name: Update latest generator documentation in the website on: + workflow_dispatch: push: branches: - 'master' @@ -8,32 +9,45 @@ on: - 'apps/generator/docs/*.md' - '.github/workflows/update-docs-in-website.yml' +permissions: {} + jobs: Make-PR: name: Make PR on website repository with updated latest generator documentation runs-on: ubuntu-latest + permissions: + contents: write # push to asyncapi/website via PAT + pull-requests: write # gh pr create env: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} steps: - name: Checkout Current repository - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: generator - - name: Checkout Another repository - uses: actions/checkout@v3 + persist-credentials: false # since this repo only used for reading docs + - name: Checkout The Website repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: asyncapi/website path: website token: ${{ env.GITHUB_TOKEN }} + persist-credentials: true # needed for git push of the docs to the website repo + - name: Config git + working-directory: ./website run: | git config --global user.name asyncapi-bot git config --global user.email info@asyncapi.io + - name: Create branch working-directory: ./website + env: + SHA: ${{ github.sha }} run: | - git checkout -b update-generator-docs-${{ github.sha }} - - name: Copy generator folder from Current Repo to Another + git checkout -b "update-generator-docs-${SHA}" + + - name: Copy generator folder to the website repo working-directory: ./website run: | rm -r ./markdown/docs/tools/generator @@ -42,12 +56,14 @@ jobs: rm -r ../generator/apps/generator/docs/jsdoc2md-handlebars printf "%s\ntitle: Generator\nweight: 3\n%s" "---" "---"> ../generator/apps/generator/docs/_section.md mv ../generator/apps/generator/docs/*.md ./markdown/docs/tools/generator + - name: Commit and push working-directory: ./website run: | git add . git commit -m "docs(generator): update latest generator docs" - git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/website + git push origin HEAD + - name: Create PR working-directory: ./website run: | diff --git a/.github/workflows/update-maintainers-trigger.yaml b/.github/workflows/update-maintainers-trigger.yaml index 92656a1c18..f0d9a7e35c 100644 --- a/.github/workflows/update-maintainers-trigger.yaml +++ b/.github/workflows/update-maintainers-trigger.yaml @@ -4,6 +4,7 @@ name: Trigger MAINTAINERS.yaml file update on: + workflow_dispatch: push: branches: [ master ] paths: diff --git a/.github/workflows/update-maintainers.yml b/.github/workflows/update-maintainers.yml index c4cd1baa47..ab49ebb3ad 100644 --- a/.github/workflows/update-maintainers.yml +++ b/.github/workflows/update-maintainers.yml @@ -7,6 +7,9 @@ on: paths: - 'CODEOWNERS' +# Deny-all for the built-in GITHUB_TOKEN; the job uses secrets.GH_TOKEN (PAT) for cross-repo writes. +permissions: {} + jobs: update-maintainers: runs-on: ubuntu-latest @@ -14,31 +17,34 @@ jobs: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} steps: - name: Checkout main branch - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: master path: current_state + persist-credentials: false - name: Checkout one commit before last one - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 ref: master path: previous_state + persist-credentials: false - run: cd previous_state && git checkout HEAD^ - name: Checkout community repo - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: asyncapi/community token: ${{ env.GITHUB_TOKEN }} path: community + persist-credentials: true # needed for the `git push` later - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '16' + node-version: '20' - name: Install js-yaml run: npm install js-yaml@3.14.1 @@ -47,7 +53,7 @@ jobs: id: compare-codeowners env: GH_TOKEN: ${{ env.GITHUB_TOKEN }} - uses: actions/github-script@v6 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('fs'); @@ -149,8 +155,10 @@ jobs: - name: Create new branch working-directory: ./community + env: + RUN_ID: ${{ github.run_id }} run: | - git checkout -b update-maintainers-${{ github.run_id }} + git checkout -b update-maintainers-${RUN_ID} - name: Commit and push working-directory: ./community @@ -159,17 +167,19 @@ jobs: git config --global user.name "asyncapi-bot" git add . git commit -m "Update MAINTAINERS.yaml" - git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/community + git push origin HEAD - name: Create PR working-directory: ./community + env: + RUN_ID: ${{ github.run_id }} run: | - gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${{ github.run_id }} + gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${RUN_ID} - name: Report workflow run status to Slack if: failure() # Only, on failure, send a message on the slack channel - uses: rtCamp/action-slack-notify@v2 + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 #v2.3.3 env: SLACK_WEBHOOK: ${{ secrets.SLACK_CI_FAIL_NOTIFY }} SLACK_TITLE: 🚨 Update maintainers list action failed 🚨 diff --git a/.github/workflows/verify-docs-up-to-date.yml b/.github/workflows/verify-docs-up-to-date.yml index 4fe38cba7b..7fd657f78e 100644 --- a/.github/workflows/verify-docs-up-to-date.yml +++ b/.github/workflows/verify-docs-up-to-date.yml @@ -31,7 +31,7 @@ jobs: - name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # //NOSONAR + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} From eb41e17b2a2da610747fe1f421cd77d4f04e959a Mon Sep 17 00:00:00 2001 From: Florence Njeri Date: Sat, 22 Aug 2026 00:45:36 +0200 Subject: [PATCH 2/4] resolve pwn request --- .github/workflows/manual-netlify-build.yml | 70 +++++++++++++++++ .github/workflows/manual-netlify-preview.yml | 80 -------------------- 2 files changed, 70 insertions(+), 80 deletions(-) create mode 100644 .github/workflows/manual-netlify-build.yml delete mode 100644 .github/workflows/manual-netlify-preview.yml diff --git a/.github/workflows/manual-netlify-build.yml b/.github/workflows/manual-netlify-build.yml new file mode 100644 index 0000000000..c12b30da60 --- /dev/null +++ b/.github/workflows/manual-netlify-build.yml @@ -0,0 +1,70 @@ +name: Docs Preview Build (Netlify) + +on: + workflow_dispatch: + pull_request: + paths: + - 'apps/generator/docs/**' +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - name: Checkout generator PR + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false + + - name: Checkout website repo + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: asyncapi/website + path: website + fetch-depth: 1 + persist-credentials: false + + - name: Sync docs into website + run: | + rm -rf website/markdown/docs/tools/generator/* + cp -R apps/generator/docs/* website/markdown/docs/tools/generator/ + rm -f website/markdown/docs/tools/generator/README.md + rm -rf website/markdown/docs/tools/generator/jsdoc2md-handlebars + printf "%s\ntitle: Generator\nweight: 3\n%s" "---" "---"> website/markdown/docs/tools/generator/_section.md + + - name: Setup Node + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + + - name: Install deps + working-directory: website + run: | + npm ci + + - name: Build website + working-directory: website + run: npm run build + + # Stash the PR number so the deploy workflow knows where to comment. + - name: Save PR metadata + run: | + mkdir -p ./pr-meta + echo "${{ github.event.number }}" > ./pr-meta/pr-number.txt + + - name: Upload built site + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + with: + name: docs-preview-site + path: | + website/out + website/.next + website/public + if-no-files-found: warn + + - name: Upload PR metadata + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + with: + name: docs-preview-pr-meta + path: ./pr-meta diff --git a/.github/workflows/manual-netlify-preview.yml b/.github/workflows/manual-netlify-preview.yml deleted file mode 100644 index 1b6680c781..0000000000 --- a/.github/workflows/manual-netlify-preview.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Docs Preview (Netlify) - -on: - pull_request_target: - paths: - - 'apps/generator/docs/**' - -concurrency: - group: docs-preview-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - preview: - runs-on: ubuntu-latest - - steps: - - name: Checkout generator PR - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha }} - - - name: Checkout website repo - uses: actions/checkout@v5 - with: - repository: asyncapi/website - path: website - fetch-depth: 1 - - - name: Sync docs into website - run: | - rm -rf website/markdown/docs/tools/generator/* - cp -R apps/generator/docs/* website/markdown/docs/tools/generator/ - rm website/markdown/docs/tools/generator/README.md - rm -r website/markdown/docs/tools/generator/jsdoc2md-handlebars - printf "%s\ntitle: Generator\nweight: 3\n%s" "---" "---"> website/markdown/docs/tools/generator/_section.md - - - name: Setup Node - uses: actions/setup-node@v6 - - - name: Install jq - run: | - sudo apt-get update && sudo apt-get install -y jq - - - name: Install Netlify CLI - run: npm i -g netlify-cli@23.9.5 - - - name: Install deps - working-directory: website - run: | - npm ci - - - name: Build and deploy draft preview to Netlify - id: deploy - working-directory: website - env: - NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }} - NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }} - run: | - set -e - # Build and deploy built files to Netlify - DEPLOY_JSON=$(netlify deploy \ - --auth "$NETLIFY_AUTH_TOKEN" \ - --site "$NETLIFY_SITE_ID" \ - --message "generator repo PR #${{ github.event.number }}" \ - --draft \ - --json) - - echo "$DEPLOY_JSON" - echo "url=$(echo "$DEPLOY_JSON" | jq -r '.deploy_url')" >> "$GITHUB_OUTPUT" - - - name: Comment preview URL on PR - if: success() - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b #v3.0.1 release https://github.com/thollander/actions-comment-pull-request/releases/tag/v3.0.1 - with: - github-token: ${{ secrets.GH_TOKEN }} - message: | - 🚀 **Docs preview deployed** - Below link points directly to the generator docs preview. May the force be with you! - → ${{ steps.deploy.outputs.url }}/docs/tools/generator - comment-tag: netlify-docs-preview \ No newline at end of file From b175d0d526e8548a7acc347ebd1010bd971b65f0 Mon Sep 17 00:00:00 2001 From: Florence Njeri Date: Sat, 22 Aug 2026 00:52:20 +0200 Subject: [PATCH 3/4] chore(workflows): remove non-netlify workflow changes from PR --- .github/workflows/bump.yml | 7 ++-- .github/workflows/local-generate-files.yml | 16 +++------ .github/workflows/pr-review-checklist.yml | 9 +---- .../pr-testing-with-test-project.yml | 35 +++++-------------- .github/workflows/release-with-changesets.yml | 28 +++++---------- .github/workflows/update-docs-in-website.yml | 28 ++++----------- .../workflows/update-maintainers-trigger.yaml | 1 - .github/workflows/update-maintainers.yml | 30 ++++++---------- .github/workflows/verify-docs-up-to-date.yml | 2 +- 9 files changed, 42 insertions(+), 114 deletions(-) diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml index b9474cb25c..77b3a97938 100644 --- a/.github/workflows/bump.yml +++ b/.github/workflows/bump.yml @@ -1,13 +1,12 @@ name: Bump package version in dependent repos on: - workflow_dispatch: # It cannot run on release event as when release is created then version is not yet bumped in package.json # This means we cannot extract easily latest version and have a risk that package is not yet on npm push: branches: - master -permissions: {} + jobs: bump-in-dependent-projects: name: Bump this package in repositories that depend on it @@ -15,9 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + uses: actions/checkout@v3 - name: Bumping latest version of this package in other repositories uses: derberg/npm-dependency-manager-for-your-github-org@1eafd3bf3974f21d395c1abac855cb04b295d570 # using v6.-.- https://github.com/derberg/npm-dependency-manager-for-your-github-org/releases/tag/v6 with: diff --git a/.github/workflows/local-generate-files.yml b/.github/workflows/local-generate-files.yml index 1120a8bbac..90139bb7f5 100644 --- a/.github/workflows/local-generate-files.yml +++ b/.github/workflows/local-generate-files.yml @@ -1,13 +1,10 @@ # this workflow runs after releases to generate some files like for example api.md name: Autogenerate API files -on: - workflow_dispatch: +on: release: types: - published - -permissions: {} jobs: version_bump: @@ -15,25 +12,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v3 with: # target branch of release. More info https://docs.github.com/en/rest/reference/repos#releases # in case release is created from release branch then we need to checkout from given branch # if @semantic-release/github is used to publish, the minimum version is 7.2.0 for proper working ref: ${{ github.event.release.target_commitish }} - persist-credentials: false - - name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@v6 with: node-version: "${{ steps.lockversion.outputs.version }}" - cache: '' # disable default npm cache which prevents cache-poisoning on release artifacts - name: Install dependencies run: npm ci - name: Assets generation @@ -50,7 +44,7 @@ jobs: branch: assets-update/${{github.event.release.tag_name}} - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel name: Report workflow run status to Slack - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: 8398a7/action-slack@v3 with: status: ${{ job.status }} fields: repo,action,workflow diff --git a/.github/workflows/pr-review-checklist.yml b/.github/workflows/pr-review-checklist.yml index cbc3b2f79c..c63792ab51 100644 --- a/.github/workflows/pr-review-checklist.yml +++ b/.github/workflows/pr-review-checklist.yml @@ -1,13 +1,10 @@ name: PR Review Checklist on: - workflow_dispatch: pull_request_target: types: - opened -permissions: {} - jobs: pr-review-list: name: Post PR Review Checklist @@ -17,13 +14,9 @@ jobs: github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot-preview[bot]') runs-on: ubuntu-latest - permissions: - pull-requests: write # permission to create-or-update-comment posts to the PR thread steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false # read-only; only used to access .github/pr-review-checklist.md + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2 - name: Post initial PR checklist uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 #v4.0.0 https://github.com/peter-evans/create-or-update-comment/releases/tag/v4.0.0 diff --git a/.github/workflows/pr-testing-with-test-project.yml b/.github/workflows/pr-testing-with-test-project.yml index 4c1fecaa11..72dff12ca8 100644 --- a/.github/workflows/pr-testing-with-test-project.yml +++ b/.github/workflows/pr-testing-with-test-project.yml @@ -2,23 +2,16 @@ name: Test using test project on: - workflow_dispatch: pull_request: types: [opened, reopened, synchronize, ready_for_review] -# Revokes default permissions since all jobs only need read access. -permissions: {} + jobs: changes: runs-on: ubuntu-latest - permissions: - contents: read # checkout - pull-requests: read # paths-filter reads PR diff outputs: should_test: ${{ steps.should_run.outputs.shouldrun }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3 - name: Checks paths-filter uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 https://github.com/dorny/paths-filter/releases/tag/v4.0.1 id: filter @@ -45,7 +38,7 @@ jobs: startsWith(github.event.pull_request.title, 'ci: update of files from global .github repo') || startsWith(github.event.pull_request.title, 'chore(release):') )) || - (github.actor_id == '46447321' && + (github.actor == 'allcontributors[bot]' && startsWith(github.event.pull_request.title, 'docs: add') ) ) @@ -57,18 +50,12 @@ jobs: needs: changes name: Test generator as dependency with Node 24 runs-on: ubuntu-latest - permissions: - contents: read steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - name: Log should_test value across jobs #it has to stay here for some time for debugging - env: - SHOULD_TEST: ${{ needs.changes.outputs.should_test }} run: | - echo "should_test value: ${SHOULD_TEST}" + echo "should_test value: ${{ needs.changes.outputs.should_test }}" - if: needs.changes.outputs.should_test == 'true' name: Run test run: NODE_VERSION=24 docker compose up --abort-on-container-exit --force-recreate @@ -79,8 +66,6 @@ jobs: needs: changes name: Acceptance tests (${{ matrix.language }}) runs-on: ubuntu-latest - permissions: - contents: read strategy: fail-fast: false @@ -89,20 +74,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3 - name: Log should_test value across jobs #it has to stay here for some time for debugging - env: - SHOULD_TEST: ${{ needs.changes.outputs.should_test }} run: | - echo "should_test value: ${SHOULD_TEST}" + echo "should_test value: ${{ needs.changes.outputs.should_test }}" - name: Check package-lock version if: needs.changes.outputs.should_test == 'true' # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} diff --git a/.github/workflows/release-with-changesets.yml b/.github/workflows/release-with-changesets.yml index 7973e5f8d2..4302cc389e 100644 --- a/.github/workflows/release-with-changesets.yml +++ b/.github/workflows/release-with-changesets.yml @@ -2,14 +2,10 @@ name: Release on: - workflow_dispatch: push: branches: - master -# revoke default permissions -permissions: {} - jobs: test-nodejs: # We just check the message of the first commit as there is always just one commit because we squash into one before merging @@ -24,8 +20,6 @@ jobs: startsWith( github.event.commits[0].message, 'feat!:' )) name: Test NodeJS release on ${{ matrix.os }} runs-on: ${{ matrix.os }} - permissions: - contents: read # no write permissions needed for testing strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] @@ -36,9 +30,7 @@ jobs: git config --global core.eol lf shell: bash - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + uses: actions/checkout@v4 - name: Check if Node.js project and has package.json id: packagejson run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT @@ -46,13 +38,13 @@ jobs: - if: steps.packagejson.outputs.exists == 'true' name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master id: lockversion with: node-version: ${{ vars.NODE_VERSION }} - if: steps.packagejson.outputs.exists == 'true' name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@v4 with: node-version: "${{ steps.lockversion.outputs.version }}" registry-url: "https://registry.npmjs.org" @@ -70,7 +62,7 @@ jobs: run: npm test --if-present - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel name: Report workflow run status to Slack - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: 8398a7/action-slack@v3 with: status: ${{ job.status }} fields: repo,action,workflow @@ -92,22 +84,20 @@ jobs: git config --global core.autocrlf false git config --global core.eol lf - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false + uses: actions/checkout@v4 - name: Check if Node.js project and has package.json id: packagejson run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT shell: bash - if: steps.packagejson.outputs.exists == 'true' name: Check package-lock version - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master with: node-version: ${{ vars.NODE_VERSION }} id: lockversion - if: steps.packagejson.outputs.exists == 'true' name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@v4 with: node-version: "${{ steps.lockversion.outputs.version }}" - if: steps.packagejson.outputs.exists == 'true' @@ -122,7 +112,7 @@ jobs: - if: steps.packagejson.outputs.exists == 'true' name: Publish to any of NPM, Github, and Docker Hub #this step has 2 goals, it is either identifying that there is changeset file created and then this action creates a PR with version bump that will trigger release - or if it sees there is no changeset, and there are versions changes in package.json files, it publish new versions to NPM is they are not there yet - uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b #v1.8.0 + uses: changesets/action@v1 id: release with: # `changeset version` only rewrites package.json/CHANGELOG files; it never runs an @@ -143,7 +133,7 @@ jobs: GIT_COMMITTER_EMAIL: info@asyncapi.io - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci Slack channel name: Report workflow run status to Slack - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: 8398a7/action-slack@v3 with: status: ${{ job.status }} fields: repo,action,workflow diff --git a/.github/workflows/update-docs-in-website.yml b/.github/workflows/update-docs-in-website.yml index 6225e8016f..7501f25655 100644 --- a/.github/workflows/update-docs-in-website.yml +++ b/.github/workflows/update-docs-in-website.yml @@ -1,7 +1,6 @@ name: Update latest generator documentation in the website on: - workflow_dispatch: push: branches: - 'master' @@ -9,45 +8,32 @@ on: - 'apps/generator/docs/*.md' - '.github/workflows/update-docs-in-website.yml' -permissions: {} - jobs: Make-PR: name: Make PR on website repository with updated latest generator documentation runs-on: ubuntu-latest - permissions: - contents: write # push to asyncapi/website via PAT - pull-requests: write # gh pr create env: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} steps: - name: Checkout Current repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v3 with: path: generator - persist-credentials: false # since this repo only used for reading docs - - name: Checkout The Website repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Checkout Another repository + uses: actions/checkout@v3 with: repository: asyncapi/website path: website token: ${{ env.GITHUB_TOKEN }} - persist-credentials: true # needed for git push of the docs to the website repo - - name: Config git - working-directory: ./website run: | git config --global user.name asyncapi-bot git config --global user.email info@asyncapi.io - - name: Create branch working-directory: ./website - env: - SHA: ${{ github.sha }} run: | - git checkout -b "update-generator-docs-${SHA}" - - - name: Copy generator folder to the website repo + git checkout -b update-generator-docs-${{ github.sha }} + - name: Copy generator folder from Current Repo to Another working-directory: ./website run: | rm -r ./markdown/docs/tools/generator @@ -56,14 +42,12 @@ jobs: rm -r ../generator/apps/generator/docs/jsdoc2md-handlebars printf "%s\ntitle: Generator\nweight: 3\n%s" "---" "---"> ../generator/apps/generator/docs/_section.md mv ../generator/apps/generator/docs/*.md ./markdown/docs/tools/generator - - name: Commit and push working-directory: ./website run: | git add . git commit -m "docs(generator): update latest generator docs" - git push origin HEAD - + git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/website - name: Create PR working-directory: ./website run: | diff --git a/.github/workflows/update-maintainers-trigger.yaml b/.github/workflows/update-maintainers-trigger.yaml index f0d9a7e35c..92656a1c18 100644 --- a/.github/workflows/update-maintainers-trigger.yaml +++ b/.github/workflows/update-maintainers-trigger.yaml @@ -4,7 +4,6 @@ name: Trigger MAINTAINERS.yaml file update on: - workflow_dispatch: push: branches: [ master ] paths: diff --git a/.github/workflows/update-maintainers.yml b/.github/workflows/update-maintainers.yml index ab49ebb3ad..c4cd1baa47 100644 --- a/.github/workflows/update-maintainers.yml +++ b/.github/workflows/update-maintainers.yml @@ -7,9 +7,6 @@ on: paths: - 'CODEOWNERS' -# Deny-all for the built-in GITHUB_TOKEN; the job uses secrets.GH_TOKEN (PAT) for cross-repo writes. -permissions: {} - jobs: update-maintainers: runs-on: ubuntu-latest @@ -17,34 +14,31 @@ jobs: GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} steps: - name: Checkout main branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v3 with: ref: master path: current_state - persist-credentials: false - name: Checkout one commit before last one - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v3 with: fetch-depth: 2 ref: master path: previous_state - persist-credentials: false - run: cd previous_state && git checkout HEAD^ - name: Checkout community repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v3 with: repository: asyncapi/community token: ${{ env.GITHUB_TOKEN }} path: community - persist-credentials: true # needed for the `git push` later - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@v3 with: - node-version: '20' + node-version: '16' - name: Install js-yaml run: npm install js-yaml@3.14.1 @@ -53,7 +47,7 @@ jobs: id: compare-codeowners env: GH_TOKEN: ${{ env.GITHUB_TOKEN }} - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + uses: actions/github-script@v6 with: script: | const fs = require('fs'); @@ -155,10 +149,8 @@ jobs: - name: Create new branch working-directory: ./community - env: - RUN_ID: ${{ github.run_id }} run: | - git checkout -b update-maintainers-${RUN_ID} + git checkout -b update-maintainers-${{ github.run_id }} - name: Commit and push working-directory: ./community @@ -167,19 +159,17 @@ jobs: git config --global user.name "asyncapi-bot" git add . git commit -m "Update MAINTAINERS.yaml" - git push origin HEAD + git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/community - name: Create PR working-directory: ./community - env: - RUN_ID: ${{ github.run_id }} run: | - gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${RUN_ID} + gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${{ github.run_id }} - name: Report workflow run status to Slack if: failure() # Only, on failure, send a message on the slack channel - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 #v2.3.3 + uses: rtCamp/action-slack-notify@v2 env: SLACK_WEBHOOK: ${{ secrets.SLACK_CI_FAIL_NOTIFY }} SLACK_TITLE: 🚨 Update maintainers list action failed 🚨 diff --git a/.github/workflows/verify-docs-up-to-date.yml b/.github/workflows/verify-docs-up-to-date.yml index 7fd657f78e..4fe38cba7b 100644 --- a/.github/workflows/verify-docs-up-to-date.yml +++ b/.github/workflows/verify-docs-up-to-date.yml @@ -31,7 +31,7 @@ jobs: - name: Check package-lock version # This workflow is from our own org repo and safe to reference by 'master'. - uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master + uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # //NOSONAR id: lockversion with: node-version: ${{ vars.NODE_VERSION }} From 76605931924ef099a80d56fb3ecb9ee69f9a4ec7 Mon Sep 17 00:00:00 2001 From: Florence Njeri Date: Thu, 27 Aug 2026 07:47:50 +0200 Subject: [PATCH 4/4] fix file name --- .../{manual_netlify_preview.yml => manual-netlify-preview.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{manual_netlify_preview.yml => manual-netlify-preview.yml} (100%) diff --git a/.github/workflows/manual_netlify_preview.yml b/.github/workflows/manual-netlify-preview.yml similarity index 100% rename from .github/workflows/manual_netlify_preview.yml rename to .github/workflows/manual-netlify-preview.yml