chore(docker): update renovate/renovate docker tag to v44.65.2 #498
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| # main only: a PR already gets these jobs from the pull_request trigger below, | |
| # and without this the four contexts report twice on any PR that touches the | |
| # paths -- once per trigger. | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/**" | |
| - ".github/actions/**" | |
| - "tests/**" | |
| # Deliberately unfiltered, unlike the push trigger above. These jobs are | |
| # required checks on protect-main, and a required check that does not report | |
| # blocks the PR forever on "Expected" -- so the filter and the requirement | |
| # cannot both exist. Requiring them is the point: this repo's Renovate PRs | |
| # bump the actions its own release workflows run on, and GitHub auto-merge | |
| # waits only for checks that are required. | |
| # | |
| # Nothing here reads the diff, so the jobs pass on a PR that touches none of | |
| # the paths above; the cost is one CI run on every PR to this repo. | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint workflows | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install actionlint | |
| run: | | |
| # renovate: datasource=github-releases depName=rhysd/actionlint | |
| VERSION="1.7.12" | |
| curl -fsSL \ | |
| "https://github.com/rhysd/actionlint/releases/download/v${VERSION}/actionlint_${VERSION}_linux_amd64.tar.gz" \ | |
| | tar -xz actionlint | |
| sudo mv actionlint /usr/local/bin/ | |
| - name: Install zizmor | |
| # renovate: datasource=pypi depName=zizmor | |
| run: pip install zizmor==1.29.0 | |
| - name: Install yamllint | |
| # renovate: datasource=pypi depName=yamllint | |
| run: pip install yamllint==1.38.0 | |
| # The ignore covers exactly one thing: actionlint does not yet know the | |
| # `$/` self-repository syntax GitHub shipped on 2026-07-30, and rejects it | |
| # as a malformed `uses:`. Tracked upstream as rhysd/actionlint#711 -- | |
| # delete this flag once a release lands with support. | |
| # | |
| # Scoped to the message rather than the file, so a genuinely unpinned | |
| # action (`uses: actions/checkout` with no ref) still fails. | |
| - name: actionlint | |
| run: | | |
| actionlint \ | |
| -ignore 'specifying action "\$/.+" in invalid format because ref is missing' \ | |
| .github/workflows/*.yml | |
| # No `|| true`: these workflows hold contents: write and feed package | |
| # registries, so a finding is a failure, not a report. The one deliberate | |
| # deviation from zizmor's defaults is recorded in .github/zizmor.yml. | |
| - name: zizmor | |
| run: zizmor --config .github/zizmor.yml .github/workflows/ .github/actions/ | |
| - name: yamllint | |
| run: | | |
| yamllint -d "{extends: relaxed, rules: {line-length: {max: 200}}}" \ | |
| .github/workflows/ .github/actions/ tests/ | |
| # shellcheck ships on GitHub-hosted runners. | |
| - name: shellcheck | |
| run: shellcheck .github/actions/*/*.sh tests/actions/*.sh tests/release/*.sh | |
| test-release-artifacts: | |
| name: Test — release artifacts | |
| needs: lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v7.0.0 | |
| with: | |
| node-version: "24.20.0" | |
| # typescript-build.yml packs a tarball to satisfy the version assertion in | |
| # common-release-assets.yml, and nothing else checks that it does. | |
| # tests/typescript/build.yml is actionlint-only and passes no version, so | |
| # it never reaches the pack step at all. | |
| - name: Run the release artifact test suite | |
| run: bash tests/release/run-tests.sh | |
| test-actions: | |
| name: Test — composite actions | |
| needs: lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Exercises the shell behind check-version, check-release-branch and | |
| # next-prerelease directly. This replaced an act-driven matrix over | |
| # common-check-release.yml: once that workflow delegated to composite | |
| # actions, act resolved them against main rather than the branch under | |
| # test, so a PR changing the rules was validated against the rules it was | |
| # replacing. | |
| - name: Run the action test suite | |
| run: bash tests/actions/run-tests.sh | |
| # A caller granting exactly what the jobs need must not be refused. See the | |
| # script for why this specific shape is worth a test. | |
| - name: Check reusable workflow permissions | |
| run: | | |
| # renovate: datasource=pypi depName=PyYAML | |
| pip install --quiet PyYAML==6.0.3 | |
| python3 tests/actions/check-permissions.py | |
| # Proves the `$/` self-repository syntax actually resolves on a runner, rather | |
| # than only that actionlint and zizmor tolerate it. Worth its own job: `$/` is | |
| # new (2026-07-30), needs runner 2.336.0+, and every release workflow depends | |
| # on it from its first step -- a syntax that silently failed to resolve would | |
| # surface as a broken release rather than a broken CI run. | |
| # | |
| # It also proves resolution is to *this commit* and not to main: on a PR that | |
| # adds an action, main has no copy of it, so resolving at all means resolving | |
| # here. | |
| test-self-repository-syntax: | |
| name: Test — $/ resolves to this commit | |
| needs: lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Show the runner version | |
| run: echo "$RUNNER_NAME on $(cat /home/runner/runners/*/.runner 2>/dev/null | head -1 || echo 'version unknown')" | |
| # No checkout: `$/` resolves without one, which is part of what is claimed. | |
| - name: A valid version passes | |
| uses: $/.github/actions/check-version | |
| with: | |
| version: "1.2.3rc1" | |
| version-format: pep440 | |
| - name: An invalid version is rejected | |
| id: reject | |
| continue-on-error: true | |
| uses: $/.github/actions/check-version | |
| with: | |
| version: "not-a-version" | |
| version-format: pep440 | |
| - name: Assert the rejection actually happened | |
| env: | |
| OUTCOME: ${{ steps.reject.outcome }} | |
| run: | | |
| if [ "$OUTCOME" != "failure" ]; then | |
| echo "::error::check-version accepted 'not-a-version' — the action resolved but does not work" | |
| exit 1 | |
| fi | |
| echo "\$/ resolved to this commit and the action behaves correctly." | |
| # tests/common/*.yml and tests/{java,python,typescript}/*.yml are validated by | |
| # actionlint above. act-based execution is not attempted: act does not | |
| # propagate `with:` inputs into a nested workflow_call, and a reusable workflow | |
| # that references this repo's own composite actions can only address them at | |
| # @main, which is not what a PR is testing. The workflows are exercised | |
| # end-to-end in the per-repo migration PRs. |