| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
GH Actions: Update README.md on how to create and use ARMBIAN_SELF_DISPATCH_TOKEN | 2 年前 | |
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> | 4 个月前 | |
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> | 4 个月前 | |
labels: only clear review labels when the approval actually counts (#10539) * labels: only clear review labels when the approval actually counts The "Remove review-related labels" step ran on a bare success(), which is not the same question as "was this PR approved". The chain fires on any approving review, but the action is configured with require_committers_approval: true, so it counts only approvals from people with write access. On a public repo anyone with read access can approve. When a non-committer does, the action exits 0 and reports isApproved=false: it correctly declines to add "Ready to merge", and then the next step went ahead and stripped "Needs review", "Work in progress", "Backlog", "Can be closed?", "Help needed" and "Needs Documentation" anyway. So any passer-by could clear a PR's review-tracking state without the PR being approved by anyone who counts. Gate the cleanup on the action's isApproved output, which it already exports. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: don't persist the checkout token in the label workflows actions/checkout writes the workflow token into the local git config by default. None of these three checkouts run an authenticated git command: the labeler steps read .github/labeler.yml and .github/labels.yml from the workspace and authenticate through their own repo-token input, and the "Ready to merge" job shells out to gh, which uses GH_TOKEN. The pull_request_target checkout defaults to the base ref, so no untrusted pull request code runs beside the token -- this is defence in depth rather than a live hole -- but there is no reason to leave it lying there. Note the first checkout stays: it looks unused, but gh needs the git remote to resolve which repo to query. Dropping the credential keeps that working. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: require a canonical PR number before touching labels Number.parseInt consumes the longest valid prefix rather than rejecting trailing junk, so "123abc" became 123 and "1e3" became 1 -- both integers, both greater than zero, both sailing past the isInteger guard. The cleanup step would then strip labels off whichever pull request that produced. Require canonical decimal digits and convert with Number instead. Malformed input now fails the step loudly rather than silently retargeting it. The value still comes from github.event.pull_request.number by way of an artifact, so this is not a reachable bug today; it is about the guard actually guarding what it claims to. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: validate the PR number where it enters the job The previous commit validated PR_NUMBER inside the github-script cleanup step, which is too late and too conditional to be the gate. Everything in the job consumes steps.pr.outputs.number, starting with label-when-approved-action, which parseInt()s it and then reads reviews and writes labels. Validating after that step means validating after those writes. Worse, the cleanup step is gated on isApproved == 'true', so on the not-approved path the check did not run at all. Move the check into the `pr` step that produces the value: reject anything that is not canonical decimal digits, and fail the job there, before any consumer sees it. The github-script check stays as a second line of defence, in case the gate above is ever moved or removed. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> --------- Signed-off-by: Igor Pecovnik <igor@armbian.com> | 22 天前 | |
Fix maintainers-sync / CODEOWNERS job errors (#10385) * data-sync-maintainers: don't fail when there are no .wip boards The "Update maintainers" and "Mark csc for no maintainer" steps glob config/boards/*.{conf,wip,csc,eos,tvb}. With no *.wip boards left, the unmatched *.wip stays literal and sed/grep error with "No such file or directory"; under GitHub's default bash -e -o pipefail that fails the job (exit 2). Enable `shopt -s nullglob` in both steps so an empty support-level class expands to nothing, and guard the demote grep with `|| true` so no empty-maintainer match doesn't trip pipefail either. Signed-off-by: Igor Pecovnik <igor@armbian.com> * rockchip64: quote BOOTCONFIG in BOOT_SOC expr When a board has no BOOTCONFIG set, the unquoted `expr $BOOTCONFIG : ...` drops the empty operand, so expr sees `: REGEX` and prints "syntax error: unexpected argument ...". The `|| true` swallowed the exit code but not the stderr noise (two lines during CODEOWNERS generation). Quote it so an empty value is a proper empty-string argument. Signed-off-by: Igor Pecovnik <igor@armbian.com> * data-sync-maintainers: clearer auto-PR description Rewrite the generated PR body: an [!IMPORTANT] callout flagging it as auto-generated, a short "what changed" list (maintainers synced, unmaintained boards demoted to CSC, CODEOWNERS refreshed), the become-a-maintainer link, and references. Signed-off-by: Igor Pecovnik <igor@armbian.com> * data-sync-maintainers: mention armbian.com/authors listing Note in the auto-PR body that active maintainers are listed automatically on armbian.com/authors based on recent activity. Signed-off-by: Igor Pecovnik <igor@armbian.com> --------- Signed-off-by: Igor Pecovnik <igor@armbian.com> | 1 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.0 to 2.21.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 15 天前 | |
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> | 4 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
labels: only clear review labels when the approval actually counts (#10539) * labels: only clear review labels when the approval actually counts The "Remove review-related labels" step ran on a bare success(), which is not the same question as "was this PR approved". The chain fires on any approving review, but the action is configured with require_committers_approval: true, so it counts only approvals from people with write access. On a public repo anyone with read access can approve. When a non-committer does, the action exits 0 and reports isApproved=false: it correctly declines to add "Ready to merge", and then the next step went ahead and stripped "Needs review", "Work in progress", "Backlog", "Can be closed?", "Help needed" and "Needs Documentation" anyway. So any passer-by could clear a PR's review-tracking state without the PR being approved by anyone who counts. Gate the cleanup on the action's isApproved output, which it already exports. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: don't persist the checkout token in the label workflows actions/checkout writes the workflow token into the local git config by default. None of these three checkouts run an authenticated git command: the labeler steps read .github/labeler.yml and .github/labels.yml from the workspace and authenticate through their own repo-token input, and the "Ready to merge" job shells out to gh, which uses GH_TOKEN. The pull_request_target checkout defaults to the base ref, so no untrusted pull request code runs beside the token -- this is defence in depth rather than a live hole -- but there is no reason to leave it lying there. Note the first checkout stays: it looks unused, but gh needs the git remote to resolve which repo to query. Dropping the credential keeps that working. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: require a canonical PR number before touching labels Number.parseInt consumes the longest valid prefix rather than rejecting trailing junk, so "123abc" became 123 and "1e3" became 1 -- both integers, both greater than zero, both sailing past the isInteger guard. The cleanup step would then strip labels off whichever pull request that produced. Require canonical decimal digits and convert with Number instead. Malformed input now fails the step loudly rather than silently retargeting it. The value still comes from github.event.pull_request.number by way of an artifact, so this is not a reachable bug today; it is about the guard actually guarding what it claims to. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> * labels: validate the PR number where it enters the job The previous commit validated PR_NUMBER inside the github-script cleanup step, which is too late and too conditional to be the gate. Everything in the job consumes steps.pr.outputs.number, starting with label-when-approved-action, which parseInt()s it and then reads reviews and writes labels. Validating after that step means validating after those writes. Worse, the cleanup step is gated on isApproved == 'true', so on the not-approved path the check did not run at all. Move the check into the `pr` step that produces the value: reject anything that is not canonical decimal digits, and fail the job there, before any consumer sees it. The github-script check stays as a second line of defence, in case the gate above is ever moved or removed. Same change in armbian/ci and armbian/armbian.github.io. Signed-off-by: Igor Pecovnik <igor@armbian.com> --------- Signed-off-by: Igor Pecovnik <igor@armbian.com> | 22 天前 | |
build(deps): bump tspascoal/get-user-teams-membership Bumps [tspascoal/get-user-teams-membership](https://github.com/tspascoal/get-user-teams-membership) from 4.0.1 to 4.0.2. - [Release notes](https://github.com/tspascoal/get-user-teams-membership/releases) - [Commits](https://github.com/tspascoal/get-user-teams-membership/compare/818140d631d5f29f26b151afbe4179f87d9ceb5e...b2546c5affc730fd8e3d8483ae9ad3621938c2f9) --- updated-dependencies: - dependency-name: tspascoal/get-user-teams-membership dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 3 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.0 to 2.21.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 15 天前 | |
build(deps): bump igorjs/gh-actions-clean-workflow from 7.0.1 to 8.0.0 Bumps [igorjs/gh-actions-clean-workflow](https://github.com/igorjs/gh-actions-clean-workflow) from 7.0.1 to 8.0.0. - [Release notes](https://github.com/igorjs/gh-actions-clean-workflow/releases) - [Changelog](https://github.com/igorjs/gh-actions-clean-workflow/blob/main/CHANGELOG.md) - [Commits](https://github.com/igorjs/gh-actions-clean-workflow/compare/5fa2e3a4fdd40e3e7098645a0b8df08624352e5e...b910eb365da5e592d865ddd8a72d01cbd720b3b1) --- updated-dependencies: - dependency-name: igorjs/gh-actions-clean-workflow dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> | 14 天前 | |
ci: auto-label PRs "Work in progress" from review state (hybrid) Adds automation that keeps the "Work in progress" label in sync with a PR's review state: present while a review requests changes or any conversation is unresolved, cleared once neither holds. GitHub Actions has no trigger for a review conversation being resolved, and pull_request_review from a fork gets a read-only GITHUB_TOKEN, so a single pull_request_review-triggered workflow cannot do this. Use a hybrid instead: - .github/scripts/wip-label.js -- shared logic (reviewDecision + paginated unresolved reviewThreads -> add/remove the label), so the event and cron paths can never drift. - maintenance-listen-review-wip.yml -- listens on pull_request_review with a read-only token (fork-safe) and just records the PR number as an artifact. - maintenance-label-wip.yml -- workflow_run worker fired by the listener; runs in the default-branch context with a write token, checks out the trusted script and syncs the one PR. Per-PR concurrency, newer reviews supersede. - maintenance-label-wip-sweep.yml -- scheduled backstop that recomputes the label for every open PR, catching conversation resolution (which has no event) and any missed events. Hardening: the listener artifact is fork-controlled, so the worker downloads it into RUNNER_TEMP (never the checkout) so it cannot overwrite the trusted script before github-script runs it; the sweep pins checkout to the default branch so a workflow_dispatch on another branch cannot run that branch's script; both set persist-credentials: false. Also drop "Work in progress" from the blanket removal list in maintenance-label-on-approval.yml (now owned by this automation) and quote $GITHUB_OUTPUT there (shellcheck SC2086). Signed-off-by: Igor Pecovnik <igor@armbian.com> | 10 天前 | |
ci: auto-label PRs "Work in progress" from review state (hybrid) Adds automation that keeps the "Work in progress" label in sync with a PR's review state: present while a review requests changes or any conversation is unresolved, cleared once neither holds. GitHub Actions has no trigger for a review conversation being resolved, and pull_request_review from a fork gets a read-only GITHUB_TOKEN, so a single pull_request_review-triggered workflow cannot do this. Use a hybrid instead: - .github/scripts/wip-label.js -- shared logic (reviewDecision + paginated unresolved reviewThreads -> add/remove the label), so the event and cron paths can never drift. - maintenance-listen-review-wip.yml -- listens on pull_request_review with a read-only token (fork-safe) and just records the PR number as an artifact. - maintenance-label-wip.yml -- workflow_run worker fired by the listener; runs in the default-branch context with a write token, checks out the trusted script and syncs the one PR. Per-PR concurrency, newer reviews supersede. - maintenance-label-wip-sweep.yml -- scheduled backstop that recomputes the label for every open PR, catching conversation resolution (which has no event) and any missed events. Hardening: the listener artifact is fork-controlled, so the worker downloads it into RUNNER_TEMP (never the checkout) so it cannot overwrite the trusted script before github-script runs it; the sweep pins checkout to the default branch so a workflow_dispatch on another branch cannot run that branch's script; both set persist-credentials: false. Also drop "Work in progress" from the blanket removal list in maintenance-label-on-approval.yml (now owned by this automation) and quote $GITHUB_OUTPUT there (shellcheck SC2086). Signed-off-by: Igor Pecovnik <igor@armbian.com> | 10 天前 | |
ci: auto-label PRs "Work in progress" from review state (hybrid) Adds automation that keeps the "Work in progress" label in sync with a PR's review state: present while a review requests changes or any conversation is unresolved, cleared once neither holds. GitHub Actions has no trigger for a review conversation being resolved, and pull_request_review from a fork gets a read-only GITHUB_TOKEN, so a single pull_request_review-triggered workflow cannot do this. Use a hybrid instead: - .github/scripts/wip-label.js -- shared logic (reviewDecision + paginated unresolved reviewThreads -> add/remove the label), so the event and cron paths can never drift. - maintenance-listen-review-wip.yml -- listens on pull_request_review with a read-only token (fork-safe) and just records the PR number as an artifact. - maintenance-label-wip.yml -- workflow_run worker fired by the listener; runs in the default-branch context with a write token, checks out the trusted script and syncs the one PR. Per-PR concurrency, newer reviews supersede. - maintenance-label-wip-sweep.yml -- scheduled backstop that recomputes the label for every open PR, catching conversation resolution (which has no event) and any missed events. Hardening: the listener artifact is fork-controlled, so the worker downloads it into RUNNER_TEMP (never the checkout) so it cannot overwrite the trusted script before github-script runs it; the sweep pins checkout to the default branch so a workflow_dispatch on another branch cannot run that branch's script; both set persist-credentials: false. Also drop "Work in progress" from the blanket removal list in maintenance-label-on-approval.yml (now owned by this automation) and quote $GITHUB_OUTPUT there (shellcheck SC2086). Signed-off-by: Igor Pecovnik <igor@armbian.com> | 10 天前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
ci: auto-label PRs "Work in progress" from review state (hybrid) Adds automation that keeps the "Work in progress" label in sync with a PR's review state: present while a review requests changes or any conversation is unresolved, cleared once neither holds. GitHub Actions has no trigger for a review conversation being resolved, and pull_request_review from a fork gets a read-only GITHUB_TOKEN, so a single pull_request_review-triggered workflow cannot do this. Use a hybrid instead: - .github/scripts/wip-label.js -- shared logic (reviewDecision + paginated unresolved reviewThreads -> add/remove the label), so the event and cron paths can never drift. - maintenance-listen-review-wip.yml -- listens on pull_request_review with a read-only token (fork-safe) and just records the PR number as an artifact. - maintenance-label-wip.yml -- workflow_run worker fired by the listener; runs in the default-branch context with a write token, checks out the trusted script and syncs the one PR. Per-PR concurrency, newer reviews supersede. - maintenance-label-wip-sweep.yml -- scheduled backstop that recomputes the label for every open PR, catching conversation resolution (which has no event) and any missed events. Hardening: the listener artifact is fork-controlled, so the worker downloads it into RUNNER_TEMP (never the checkout) so it cannot overwrite the trusted script before github-script runs it; the sweep pins checkout to the default branch so a workflow_dispatch on another branch cannot run that branch's script; both set persist-credentials: false. Also drop "Work in progress" from the blanket removal list in maintenance-label-on-approval.yml (now owned by this automation) and quote $GITHUB_OUTPUT there (shellcheck SC2086). Signed-off-by: Igor Pecovnik <igor@armbian.com> | 10 天前 | |
[StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> | 4 个月前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
maintenance-rewrite-kernel-patches: enable parallel patch rewriting Wire the parallel patch rewriting feature (lib/tools/common/patching_parallel.py, introduced in 205a36f2) into the rewrite-patches workflow: pass PARALLEL_PATCHES to compile.sh, exposed as a dispatch toggle defaulting to yes with an escape hatch. It only takes effect for the rewrite-* commands this workflow runs (patching.py gates parallel on REWRITE_PATCHES=yes), and the worker count auto-calculates. Note: this belongs here, not in maintenance-rewrite-kernel-configs.yml — rewrite-kernel-config does not rewrite patches, so PARALLEL_PATCHES is a no-op there. Signed-off-by: Igor Pecovnik <igor@armbian.com> | 1 个月前 | |
build(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.9 to 4.38.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> | 3 天前 | |
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 1 个月前 | |
ci: organize GitHub Actions into meaningful categories Reorganize workflow files and names into 3 main categories: - Data: Data collection and synchronization workflows - Infrastructure: Infrastructure tasks (mirroring, forking) - Maintenance: All PR checks, labels, notifications, and maintenance tasks All workflows now have capitalized category prefixes for consistency. Also update internal workflow references to reflect new names. | 7 个月前 | |
build(deps): bump plbstl/first-contribution from 4.3.2 to 4.3.3 Bumps [plbstl/first-contribution](https://github.com/plbstl/first-contribution) from 4.3.2 to 4.3.3. - [Release notes](https://github.com/plbstl/first-contribution/releases) - [Commits](https://github.com/plbstl/first-contribution/compare/fa732d1b5586da1a72ba34290a32e87467a59b78...2c36bdb58684587f60549a69aaa3ec00b9d5f4fe) --- updated-dependencies: - dependency-name: plbstl/first-contribution dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 3 个月前 | |
build(deps): bump plbstl/first-contribution from 4.3.2 to 4.3.3 Bumps [plbstl/first-contribution](https://github.com/plbstl/first-contribution) from 4.3.2 to 4.3.3. - [Release notes](https://github.com/plbstl/first-contribution/releases) - [Commits](https://github.com/plbstl/first-contribution/compare/fa732d1b5586da1a72ba34290a32e87467a59b78...2c36bdb58684587f60549a69aaa3ec00b9d5f4fe) --- updated-dependencies: - dependency-name: plbstl/first-contribution dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> | 3 个月前 |
Runners requirements
- big (6-16 cores, 64Gb SSD, 16Gb memory, 2Gb swap)
- small (4 cores, 64Gb SSD, 8Gb memory, 2Gb swap)
Preparation
Adding x86 runner to your Jammy VM (check here if any changes):
$ mkdir actions-runner
$ cd actions-runner
$ curl -o actions-runner-linux-x64-2.294.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.294.0/actions-runner-linux-x64-2.294.0.tar.gz
$ tar xzf ./actions-runner-linux-x64-2.294.0.tar.gz
Configuration
Once asked, tag your runner accordingly:
- small
- big
- arm64
Start the configuration experience
$ ./config.sh --url https://github.com/armbian --token XXXXXXXXXXXXXXXXXXXXXXXXXXX
You need to get a valid token from our DevOps team to proceed.
Create startup scripts
sudo ./svc.sh install # install
sudo ./svc.sh start # start
sudo ./svc.sh status # check
Use workflows in forked repositories
forked-helper.yml workflow helper can help to run custom workflows on the forked repositories.
- Create a fine-grained Personal Access Token (PAT) with the
reposcope and store it as a secret. It needs the following permissions on the target repositories:contents: read & writemetadata: read only (automatically selected when selecting the contents permission)
- Create a secret named
ARMBIAN_SELF_DISPATCH_TOKENon your repository withsecurity_eventspermissions. To do this, head to your forked repository, go toSettingson the top bar, selectSecrets and variablesand thenActions. From here you can create a new repository secret.Name:ARMBIAN_SELF_DISPATCH_TOKENSecret: Paste your fine-grained Personal Access Token that you created in step 1 here
- Helper will dispatch
repository_dispatcheventarmbianonpush,release,deployment,pull_requestandworkflow_dispatchevents. All needed event details you can find inclient_payloadproperty of the event. - Create empty default branch in forked repository
- Create workflow with
repository_dispatchin default branch. - Run any need actions in this workflow.
Workflow example:
name: Test Armbian dispatch
on:
repository_dispatch:
types: ["armbian"]
jobs:
show-dispatch:
name: Show dispatch event details
runs-on: ubuntu-latest
steps:
- uses: hmarr/debug-action@v2