(mirror of https://github.com/vyos/vyos-github-actions.git) https://git.amelek.net/vyos/vyos-github-actions.git/atom?h=chore%2FT8937-retire-mergify-replaceable-ghas 2026-05-30T09:44:44+00:00 2026-05-30T09:44:44+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-30T09:44:44+00:00 urn:sha1:bbf1b0a43326070bcc958810c3bc70451f76955b Replaces 5 caller workflows now superseded by central Mergify rules. See https://vyos.dev/T8937 for the design + spec + plan. Advances: T8937 🤖 Generated by [robots](https://vyos.io) 2026-05-29T23:34:08+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-29T23:34:08+00:00 urn:sha1:b5e2b170016ca3dd011df7de42ec858858564bb7 Replaces PAT-based secrets passthrough with secrets:inherit and MIRROR_ENABLED opt-out guard per rollout 1b uniform stub spec. Plan: ~/.claude/plans/2026-05-26-mirror-rollout-1b-revised.md Task 5 🤖 Generated by [robots](https://vyos.io) 2026-05-28T10:25:43+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-28T10:25:43+00:00 urn:sha1:b28c9e64fbfb91767e88cbefacd58e211c10d19e Addresses CodeRabbit finding on PR #10 (merged) — pin all three movable refs in the pull_request_target workflow to immutable commit SHAs. Defense in depth: the assign_reviewer job mints a vyos-bot[bot] App-installation token from secrets.APP_PRIVATE_KEY; movable refs in a secrets-handling pull_request_target workflow are an RCE vector if any of the referenced repos (or any user with push access to them) is compromised. Pinned refs: - toshimaru/auto-author-assign@2daaeb2 (was @v1.6.2) - vyos/.github/.github/actions/get-token@8a437c7 (was @current — vyos org-local but elevated trust workflow, so pin even our own action; trade-off: must manually bump SHA on central-action updates) - shufo/auto-assign-reviewer-by-files@f5f3db9 (was @v1.1.4) CR thread: https://github.com/vyos/vyos-github-actions/pull/10#discussion_r3316105021 Phase 0 CR: 0 finding(s). Refs: T8615 follow-up (the original CI-fix PR #10 was out-of-T8615- scope but landed in the same sweep) Generated by robots https://vyos.io 2026-05-28T10:08:00+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-28T10:08:00+00:00 urn:sha1:8f0fbf4d6081bb140b9a3c4656826317501aff5e * T8615: add Mergify config (extends: mergify central template) Adds the org-local central-config inheritance file per the T8615 sweep (re-scoped 2026-05-28). 4-line minimum: extends: mergify resolves to vyos/mergify which provides commands_restrictions (9 slash commands x 4-sender allowlist), conflict labeler, PR-title T-ID format check, opt-in auto-update, and the backport-conflict merge protection. merge_protections_settings: reporting_method: check-runs declared explicitly per-repo because only defaults and commands_restrictions are documented as merging across extends: -- pin to current behavior pre the 2026-07-31 default flip per data/github.md Mergify gotchas table. Phase 0 CR: 0 finding(s). Known false positive: CR flags extends: mergify as 'not a documented built-in preset' but Mergify documents the org-local form at https://docs.mergify.com/configuration/sharing/. Refs: T8615 (re-scoped 2026-05-28), IS-421 Generated by robots https://vyos.io * T8615: switch yaml-language-server schema URL to JSON-schema Replaces the human-docs file-format URL (which serves HTML and cannot drive editor validation) with the machine-readable JSON-schema URL that yaml-language-server actually resolves for autocomplete and schema validation. Old: https://docs.mergify.com/configuration/file-format/ New: https://docs.mergify.com/mergify-configuration-schema.json Phase 0 CR: 0 finding(s). Refs: T8615 (re-scoped 2026-05-28), IS-421 Generated by robots https://vyos.io 2026-05-28T10:07:50+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-28T10:07:50+00:00 urn:sha1:9139991776bf311dbc51b9f2e23d71f1d964a954 Two CI workflows in this repo have been failing on every PR for an extended period. Both surfaced during the T8615 Mergify central-config sweep against vyos/vyos-github-actions#9. unused-imports.yml ================== Workflow invoked 'make unused-imports' but this repo has no Makefile (grep across full git history confirms no Makefile ever existed). The 'unused-imports' target appears to have been copy-pasted from a sister repo (vyos/vyos-1x defines it). Workflow has been broken since the 'T6310: add PR templates' commit (d327ae1) introduced it. Fix: invoke pylint directly, enabling only W0611 (unused-import) per the workflow's original intent. Use 'git ls-files -z' + 'xargs -0' so any future Python file with whitespace in its path is handled safely. auto-author-assign.yml / assign_reviewer ======================================== The 'assign_reviewer' job authenticated via secrets.PR_ACTION_ASSIGN_REVIEWERS, a classic personal access token whose lifetime exceeds 90 days. The VyOS-Networks enterprise rejects this with: The 'VyOS Networks' enterprise forbids access via a personal access tokens (classic) if the token's lifetime is greater than 90 days. Please adjust your token's lifetime at the following URL: https://github.com/settings/tokens/1583410548 Fix: swap to a vyos-bot[bot] App-installation token minted via the central composite action at vyos/.github/.github/actions/get-token@current (established 2026-05-26 under Mirror Pipeline Rollout 1a). The minted token is scoped down to pull_requests:write only — narrower than the App's default permissions, defense in depth for the pull_request_target trigger surface. The 'assign-author' job is unchanged — it uses the default GITHUB_TOKEN and works correctly. Only the broken 'assign_reviewer' job is touched. Follow-up: the now-orphaned secrets.PR_ACTION_ASSIGN_REVIEWERS classic PAT (https://github.com/settings/tokens/1583410548) can be revoked at operator's discretion after this PR lands. Test plan ========= - Local YAML parses (verified) - Phase 0 CR clean (0 findings after applying the round-2 review suggestions about NUL-delimited xargs + removing internal docs link) - Post-merge: next PR opened against current should see both 'Check for unused imports using Pylint' and 'PR Triage / assign_reviewer' pass instead of fail Refs: T8615 (re-scoped 2026-05-28), IS-421 Caught while landing: https://github.com/vyos/vyos-github-actions/pull/9 Generated by robots https://vyos.io 2026-05-09T15:51:42+00:00 kumvijaya kumvijaya@gmail.com 2026-05-09T15:51:42+00:00 urn:sha1:432d67af55fe0e1581d90c969897ba5e17a682a5 2026-05-07T11:34:08+00:00 Yuriy Andamasov yuriy@andamasov.com 2026-05-07T11:34:08+00:00 urn:sha1:cbd344d016dda5132f596072b2be198cadb343b5 2026-05-05T17:18:17+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-05T17:18:17+00:00 urn:sha1:8c67c06671f0b88b515f957a69de5bfd8b93d108 2025-07-14T12:03:23+00:00 Yevhen Bondarenko evgeniy.bondarenko@sentrium.io 2025-07-14T12:03:23+00:00 urn:sha1:3207938c70590c01a1fc856076a171e1946a335a 2025-07-04T13:55:24+00:00 lemeshovich 17667824+lemeshovich@users.noreply.github.com 2025-07-04T13:55:24+00:00 urn:sha1:61c8920202f6b5a8f6b5eb26c128ab5ef8e1763d