Skip to content

Commit 2aa9eae

Browse files
vbonkclaude
vbonk
and
claude
authored
feat: Phase 2 — Workflow automation (11 tasks, 10 new workflows)
New workflows: - stale.yml: 60-day stale + 14-day close, exempt in-progress/blocked/high/roadmap - auto-label.yml + labeler.yml: path-based PR labeling (docs, ci, deps) - pr-size.yml: size/xs through size/xl labels with XL advisory - codeql.yml: CodeQL with empty language matrix (template no-op) - dependabot-auto-merge.yml: auto-squash minor/patch Dependabot PRs - validate-template.yml: meta-CI (YAML, JSON, ShellCheck, SHA-pin check, secrets scan) - dependency-review.yml: fail on moderate+ severity vulnerabilities - scan-pr-body.yml: prompt injection detection (commented, opt-in) - welcome.yml: first-time contributor greeting (commented, opt-in) - lock-threads.yml: weekly lock of 30-day-old closed threads Modified: - ci.yml: Rust section (commented), paths-ignore, multi-OS matrix example - labels.sh: size/xs-xl labels + deferred label All actions SHA-pinned. All workflows have explicit permissions + timeout-minutes. Co-authored-by: Tony Bonk <vbonk@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 2df1298 commit 2aa9eae

File tree

13 files changed

+588
-1
lines changed

13 files changed

+588
-1
lines changed

‎.github/labeler.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Labeler configuration for actions/labeler
2+
# Maps file path patterns to PR labels.
3+
# See: https://github.com/actions/labeler
4+
5+
documentation:
6+
- changed-files:
7+
- any-glob-to-any-file:
8+
- '*.md'
9+
- 'docs/**'
10+
11+
ci:
12+
- changed-files:
13+
- any-glob-to-any-file:
14+
- '.github/**'
15+
16+
dependencies:
17+
- changed-files:
18+
- any-glob-to-any-file:
19+
- 'package.json'
20+
- 'package-lock.json'
21+
- 'requirements.txt'
22+
- 'requirements*.txt'
23+
- 'pyproject.toml'
24+
- 'go.mod'
25+
- 'go.sum'
26+
- 'Cargo.toml'
27+
- 'Cargo.lock'
28+
- 'Gemfile'
29+
- 'Gemfile.lock'
30+
31+
# TEMPLATE: Uncomment and adjust for your project structure
32+
#
33+
# frontend:
34+
# - changed-files:
35+
# - any-glob-to-any-file:
36+
# - 'src/components/**'
37+
# - 'src/pages/**'
38+
# - 'src/styles/**'
39+
# - '*.css'
40+
# - '*.scss'
41+
#
42+
# backend:
43+
# - changed-files:
44+
# - any-glob-to-any-file:
45+
# - 'src/api/**'
46+
# - 'src/services/**'
47+
# - 'src/models/**'
48+
#
49+
# tests:
50+
# - changed-files:
51+
# - any-glob-to-any-file:
52+
# - 'tests/**'
53+
# - '**/*.test.*'
54+
# - '**/*.spec.*'

‎.github/workflows/auto-label.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Auto-Label PRs
2+
# Automatically labels PRs based on changed file paths.
3+
# Configure labels in .github/labeler.yml
4+
5+
name: Auto Label
6+
7+
on:
8+
pull_request:
9+
branches: [main]
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
15+
jobs:
16+
label:
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 5
19+
20+
steps:
21+
- name: Label PR based on changed files
22+
uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
23+
with:
24+
repo-token: ${{ secrets.GITHUB_TOKEN }}
25+
sync-labels: true

‎.github/workflows/ci.yml‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@ name: CI
77
on:
88
push:
99
branches: [main]
10+
paths-ignore: ['**.md', 'docs/**', 'LICENSE', '.editorconfig']
1011
pull_request:
1112
branches: [main]
13+
paths-ignore: ['**.md', 'docs/**', 'LICENSE', '.editorconfig']
1214

1315
# Cancel in-progress runs for the same branch
1416
concurrency:
@@ -82,9 +84,48 @@ jobs:
8284
# - name: Test
8385
# run: go test ./...
8486

87+
# --- Rust ---
88+
# - name: Setup Rust
89+
# uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # master
90+
# with:
91+
# toolchain: stable
92+
# components: rustfmt, clippy
93+
#
94+
# - name: Rust cache
95+
# uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
96+
#
97+
# - name: Check formatting
98+
# run: cargo fmt --all -- --check
99+
#
100+
# - name: Clippy
101+
# run: cargo clippy --all-targets --all-features -- -D warnings
102+
#
103+
# - name: Test
104+
# run: cargo test --all-features
105+
#
106+
# - name: Build
107+
# run: cargo build --release
108+
85109
# --- Generic (placeholder) ---
86110
- name: Placeholder
87111
run: |
88112
echo "CI workflow running"
89113
echo "Configure this workflow for your tech stack"
90-
echo "See comments above for Node.js, Python, and Go examples"
114+
echo "See comments above for Node.js, Python, Go, and Rust examples"
115+
116+
# ============================================
117+
# TEMPLATE: Multi-OS matrix example
118+
# Uncomment and replace the 'build' job above to test across OSes.
119+
# ============================================
120+
# build-matrix:
121+
# strategy:
122+
# fail-fast: false
123+
# matrix:
124+
# os: [ubuntu-latest, macos-latest, windows-latest]
125+
# runs-on: ${{ matrix.os }}
126+
# timeout-minutes: 15
127+
# steps:
128+
# - name: Checkout
129+
# uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
130+
# - name: Build & Test
131+
# run: echo "Running on ${{ matrix.os }}"

‎.github/workflows/codeql.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# CodeQL Analysis
2+
# Runs GitHub's CodeQL security scanner.
3+
# TEMPLATE: Uncomment languages in the matrix to enable scanning.
4+
5+
name: CodeQL
6+
7+
on:
8+
push:
9+
branches: [main]
10+
pull_request:
11+
branches: [main]
12+
schedule:
13+
- cron: '0 8 * * 1' # Weekly Monday 08:00 UTC
14+
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
20+
jobs:
21+
analyze:
22+
runs-on: ubuntu-latest
23+
timeout-minutes: 30
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
# TEMPLATE: Uncomment languages used in your project.
29+
# Supported: javascript, typescript, python, go, ruby, java, kotlin, csharp, cpp, swift
30+
language: []
31+
# language:
32+
# - javascript-typescript
33+
# - python
34+
# - go
35+
# - java-kotlin
36+
# - ruby
37+
# - csharp
38+
# - cpp
39+
# - swift
40+
41+
steps:
42+
- name: Checkout
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
45+
- name: Initialize CodeQL
46+
uses: github/codeql-action/init@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6
47+
with:
48+
languages: ${{ matrix.language }}
49+
50+
- name: Autobuild
51+
uses: github/codeql-action/autobuild@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6
52+
53+
- name: Perform CodeQL Analysis
54+
uses: github/codeql-action/analyze@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6
55+
with:
56+
category: '/language:${{ matrix.language }}'

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Dependabot Auto-Merge
2+
# Automatically merges minor and patch Dependabot PRs after CI passes.
3+
# Major version bumps still require human review.
4+
5+
name: Dependabot Auto-Merge
6+
7+
on:
8+
pull_request:
9+
10+
permissions:
11+
contents: write
12+
pull-requests: write
13+
14+
jobs:
15+
auto-merge:
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 5
18+
if: github.actor == 'dependabot[bot]'
19+
20+
steps:
21+
- name: Fetch Dependabot metadata
22+
id: metadata
23+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
24+
with:
25+
github-token: ${{ secrets.GITHUB_TOKEN }}
26+
27+
- name: Auto-merge minor and patch updates
28+
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
29+
run: gh pr merge --auto --squash "$PR_URL"
30+
env:
31+
PR_URL: ${{ github.event.pull_request.html_url }}
32+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/dependency-review.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Dependency Review
2+
# Scans PRs for vulnerable or license-restricted dependencies.
3+
# Blocks PRs that introduce moderate+ severity vulnerabilities.
4+
5+
name: Dependency Review
6+
7+
on:
8+
pull_request:
9+
branches: [main]
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
15+
jobs:
16+
review:
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 10
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
24+
- name: Dependency Review
25+
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
26+
with:
27+
fail-on-severity: moderate
28+
comment-summary-in-pr: always

‎.github/workflows/lock-threads.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Lock Stale Threads
2+
# Locks issues and PRs that have been closed for 30+ days.
3+
# Prevents necro-posting on resolved threads.
4+
5+
name: Lock Threads
6+
7+
on:
8+
schedule:
9+
- cron: '0 7 * * 1' # Weekly Monday 07:00 UTC
10+
workflow_dispatch:
11+
12+
permissions:
13+
issues: write
14+
pull-requests: write
15+
16+
jobs:
17+
lock:
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 10
20+
21+
steps:
22+
- name: Lock closed threads
23+
uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
24+
with:
25+
github-token: ${{ secrets.GITHUB_TOKEN }}
26+
issue-inactive-days: 30
27+
pr-inactive-days: 30
28+
issue-comment: >
29+
This issue has been locked because it has been closed for more than
30+
30 days. If you have a related question or issue, please open a new
31+
one with a link to this thread for context.
32+
pr-comment: >
33+
This PR has been locked because it has been closed for more than
34+
30 days. If you have a related question or change, please open a new
35+
PR with a link to this thread for context.
36+
log-output: true

‎.github/workflows/pr-size.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# PR Size Labeler
2+
# Automatically labels PRs by size (lines changed).
3+
# Encourages smaller, reviewable PRs.
4+
5+
name: PR Size
6+
7+
on:
8+
pull_request:
9+
branches: [main]
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
15+
jobs:
16+
size-label:
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 5
19+
20+
steps:
21+
- name: Label PR by size
22+
uses: codelytv/pr-size-labeler@4ec67706cd878fbc1c8db0a5dcd28b6bb412e85a # v1.10.3
23+
with:
24+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25+
xs_label: 'size/xs'
26+
xs_max_size: 10
27+
s_label: 'size/s'
28+
s_max_size: 50
29+
m_label: 'size/m'
30+
m_max_size: 200
31+
l_label: 'size/l'
32+
l_max_size: 500
33+
xl_label: 'size/xl'
34+
fail_if_xl: false
35+
message_if_xl: >
36+
This PR exceeds 500 lines changed. Consider breaking it into
37+
smaller, focused PRs for easier review and safer merges.
38+
files_to_ignore: |
39+
package-lock.json
40+
yarn.lock
41+
pnpm-lock.yaml
42+
Cargo.lock
43+
go.sum

0 commit comments

Comments
 (0)