From 0b355ae00f265aa896ae649ac9d29d67b2ef644d Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Wed, 13 May 2026 17:25:15 +0600 Subject: [PATCH 1/7] Apply kubedb/installer#2281: harden CI workflows Signed-off-by: Tamal Saha --- .github/workflows/release-tracker.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/release-tracker.yml b/.github/workflows/release-tracker.yml index 4b79b25..61ae71c 100644 --- a/.github/workflows/release-tracker.yml +++ b/.github/workflows/release-tracker.yml @@ -25,11 +25,6 @@ jobs: git config --global user.email "${GITHUB_USER}@appscode.com" git remote set-url origin https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git - - name: Install GitHub CLI - run: | - curl -fsSL https://github.com/github/hub/raw/master/script/get | bash -s 2.14.1 - sudo mv bin/hub /usr/local/bin - - name: Update release tracker if: | github.event.action == 'closed' && From c5a905f108d8e7570a9392db0042555fe67e9b90 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Wed, 13 May 2026 17:41:11 +0600 Subject: [PATCH 2/7] Remove Prepare git step from release-tracker.yml Signed-off-by: Tamal Saha --- .github/workflows/release-tracker.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/release-tracker.yml b/.github/workflows/release-tracker.yml index 61ae71c..efaa908 100644 --- a/.github/workflows/release-tracker.yml +++ b/.github/workflows/release-tracker.yml @@ -16,15 +16,6 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Prepare git - env: - GITHUB_USER: 1gtm - GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }} - run: | - git config --global user.name "${GITHUB_USER}" - git config --global user.email "${GITHUB_USER}@appscode.com" - git remote set-url origin https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git - - name: Update release tracker if: | github.event.action == 'closed' && From 2f24ae4c826ac11c1cf76fc96e5c2575c801d019 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Wed, 13 May 2026 18:16:34 +0600 Subject: [PATCH 3/7] release-tracker.yml: gate at job level with merged == true Signed-off-by: Tamal Saha --- .github/workflows/release-tracker.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/release-tracker.yml b/.github/workflows/release-tracker.yml index efaa908..cbcb150 100644 --- a/.github/workflows/release-tracker.yml +++ b/.github/workflows/release-tracker.yml @@ -11,15 +11,13 @@ concurrency: jobs: build: + if: github.event.pull_request.merged == true runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v4 - name: Update release tracker - if: | - github.event.action == 'closed' && - github.event.pull_request.merged == true env: GITHUB_USER: 1gtm GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }} From c8e6dc16a5a0405bafd12e9cd9fd56f8cacbcf83 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Wed, 13 May 2026 21:13:32 +0600 Subject: [PATCH 4/7] Use node-version: '22' in setup-node steps Signed-off-by: Tamal Saha --- .github/workflows/preview-website.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/preview-website.yml b/.github/workflows/preview-website.yml index 59e6df6..6e3b7cd 100644 --- a/.github/workflows/preview-website.yml +++ b/.github/workflows/preview-website.yml @@ -26,7 +26,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@v4 with: - node-version: '18' + node-version: '22' - name: Install yq run: | From dfd03ed721bcc7ac364b86650dcd45853afd63e2 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Thu, 14 May 2026 14:01:50 +0600 Subject: [PATCH 5/7] Add 1gtm-app[bot] to kodiak auto_approve_usernames Signed-off-by: Tamal Saha --- .github/.kodiak.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/.kodiak.toml b/.github/.kodiak.toml index ded81e4..e586458 100644 --- a/.github/.kodiak.toml +++ b/.github/.kodiak.toml @@ -15,4 +15,4 @@ strip_html_comments = true # default: false always = true # default: false [approve] -auto_approve_usernames = ["1gtm", "tamalsaha"] +auto_approve_usernames = ["1gtm", "tamalsaha", "1gtm-app[bot]"] From 052e2158314ca2532d3cad6e2c9ecca47fcd718d Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Thu, 14 May 2026 15:03:36 +0600 Subject: [PATCH 6/7] Normalize kodiak auto_approve_usernames Signed-off-by: Tamal Saha --- .github/.kodiak.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/.kodiak.toml b/.github/.kodiak.toml index e586458..b64a5f6 100644 --- a/.github/.kodiak.toml +++ b/.github/.kodiak.toml @@ -15,4 +15,4 @@ strip_html_comments = true # default: false always = true # default: false [approve] -auto_approve_usernames = ["1gtm", "tamalsaha", "1gtm-app[bot]"] +auto_approve_usernames = ["tamalsaha", "1gtm", "1gtm-app[bot]"] \ No newline at end of file From d74effd447413ce71f1a3080c2b56c52860c0931 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Fri, 15 May 2026 15:26:01 +0600 Subject: [PATCH 7/7] Pin remaining actions to commit SHAs Signed-off-by: Tamal Saha --- .github/workflows/ci.yml | 4 ++-- .github/workflows/preview-website.yml | 6 +++--- .github/workflows/release-tracker.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c9bc2fd..62c0238 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: name: Build runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install link checker run: | @@ -38,7 +38,7 @@ jobs: - name: Create Kubernetes cluster id: kind - uses: engineerd/setup-kind@v0.5.0 + uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 with: version: v0.31.0 diff --git a/.github/workflows/preview-website.yml b/.github/workflows/preview-website.yml index 6e3b7cd..06866ad 100644 --- a/.github/workflows/preview-website.yml +++ b/.github/workflows/preview-website.yml @@ -15,16 +15,16 @@ jobs: name: Build runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Go 1.x - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: '1.25' id: go - name: Use Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' diff --git a/.github/workflows/release-tracker.yml b/.github/workflows/release-tracker.yml index cbcb150..3d92e20 100644 --- a/.github/workflows/release-tracker.yml +++ b/.github/workflows/release-tracker.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Update release tracker env: