From 43bec4c6f8daddd4dae006c0c38218681dfb3d28 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Wed, 24 Jun 2026 16:56:16 +0300 Subject: [PATCH 1/3] ci: gate manual releases and dependency PR flow --- .../workflows/docker-dependency-updater.yml | 13 ++++++++++--- .github/workflows/docker-ops.yml | 18 +++++++++++++++++- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docker-dependency-updater.yml b/.github/workflows/docker-dependency-updater.yml index c7a9172a..b91fc0cc 100644 --- a/.github/workflows/docker-dependency-updater.yml +++ b/.github/workflows/docker-dependency-updater.yml @@ -20,7 +20,11 @@ env: REPORT_PATH: docker-dependency-report.json UPDATE_BRANCH: docker-dependency-updates PR_TITLE: "chore(deps): docker dependency upgrade" - PR_AUTO_MERGE: "true" + PR_TEAM_REVIEWER: worker + PR_LABELS: |- + docker + dependencies + PR_AUTO_MERGE: "false" PR_MERGE_METHOD: squash COMMIT_MESSAGE: "chore(deps): update Docker dependency pins" COPILOT_PROMPT_PARTS: >- @@ -55,7 +59,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Load dependency updater defaults id: config @@ -141,11 +145,12 @@ jobs: permissions: contents: write + issues: write pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ github.ref }} @@ -382,6 +387,8 @@ jobs: body-path: docker-dependency-pr-body.md branch: ${{ needs.config.outputs.update_branch }} add-paths: ${{ needs.config.outputs.dockerfile }} + labels: ${{ env.PR_LABELS }} + team-reviewers: ${{ env.PR_TEAM_REVIEWER }} draft: false delete-branch: true diff --git a/.github/workflows/docker-ops.yml b/.github/workflows/docker-ops.yml index c6a800ec..fc2bf89c 100644 --- a/.github/workflows/docker-ops.yml +++ b/.github/workflows/docker-ops.yml @@ -20,8 +20,24 @@ name: Build/Release workflow_dispatch: jobs: + control-gate: + name: Control Gate + runs-on: ubuntu-latest + steps: + - name: Reject manual latest release + if: github.event_name == 'workflow_dispatch' && github.ref_name == 'latest' + run: | + echo "::error::Manual latest releases are disabled. Merge to latest so the push trigger runs the release path." + exit 1 + + - name: Accept workflow trigger + run: | + echo "Build/Release accepted for ${GITHUB_EVENT_NAME} on ${GITHUB_REF_NAME}." + docker-ops: name: Docker Ops + needs: control-gate + if: needs.control-gate.result == 'success' permissions: contents: write security-events: write @@ -45,7 +61,7 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Build worker image run: make build IMAGE_NAME=worker-runtime-output TAG="${GITHUB_SHA}" From 2c9cdab337c3e5239158856165bae06070d8ae81 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Wed, 24 Jun 2026 17:40:18 +0300 Subject: [PATCH 2/3] Fix Docker dependency PR automation --- .github/workflows/docker-dependency-updater.yml | 3 ++- .github/workflows/docker-ops.yml | 16 ---------------- 2 files changed, 2 insertions(+), 17 deletions(-) diff --git a/.github/workflows/docker-dependency-updater.yml b/.github/workflows/docker-dependency-updater.yml index b91fc0cc..aa62316e 100644 --- a/.github/workflows/docker-dependency-updater.yml +++ b/.github/workflows/docker-dependency-updater.yml @@ -382,6 +382,7 @@ jobs: uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 timeout-minutes: 5 with: + token: ${{ secrets.GH_TOKEN }} commit-message: ${{ needs.config.outputs.commit_message }} title: ${{ needs.config.outputs.pr_title }} body-path: docker-dependency-pr-body.md @@ -416,7 +417,7 @@ jobs: esac env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.GH_TOKEN }} MERGE_METHOD: ${{ needs.config.outputs.pr_merge_method }} PR_URL: ${{ steps.create-pr.outputs.pull-request-url }} diff --git a/.github/workflows/docker-ops.yml b/.github/workflows/docker-ops.yml index fc2bf89c..56ae143e 100644 --- a/.github/workflows/docker-ops.yml +++ b/.github/workflows/docker-ops.yml @@ -20,24 +20,8 @@ name: Build/Release workflow_dispatch: jobs: - control-gate: - name: Control Gate - runs-on: ubuntu-latest - steps: - - name: Reject manual latest release - if: github.event_name == 'workflow_dispatch' && github.ref_name == 'latest' - run: | - echo "::error::Manual latest releases are disabled. Merge to latest so the push trigger runs the release path." - exit 1 - - - name: Accept workflow trigger - run: | - echo "Build/Release accepted for ${GITHUB_EVENT_NAME} on ${GITHUB_REF_NAME}." - docker-ops: name: Docker Ops - needs: control-gate - if: needs.control-gate.result == 'success' permissions: contents: write security-events: write From 6fbe86ddf6de4f250660459fd35c7e6ee8da1ce8 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Wed, 24 Jun 2026 17:48:48 +0300 Subject: [PATCH 3/3] Use major tag for create-pull-request action --- .github/workflows/docker-dependency-updater.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-dependency-updater.yml b/.github/workflows/docker-dependency-updater.yml index aa62316e..a289841e 100644 --- a/.github/workflows/docker-dependency-updater.yml +++ b/.github/workflows/docker-dependency-updater.yml @@ -379,7 +379,7 @@ jobs: - name: Create pull request id: create-pr if: steps.changes.outputs.changed == 'true' - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 + uses: peter-evans/create-pull-request@v8 timeout-minutes: 5 with: token: ${{ secrets.GH_TOKEN }}