Skip to content

ci(workflows): apply initial good practices#1627

Merged
willtsai merged 1 commit intoradius-project:edgefrom
DariuszPorowski:dp/ci-updates
Dec 1, 2025
Merged

ci(workflows): apply initial good practices#1627
willtsai merged 1 commit intoradius-project:edgefrom
DariuszPorowski:dp/ci-updates

Conversation

@DariuszPorowski
Copy link
Member

fixes: radius-project/radius#10795

  • remove top-level permissions
  • add job-level permissions
  • use pined version of runner
  • set persist-credentials: false for checkout
  • set default timeout
  • style: minor lint
  • normalize naming of devops board workflow

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
@DariuszPorowski DariuszPorowski requested review from a team as code owners November 26, 2025 22:42
@DariuszPorowski DariuszPorowski changed the title ci(workflows): enhance permissions for jobs ci(workflows): apply initial good practices Nov 26, 2025
@willtsai willtsai merged commit 42a81f1 into radius-project:edge Dec 1, 2025
11 checks passed
@DariuszPorowski DariuszPorowski deleted the dp/ci-updates branch December 1, 2025 19:56
ytimocin pushed a commit that referenced this pull request Dec 4, 2025
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
ytimocin added a commit that referenced this pull request Dec 4, 2025
* ci(workflows): pin actions to full sha (#1598)

* ci(workflows): pin actions to full sha

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(dependabot): add configuration for GitHub Actions updates

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): ensure deployment skips when secrets are missing

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix(workflows): correct syntax for Azure DevOps token retrieval step

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix: broken links (#1607)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): enhance permissions for jobs (#1627)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski added a commit to DariuszPorowski/radius-docs that referenced this pull request Dec 5, 2025
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski added a commit to DariuszPorowski/radius-docs that referenced this pull request Dec 5, 2025
* ci(workflows): pin actions to full sha (radius-project#1598)

* ci(workflows): pin actions to full sha

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(dependabot): add configuration for GitHub Actions updates

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): ensure deployment skips when secrets are missing

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix(workflows): correct syntax for Azure DevOps token retrieval step

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix: broken links (radius-project#1607)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): enhance permissions for jobs (radius-project#1627)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
ytimocin added a commit that referenced this pull request Dec 5, 2025
* Update docs for v0.53.0

* update ACI deployment prereqs to add requirement for  role on the subscription (#1595)

* update ACI deployment prereqs to add requirement for  role on the subscription

Signed-off-by: Will Tsai <28876888+willtsai@users.noreply.github.com>

* minor fix

Signed-off-by: Will Tsai <28876888+willtsai@users.noreply.github.com>

---------

Signed-off-by: Will Tsai <28876888+willtsai@users.noreply.github.com>

* Down-Merge for SHA fix in actions (#1634)

* ci(workflows): pin actions to full sha (#1598)

* ci(workflows): pin actions to full sha

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(dependabot): add configuration for GitHub Actions updates

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): ensure deployment skips when secrets are missing

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix(workflows): correct syntax for Azure DevOps token retrieval step

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* fix: broken links (#1607)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(workflows): enhance permissions for jobs (#1627)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(deps): bump the all group with 5 updates (#1635)

Bumps the all group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/stale](https://github.com/actions/stale) | `10.1.0` | `10.1.1` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `6.0.1` |
| [Azure/static-web-apps-deploy](https://github.com/azure/static-web-apps-deploy) | `4d27395796ac319302594769cfe812bd207490b1` | `1a947af9992250f3bc2e68ad0754c0b0c11566c9` |
| [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) | `0.54.0` | `0.55.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.0.0` | `6.1.0` |


Updates `actions/stale` from 10.1.0 to 10.1.1
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5f858e3...9971854)

Updates `actions/checkout` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@1af3b93...8e8c483)

Updates `Azure/static-web-apps-deploy` from 4d27395796ac319302594769cfe812bd207490b1 to 1a947af9992250f3bc2e68ad0754c0b0c11566c9
- [Release notes](https://github.com/azure/static-web-apps-deploy/releases)
- [Commits](Azure/static-web-apps-deploy@4d27395...1a947af)

Updates `rojopolis/spellcheck-github-actions` from 0.54.0 to 0.55.0
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@6f2326b...16d0338)

Updates `actions/setup-node` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@2028fbc...395ad32)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: Azure/static-web-apps-deploy
  dependency-version: 1a947af9992250f3bc2e68ad0754c0b0c11566c9
  dependency-type: direct:production
  dependency-group: all
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: actions/setup-node
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Revert "ci(deps): bump the all group with 5 updates (#1635)" (#1641)

This reverts commit 96761da.

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

* ci(dependabot): specify target branch (#1640) (#1642)

Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>

---------

Signed-off-by: Will Tsai <28876888+willtsai@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Radius CI Bot <radiuscoreteam@service.microsoft.com>
Co-authored-by: Will <28876888+willtsai@users.noreply.github.com>
Co-authored-by: Yetkin Timocin <ytimocin@microsoft.com>
Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants