From 52bfbe190482cf14677ae06018a5d36f8d75ae53 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 19:16:45 +0200 Subject: [PATCH 1/3] chore(ci): adopt shared workflows and central Renovate preset - renovate.json -> central preset (falco-maintainers) - security.yml (Trivy + CycloneDX SBOM) - pinned reusable workflows to v2.8.1 (release-please.yml,close_invalid_prs.yml,build-pr.yml) --- .github/workflows/build-pr.yml | 2 +- .github/workflows/close_invalid_prs.yml | 2 +- .github/workflows/release-please.yml | 4 +- .github/workflows/security.yml | 55 +++++++++++++++++++++++++ renovate.json | 6 +-- 5 files changed, 60 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 9889db3..804f515 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -17,7 +17,7 @@ jobs: # dorny/paths-filter comparison, and that comparison has no base outside a pull request. A # manual run is one somebody asked for regardless of what changed, so it skips the filter # instead of depending on what the filter would answer without a base. - uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-build-pr.yml@v2.4.0 + uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-build-pr.yml@v2.8.1 with: java-version: "25" java-distribution: "temurin" diff --git a/.github/workflows/close_invalid_prs.yml b/.github/workflows/close_invalid_prs.yml index 849d542..bd99444 100644 --- a/.github/workflows/close_invalid_prs.yml +++ b/.github/workflows/close_invalid_prs.yml @@ -6,5 +6,5 @@ on: jobs: close: - uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.4.0 + uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1 secrets: inherit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index a558ab2..2a07ace 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -31,7 +31,7 @@ jobs: name: Publish to OneLiteFeatherRepo needs: release-please if: needs.release-please.outputs.release_created == 'true' - uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-publish.yml@v2.4.0 + uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-publish.yml@v2.8.1 with: java-version: "25" publish-task: "publish" @@ -51,7 +51,7 @@ jobs: name: Publish snapshot to OneLiteFeatherRepo needs: release-please if: needs.release-please.outputs.release_created != 'true' - uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-publish.yml@v2.4.0 + uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-publish.yml@v2.8.1 with: java-version: "25" build-task: "-Psnapshot build" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..d97fcbc --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,55 @@ +name: Security + +# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained +# on purpose: it needs no build tool and no registry credentials, so it is the +# baseline security gate for every repository regardless of language. +on: + pull_request: + push: + branches: [main] + schedule: + - cron: "10 6 * * 1" + workflow_dispatch: +permissions: + contents: read + security-events: write + +jobs: + trivy: + name: Trivy scan + uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1 + with: + scan-type: "fs" + scanners: "vuln,secret" + severity: "CRITICAL,HIGH" + # Report-only for now, so adopting this does not turn CI red on day one. + fail-on-findings: false + upload-sarif: true + secrets: inherit + + sbom: + name: CycloneDX SBOM + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Upload SBOM + uses: actions/upload-artifact@v4 + with: + name: sbom-cyclonedx + path: bom.json + if-no-files-found: error + retention-days: 90 diff --git a/renovate.json b/renovate.json index 65c7c2c..642bf22 100644 --- a/renovate.json +++ b/renovate.json @@ -1,13 +1,9 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "github>OneLiteFeatherNET/renovate:default(team:falco-maintainers)", + "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/falco-maintainers)", "github>OneLiteFeatherNET/renovate:minestom" ], - "description": [ - "The argument to the :default preset becomes :reviewer(arg0). It carries the `team:` prefix and the bare slug, without the organisation: Renovate splits reviewers on that prefix and posts the remainder as a team reviewer, so `OneLiteFeatherNET/falco-maintainers` would be sent as a user name and rejected. The team holds admin on this repository and is the same owner .github/CODEOWNERS names.", - "The :minestom flavor only fixes version ordering for a pinned `net.minestom:minestom`. Falco resolves Minestom through mycelium-bom and pins no version of its own today, so the flavor is inert here and kept for the moment a version does get pinned." - ], "customManagers": [ { "customType": "regex", From 9d32d078ac85dfd26bd0c896311e3502378e2a44 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 20:12:45 +0200 Subject: [PATCH 2/3] chore(ci): add release-please, PR linting and release SBOMs - pr-lint.yml - commitlint.config.mjs - SBOM job appended to release-please.yml --- .github/workflows/pr-lint.yml | 17 +++++++++++++++++ .github/workflows/release-please.yml | 28 ++++++++++++++++++++++++++++ commitlint.config.mjs | 3 +++ 3 files changed, 48 insertions(+) create mode 100644 .github/workflows/pr-lint.yml create mode 100644 commitlint.config.mjs diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml new file mode 100644 index 0000000..759b37b --- /dev/null +++ b/.github/workflows/pr-lint.yml @@ -0,0 +1,17 @@ +name: PR Lint + +# Conventional Commits on the PR title and every commit on the branch. +# release-please parses those commit types to decide the version bump and to +# build the changelog - a non-conventional commit silently produces neither. +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 2a07ace..354dc51 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -57,3 +57,31 @@ jobs: build-task: "-Psnapshot build" publish-task: "-Psnapshot publish" secrets: inherit + + sbom: + name: Attach SBOM to release + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Generate CycloneDX SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + exit-code: '0' + + - name: Attach SBOM to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" bom.json --clobber diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 0000000..0616fb9 --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ['@commitlint/config-conventional'], +}; From ecb66671cbc2aecd8b4546a899b97c4018e685d6 Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Fri, 21 Aug 2026 21:12:45 +0200 Subject: [PATCH 3/3] fix(ci): restore Renovate platform presets and anchor the version in build.gradle.kts - extra-files now points at build.gradle.kts - bootstrap-sha set from tag v2.1.0 (was "HEAD") --- release-please-config.json | 7 +++++-- renovate.json | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/release-please-config.json b/release-please-config.json index 5739d7f..dc263c3 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -3,14 +3,17 @@ "release-type": "simple", "include-component-in-tag": false, "include-v-in-tag": true, - "bootstrap-sha": "HEAD", + "bootstrap-sha": "cbd74ccb7ecbc6871edb975cf319ed8d94f18155", "pull-request-header": "", "packages": { ".": { "package-name": "falco", "changelog-path": "CHANGELOG.md", "extra-files": [ - { "type": "generic", "path": "build.gradle.kts" } + { + "type": "generic", + "path": "build.gradle.kts" + } ] } } diff --git a/renovate.json b/renovate.json index 642bf22..8d88573 100644 --- a/renovate.json +++ b/renovate.json @@ -7,7 +7,7 @@ "customManagers": [ { "customType": "regex", - "description": "Keep the coordinates in the README install snippets on the released version. One rule for all four published modules: the module name is captured rather than templated, so a module is covered the moment a snippet mentions it. `falco-benchmarks` and `falco-demo` are deliberately not listed because they are never published. A consumer declares the BOM inside a `platform(\"…\")` call rather than a bare `implementation(\"…\")` one, so the match string covers both call forms; `falco-bom` and `falco-instance` are listed even though the README currently mentions neither — the quick start declares only `falco-anvil` and `falco-light`, and the full set moved to the Installation page of the wiki, which Renovate cannot reach. That page says so and points at the README as the authority on the current version. Keeping both names here costs nothing and covers the moment either returns to a README snippet; the BOM will also still be in its three-argument form, which this pattern does not match, until it has a first release.", + "description": "Keep the coordinates in the README install snippets on the released version. One rule for all four published modules: the module name is captured rather than templated, so a module is covered the moment a snippet mentions it. `falco-benchmarks` and `falco-demo` are deliberately not listed because they are never published. A consumer declares the BOM inside a `platform(\"\u2026\")` call rather than a bare `implementation(\"\u2026\")` one, so the match string covers both call forms; `falco-bom` and `falco-instance` are listed even though the README currently mentions neither \u2014 the quick start declares only `falco-anvil` and `falco-light`, and the full set moved to the Installation page of the wiki, which Renovate cannot reach. That page says so and points at the README as the authority on the current version. Keeping both names here costs nothing and covers the moment either returns to a README snippet; the BOM will also still be in its three-argument form, which this pattern does not match, until it has a first release.", "managerFilePatterns": [ "/^README\\.md$/" ],