chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks #2016

Workflow file for this run

	# This file is managed by Vivswan/repo-platform.
	# Local edits are replaced on the next sync.
	#
	# The same file in every repository: the legs after the gate are static jobs gated on the plan's module output,
	# so a change to fleet-ci.yml@stable changes this repository's CI with no PR here.

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:
	schedule:
	# Nightly: the scheduled run carries the fleet's scheduled scans, and
	# CodeQL keeps its weekly rescan through fleet-ci's plan output.
	- cron: "3 4 * * *"

	permissions:
	contents: read

	# A ref-keyed group keeps one pending run and cancels the older one, so a burst of merges would leave intermediate commits unjudged.
	# push -> keyed by the commit: every merge to main gets its own complete run and verdict
	# pull_request -> keyed by the ref: a newer push cancels the stale run
	concurrency:
	group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref \|\| github.sha }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	# Repo-owned: edit checks.yml, not this file (no secrets; permissions
	# cap at contents: read). The nightly run is the fleet callers' alone.
	checks:
	if: github.event_name != 'schedule'
	uses: ./.github/workflows/checks.yml

	# This caller's permissions are the ceiling for every called job and
	# must stay UNCONDITIONAL: GitHub validates skipped jobs' grants too.
	ci:
	uses: Vivswan/repo-platform/.github/workflows/fleet-ci.yml@stable
	permissions:
	contents: read
	# validate-managed-files posts its sticky findings comment.
	pull-requests: write
	# The ceiling for the CodeQL analysis calls.
	security-events: write
	actions: read
	# The ceiling for release-health's issue reads; no called job here
	# writes issues (the nightly caller below carries that grant).
	issues: read
	# The ceiling for release-health's Dependabot-alert reads.
	vulnerability-alerts: read

	# The nightly security scan, behind its own caller because it files the
	# tracking issue: `issues: write` exceeds the `ci` ceiling, and GitHub
	# checks a called job's grant before its condition. Not a gate: it is
	# not in all-green's needs and stays green whatever it finds.
	# Public repositories only: a private repository pays for every job that
	# runs, and a skipped job bills nothing.
	nightly:
	if: github.event_name == 'schedule' && !github.event.repository.private
	uses: Vivswan/repo-platform/.github/workflows/fleet-nightly.yml@stable
	permissions:
	contents: read
	issues: write
	security-events: write

	# THE gate: this job's own check run (named all-green, created by the
	# GitHub Actions app) is the ruleset's required check. It needs both
	# caller jobs and passes only when each result is success - so a failed
	# or cancelled job anywhere in either called workflow blocks the merge.
	# `checks` alone may skip (the schedule run); `ci` never may, so an
	# all-skipped run cannot pass.
	all-green:
	needs: [checks, ci]
	if: always()
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
	with:
	jobs: ${{ toJSON(needs) }}
	allowed-skips: checks

	# Repo-owned: edit post-green.yml, not this file. No job lane here: a caller holding a lane a called job takes deadlocks the call.
	post-green:
	needs: [all-green]
	if: >-
	needs.all-green.result == 'success' &&
	github.event_name == 'push' &&
	github.ref == 'refs/heads/main'
	permissions:
	# contents write lets the hook push a fast-forward branch (a packaged latest).
	# id-token write lets it mint the run's OIDC token for trusted publishing (npm, PyPI).
	# A called job cannot exceed its caller, so both scopes are granted here.
	contents: write
	id-token: write
	uses: ./.github/workflows/post-green.yml
	with:
	sha: ${{ github.sha }}
	# The called workflow is this repository's own, so it inherits the repository's secrets by design.
	# nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit
	secrets: inherit # zizmor: ignore[secrets-inherit]

	# The legs below gate themselves on the plan's modules output, a substring test on the compact JSON array, hence the quoted module name.
	# `ci` sits in each needs list because a job reads outputs only from its direct dependencies.
	#
	# needs post-green -> the repository's own green-gated work lands before the tag is minted
	# no lane here -> a shared lane keeps one pending call and cancels the older, so a release commit's call could be cancelled;
	# the called job holds its own lane keyed by the judged commit
	release:
	needs: [ci, all-green, post-green]
	if: >-
	needs.all-green.result == 'success' &&
	needs.post-green.result == 'success' &&
	github.event_name == 'push' &&
	github.ref == 'refs/heads/main' &&
	contains(needs.ci.outputs.modules, '"release-please"')
	permissions:
	contents: write
	pull-requests: write
	issues: read
	vulnerability-alerts: read
	uses: Vivswan/repo-platform/.github/workflows/fleet-release.yml@stable
	with:
	sha: ${{ github.sha }}
	tracking-labels: ${{ needs.ci.outputs.tracking-labels }}

	# Repo-owned: edit update-release.yml, not this file.
	# The ceiling here and on update-release-pr is the contract with the repo-owned hooks: a hook narrows itself per job,
	# and a narrower caller ceiling rejects an existing hook that asks for more (one requesting packages: read failed against a ceiling without it).
	update-release:
	needs: [release]
	if: needs.release.outputs.release_created == 'true'
	permissions:
	contents: write
	pull-requests: write
	packages: write
	id-token: write
	attestations: write
	issues: read
	vulnerability-alerts: read
	uses: ./.github/workflows/update-release.yml
	with:
	tag: ${{ needs.release.outputs.tag_name }}
	# The called workflow is this repository's own, so it inherits the repository's secrets by design.
	# nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit
	secrets: inherit # zizmor: ignore[secrets-inherit]

	publish-release:
	needs: [release, update-release]
	if: needs.release.outputs.release_created == 'true'
	permissions:
	contents: write
	id-token: write
	attestations: write
	uses: Vivswan/repo-platform/.github/workflows/fleet-release-publish.yml@stable
	with:
	tag: ${{ needs.release.outputs.tag_name }}

	# Repo-owned: edit update-release-pr.yml, not this file. The ceiling is update-release's, under the same contract.
	update-release-pr:
	needs: [release]
	if: needs.release.outputs.prs_created == 'true'
	permissions:
	contents: write
	pull-requests: write
	packages: write
	id-token: write
	attestations: write
	issues: read
	vulnerability-alerts: read
	uses: ./.github/workflows/update-release-pr.yml
	with:
	pr_number: ${{ needs.release.outputs.pr_number }}
	head_branch: ${{ needs.release.outputs.pr_head_branch }}
	# The called workflow is this repository's own, so it inherits the repository's secrets by design.
	# nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit
	secrets: inherit # zizmor: ignore[secrets-inherit]

	# Same run as the gate, so github.sha IS the judged commit and a red main never reaches the site.
	# needs post-green, publish-release -> a release commit's own deploy serves its new tag
	# !cancelled() -> those edges are orders, not gates: a skipped or red release still deploys
	# no push clause -> every main run deploys, so the nightly schedule IS the rebuild and a dispatch IS the manual deploy
	site:
	needs: [ci, all-green, post-green, publish-release]
	if: >-
	!cancelled() &&
	needs.all-green.result == 'success' &&
	github.ref == 'refs/heads/main' &&
	contains(needs.ci.outputs.modules, '"site"')
	concurrency:
	group: pages
	permissions:
	contents: read
	pages: write
	id-token: write
	issues: write
	uses: Vivswan/repo-platform/.github/workflows/reusable-site.yml@stable
	with:
	sha: ${{ github.sha }}

Navigation Menu

chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks #2016

Workflow file

chore(build): replace the webhook events generator with a test that pins the list to @octokit/openapi-webhooks #2016

Uh oh!

Workflow file for this run