From 03a022c423a35d9b375b19fab560dc00027bb6fb Mon Sep 17 00:00:00 2001
From: Bob Killen <bkillen@linuxfoundation.org>
Date: Wed, 23 Sep 2026 15:14:55 -0500
Subject: [PATCH] ci: harden workflows and publish coverage

- Add persist-credentials: false to remaining checkouts in
  import-architectures, refresh-community-people, deploy-gh-pages,
  and the new hygiene workflow (#219)
- Remove unused GH_TOKEN from the ci.yml build step; the Docusaurus
  build reads only SITE_URL/BASE_URL (#279)
- Scope pages: write and id-token: write to the deploy job in
  deploy-gh-pages.yml; build job runs with contents: read (#374)
- Run unit tests with coverage in CI, publish the summary to the job
  summary, and upload it as an artifact; the coverage runner
  propagates test failures (#186)
- Add a scheduled workflow running scripts/pr-queue-hygiene.mjs every
  6 hours with a dry-run-tested least-privilege token (#454)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Bob Killen <bkillen@linuxfoundation.org>
---
 .github/workflows/ci.yml                      | 18 ++++++++--
 .github/workflows/deploy-gh-pages.yml         |  9 +++--
 .github/workflows/import-architectures.yml    |  2 ++
 .github/workflows/pr-queue-hygiene.yml        | 34 +++++++++++++++++++
 .../workflows/refresh-community-people.yml    |  2 ++
 5 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/pr-queue-hygiene.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eeef29e7..cc5491fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,12 +24,24 @@ jobs:
           cache: npm
       - name: Install dependencies
         run: npm ci
-      - name: Run unit tests
-        run: npm run test:unit
+      - name: Run unit tests with coverage
+        run: npm run test:unit:coverage | tee coverage-summary.txt
+        shell: bash -o pipefail {0}
+      - name: Publish coverage summary
+        if: always()
+        run: |
+          if [ -f coverage-summary.txt ]; then
+            { echo '## Unit test coverage'; echo '```'; cat coverage-summary.txt; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-summary
+          path: coverage-summary.txt
       - name: Build production site
         run: npm run build:production
         env:
-          GH_TOKEN: ${{ github.token }}
           SITE_URL: https://cncf.github.io
           BASE_URL: /endusers/
 
diff --git a/.github/workflows/deploy-gh-pages.yml b/.github/workflows/deploy-gh-pages.yml
index 91fe8703..8bcacb75 100644
--- a/.github/workflows/deploy-gh-pages.yml
+++ b/.github/workflows/deploy-gh-pages.yml
@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -21,9 +19,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -73,6 +75,9 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-24.04
     needs: build
+    permissions:
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
diff --git a/.github/workflows/import-architectures.yml b/.github/workflows/import-architectures.yml
index f57cb64a..2cc53487 100644
--- a/.github/workflows/import-architectures.yml
+++ b/.github/workflows/import-architectures.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
diff --git a/.github/workflows/pr-queue-hygiene.yml b/.github/workflows/pr-queue-hygiene.yml
new file mode 100644
index 00000000..e34c5445
--- /dev/null
+++ b/.github/workflows/pr-queue-hygiene.yml
@@ -0,0 +1,34 @@
+name: PR queue hygiene
+
+on:
+  schedule:
+    - cron: '43 */6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  hygiene:
+    name: Flag stale conflicting PRs
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Run PR queue hygiene
+        run: npm run pr-queue-hygiene
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/refresh-community-people.yml b/.github/workflows/refresh-community-people.yml
index b03bce70..e34b2457 100644
--- a/.github/workflows/refresh-community-people.yml
+++ b/.github/workflows/refresh-community-people.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}