mirror of
https://github.com/aws/agent-toolkit-for-aws.git
synced 2026-09-14 14:30:26 +08:00
Roman Shevchuk
7c04f8f3a8
- Add concurrency groups to build, pull-request-lint, dependency-review, and merge-prevention workflows. PR-triggered runs cancel in-progress superseded runs; push and merge_group runs are allowed to complete. pull-request-lint keys on github.event.pull_request.number because pull_request_target's github.ref points to the base branch. - Add timeout-minutes to every job (5-30 min depending on workload) to replace the 6-hour default. - Extend CodeQL matrix to cover Python (build-mode: none) alongside the existing GitHub Actions analysis, so tools/validate.py and any future Python helpers are scanned. - Add a push trigger on main to build.yml so direct pushes to the protected branch still run lint/validate/security.
53 lines
1.1 KiB
YAML
53 lines
1.1 KiB
YAML
name: PR Lint
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, edited, synchronize, reopened]
|
|
branches: [main]
|
|
|
|
# Key on PR number because pull_request_target's github.ref is the base branch.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
# Default to no permissions; grant minimally at the job level.
|
|
permissions:
|
|
actions: none
|
|
attestations: none
|
|
checks: none
|
|
contents: none
|
|
deployments: none
|
|
discussions: none
|
|
id-token: none
|
|
issues: none
|
|
models: none
|
|
packages: none
|
|
pages: none
|
|
pull-requests: none
|
|
repository-projects: none
|
|
security-events: none
|
|
statuses: none
|
|
|
|
jobs:
|
|
pr-title:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
pull-requests: read
|
|
steps:
|
|
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
types: |
|
|
feat
|
|
fix
|
|
docs
|
|
style
|
|
refactor
|
|
perf
|
|
test
|
|
chore
|
|
ci
|
|
requireScope: false
|