feat: thin-caller suite + picker template; retire individual templates by dkastl · Pull Request #74 · geolonia/.github

dkastl · 2026-06-29T06:36:30Z

What

Makes the Security Suite a single source of truth and puts it in the org template picker.

security-suite.yml (the ruleset source) is now a thin caller of reusable-security-suite.yml@v1.20.0 instead of inlining ~230 lines.
workflow-templates/security-suite.yml (+ .properties.json, shield icon) is added, so "Security Suite (all checks)" shows up under New workflow → By Geolonia for repos that opt in manually.
The individual bumblebee-scan / secret-leak-check / pinact-check picker templates are retired (the suite supersedes them). The reusables they called are untouched.

Why

Last week's suite logic lived only in the ruleset source, so it couldn't be offered in the picker without a drift-prone copy. Now both the ruleset source and the picker template are one-line callers of the reusable.

Adoption guidance (in the template header + properties)

Prefer the org Security Suite ruleset where enabled; use this template only for repos outside that ruleset. A repo should not have both (they would run the suite twice).

Part of geolonia-operations#196.

Validation

actionlint clean on both callers
zizmor self-audit: no findings
This PR runs the thin-caller security-suite.yml on itself, exercising the reusable end-to-end.

Summary by CodeRabbit

New Features
- Added a new “Security Suite” workflow template for pull requests, combining security checks into one streamlined run with consolidated reporting.
- Added a matching template entry so it appears in the repository’s workflow options.
Chores
- Removed several older, individual security workflow templates and their related metadata to simplify the available automation set.

- security-suite.yml (ruleset source) is now a thin caller of reusable-security-suite.yml@v1.20.0 - add workflow-templates/security-suite.yml (+ .properties.json, shield icon) so the suite appears in the org 'New workflow' picker - retire the individual bumblebee-scan / secret-leak-check / pinact-check picker templates (superseded by the suite; the reusables themselves stay) One source of truth for the suite. Part of geolonia-operations#196.

github-actions · 2026-06-29T06:36:45Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-29T06:36:58Z

🛡️ Security suite

Check	Result
✅ Supply chain · `bumblebee`	No exposure matches
✅ Secrets · `betterleaks`	No secrets in diff
✅ Action pinning · `pinact`	All actions pinned
⚠️ Actions audit · `zizmor`	Findings (warn-only; see annotations)

Warning

Warnings only. These do not block the PR, but please review them.

_{Updated for 4779fb2 · workflow run}

dkastl · 2026-06-29T06:41:58Z

@coderabbitai review

coderabbitai · 2026-06-29T06:42:03Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-06-29T06:42:11Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 34 minutes

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable usage-based reviews in Billing to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information, and refer to the rate limits docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6f61f9ea-3daf-4d55-92af-568f8835bbf7

📥 Commits

Reviewing files that changed from the base of the PR and between 0481c88 and 4779fb2.

📒 Files selected for processing (1)

workflow-templates/security-suite.yml

Walkthrough

Three individual security workflow templates (bumblebee-scan, pinact-check, secret-leak-check) and their properties files are removed. A new consolidated security-suite workflow template is added. The org required workflow .github/workflows/security-suite.yml is rewritten from inline scanner jobs to a single suite job delegating to the pinned reusable reusable-security-suite.yml@v1.20.0.

Changes

Security Suite Consolidation

Layer / File(s)	Summary
Remove individual security workflow templates `workflow-templates/bumblebee-scan.yml`, `workflow-templates/bumblebee-scan.properties.json`, `workflow-templates/pinact-check.yml`, `workflow-templates/pinact-check.properties.json`, `workflow-templates/secret-leak-check.yml`, `workflow-templates/secret-leak-check.properties.json`	Deletes all three standalone security scan workflow templates and their metadata files.
Add consolidated security-suite template `workflow-templates/security-suite.properties.json`, `workflow-templates/security-suite.yml`	Adds a new "Security Suite (all checks)" template with metadata and a workflow that invokes `reusable-security-suite.yml` (pinned to v1.20.0) with `pull-requests: write` and `issues: write` job-level permissions and concurrency cancellation.
Refactor org required workflow to reusable caller `.github/workflows/security-suite.yml`	Replaces the inline `supply-chain`/betterleaks/pinact/zizmor jobs and consolidated reporting logic with a single `suite` job that delegates to `reusable-security-suite.yml@63e21d7...`, granting only the permissions needed for the reusable suite.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

geolonia/.github#60: Directly edits the same workflow template files (bumblebee-scan.yml, pinact-check.yml, secret-leak-check.yml) to SHA-pin their reusable uses: references.
geolonia/.github#71: Originally adds the full fan-out and inline consolidated reporting implementation in .github/workflows/security-suite.yml that this PR replaces.
geolonia/.github#73: Extracts reusable-security-suite.yml, the same reusable workflow this PR now delegates to from both the org workflow and the new template.

Suggested labels

github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the main change: introducing a thin security-suite caller and retiring individual templates.
Description check	✅ Passed	The description covers the summary, rationale, adoption guidance, and validation, with only the template headings and explicit related-issues section loosely matched.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/security-suite-template

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@workflow-templates/security-suite.yml`:
- Around line 14-16: The workflow trigger in the security suite template is
hard-coded to a specific branch, which prevents generated workflows from running
correctly in repos with a different default branch. Update the trigger in the
workflow template to use the `$default-branch` placeholder instead of `main`,
and make sure the `on.pull_request.branches` configuration in the security suite
workflow remains aligned with the template’s default-branch behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b089f218-7e7e-4484-b30a-a4224ae44e7a

📥 Commits

Reviewing files that changed from the base of the PR and between de8cd27 and 0481c88.

📒 Files selected for processing (9)

.github/workflows/security-suite.yml
workflow-templates/bumblebee-scan.properties.json
workflow-templates/bumblebee-scan.yml
workflow-templates/pinact-check.properties.json
workflow-templates/pinact-check.yml
workflow-templates/secret-leak-check.properties.json
workflow-templates/secret-leak-check.yml
workflow-templates/security-suite.properties.json
workflow-templates/security-suite.yml

💤 Files with no reviewable changes (6)

workflow-templates/bumblebee-scan.yml
workflow-templates/secret-leak-check.properties.json
workflow-templates/pinact-check.properties.json
workflow-templates/pinact-check.yml
workflow-templates/bumblebee-scan.properties.json
workflow-templates/secret-leak-check.yml

Per CodeRabbit: the workflow-template is copied into adopting repos, so hardcoding 'main' skips repos with a different default branch. The picker substitutes $default-branch at creation time.

github-actions · 2026-06-29T06:53:09Z

Secret Leak Check

OK No secrets detected in this PR's diff.

dkastl marked this pull request as ready for review June 29, 2026 06:37

coderabbitai Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread workflow-templates/security-suite.yml Outdated

fix: use $default-branch in the picker template trigger

4779fb2

Per CodeRabbit: the workflow-template is copied into adopting repos, so hardcoding 'main' skips repos with a different default branch. The picker substitutes $default-branch at creation time.

dkastl merged commit 689f126 into main Jun 29, 2026
8 checks passed

dkastl deleted the feat/security-suite-template branch June 29, 2026 06:54

coderabbitai Bot mentioned this pull request Jul 1, 2026

fix: bump suite to reusable-security-suite@v1.22.0 (activate warn-only pinact + config fallback) #79

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: thin-caller suite + picker template; retire individual templates - #74

feat: thin-caller suite + picker template; retire individual templates#74
dkastl merged 2 commits into
mainfrom
feat/security-suite-template

dkastl commented Jun 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

dkastl commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

Review limit reached

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dkastl commented Jun 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Adoption guidance (in the template header + properties)

Validation

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Jun 29, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Security suite

Uh oh!

dkastl commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Secret Leak Check

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dkastl commented Jun 29, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading