Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -206,20 +206,19 @@ jobs:
env:
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
steps:
- uses: actions/checkout@v7
- name: Free Disk Space
# Static release build of the full workspace; the cargo target dir
# is the largest in any of the linux jobs. `remove_tool_cache: true`
# is safe even without a `dtolnay/rust-toolchain` step — the
# pre-installed Rust toolchain on ubuntu-latest lives in
# `~/.rustup` + `~/.cargo`, not `/opt/hostedtoolcache`, so
# `rustup target add` below still resolves.
# is the largest in any of the linux jobs.
#
# Runs BEFORE checkout: the action copies a `bc` binary into its
# working dir, which dirty's the checkout.
uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable
with:
remove_android: true
remove_dotnet: true
remove_haskell: true
remove_tool_cache: true
- uses: actions/checkout@v7
Comment on lines 209 to +221

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if CODEOWNER review is required for this PR's workflow file changes.
# Verify the repo rulesets and CODEOWNERS file for .github/workflows/release.yml.

# Check CODEOWNERS for workflow ownership
fd -t f CODEOWNERS .github/ 2>/dev/null | head -5
fd -t f CODEOWNERS . 2>/dev/null | head -5

# If found, grep for workflow-related ownership rules
fd -t f CODEOWNERS . -d 1 2>/dev/null -x cat {} \; 2>/dev/null | grep -i workflow

Repository: gominimal/minimal

Length of output: 174


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== CODEOWNERS =="
cat -n .github/CODEOWNERS

echo
echo "== workflow snippets =="
sed -n '200,225p' .github/workflows/release.yml

echo
echo "== paths matched by CODEOWNERS rules for workflows =="
python3 - <<'PY'
from pathlib import Path

codeowners = Path('.github/CODEOWNERS').read_text().splitlines()
rules = []
for raw in codeowners:
    line = raw.strip()
    if not line or line.startswith('#'):
        continue
    parts = line.split()
    if len(parts) >= 2:
        rules.append((parts[0], parts[1:]))

for pat, owners in rules:
    if 'workflow' in pat.lower() or pat.startswith('.github/'):
        print(f"{pat} -> {' '.join(owners)}")
PY

Repository: gominimal/minimal

Length of output: 1768


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find any repo policy/rules docs that mention workflow changes or CODEOWNERS gating.
rg -n --hidden --glob '!.git' -e 'workflow' -e 'CODEOWNER' -e 'ruleset' -e 'frozen' README* .github . 2>/dev/null | head -200

Repository: gominimal/minimal

Length of output: 17993


Workflow edits need owner approval. .github/workflows/release.yml is part of the frozen CI layer and covered by @gominimal/minimalists, so this change should only merge with CODEOWNER review.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 209 - 221, Do not merge the
workflow change without approval from the CODEOWNER group
`@gominimal/minimalists`, as required for the frozen CI layer; obtain and preserve
the required owner review for the release workflow edits.

Sources: Coding guidelines, Learnings

- name: Install dependencies
run: sudo apt-get update && sudo apt-get install -y musl-tools protobuf-compiler
- name: Add Rust target
Expand Down