Skip to content

README.md

Latest commit

 

History

History
132 lines (89 loc) · 8.48 KB

README.md

File metadata and controls

132 lines (89 loc) · 8.48 KB
Raw

frmscoe/workflows

⚠️ This repository is a downstream mirror of tazama-lf/workflows, which is the canonical source for all Tazama GitHub Actions workflows.

All workflow changes must originate in tazama-lf/workflows. There is no automated sync between the two workflow repos - changes must be applied here manually after merging in tazama-lf/workflows. Do not edit workflow files in this repo directly without a corresponding change upstream.

For complete SDLC documentation, repository class definitions, workflow reference tables, routine maintenance procedures, and known issues, see the tazama-lf/workflows README.

What this repo is

This repository holds the GitHub Actions workflows distributed to all active frmscoe organisation repositories (33 rule repos). It is a manually-maintained subset of tazama-lf/workflows, adapted for the frmscoe org context.

Cascade and dependency

Changes flow in one direction:

tazama-lf/workflows  →  (manual PR)  →  frmscoe/workflows  →  (auto sync on push:dev)  →  33 frmscoe rule repos
  1. A workflow change is developed and merged to dev in tazama-lf/workflows.
  2. The same change is applied manually to frmscoe/workflows via a separate PR.
  3. On merge to dev in frmscoe/workflows, sync-workflows.yml fires automatically (push: dev) and opens sync-workflows-update PRs in all 33 target rule repos.
  4. Reviewers merge the sync PRs in each rule repo.

Note: Unlike tazama-lf/workflows (which triggers sync on every PR event before merge), frmscoe/workflows triggers sync only on push: dev - i.e. after merge. Sync PRs in rule repos accurately reflect merged changes.

Differences from tazama-lf/workflows

Aspect frmscoe/workflows tazama-lf/workflows
npm scope @frmscoe @tazama-lf
Docker caller stub org rule_org: "frmscoe" rule_org: "tazama-lf"
Sync trigger push: dev (after merge) pull_request: [dev] (on open/update)
Sync targets 33 frmscoe rule repos 26 tazama-lf repos
Sync segmentation None - all repos receive the same file set SPECIFIC_REPOS / PUBLISH_REPOS / RULE_REPOS groups
Missing workflows dockerfile-linter.yml, dockerhub-image-build.yml, dockerhub-image-build-rc.yml All canonical files present
Node.js CI node-ci.yml uses NPM_SCOPE: @frmscoe; stub calls frmscoe/workflows/node-ci.yml@dev node-ci.yml uses NPM_SCOPE: @tazama-lf; stub calls tazama-lf/workflows/node-ci.yml@dev

Workflows distributed to frmscoe rule repos

All 33 rule repos receive:

branch-target-check.yml, codacy.yml, codeql.yml, conventional-commits.yml, dco-check.yml, dependency-review.yml, gpg-verify.yml, node.js.yml (caller stub), sbom.yml

Plus per-repo caller stubs for: package-rule-rc.yml (fires on push: dev) and package-rule.yml (fires on push: main)

Not distributed: sync-workflows.yml, node-ci.yml (reusable workflow stays in this repo; consumer repos reference it at runtime via @dev ref), package-rule*.yml canonical reusable definitions (replaced with caller stubs), dev-to-main-pr.yml / publish.yml / release*.yml / version-check.yml (library or central-only), njsscan.yml, scorecard.yml (see decision below)

Decision: no dedicated Code Security scanning on private frmscoe rule repos

Date: August 2026

Context: njsscan and Scorecard upload SARIF into GitHub Code scanning. On private and internal repos that needs paid GitHub Code Security (list price about $30 per unique 90-day active committer / month). Enablement on private frmscoe rule repos is locked by a billing issue, so those jobs fail without producing a usable dashboard.

Decision: Do not run dedicated billable code-scanning workflows (njsscan.yml, scorecard.yml) on the private frmscoe rule repos. Keep that scanning on the public reference rules instead:

Fixes and findings picked up on those public repos are expected to propagate into the frmscoe rules through the normal central-workflow / release path. Paying for Code Security on every private rule repo is not required for that model.

What we changed here:

  1. Documented this decision in this README.
  2. Stopped syncing njsscan.yml and scorecard.yml to the 33 private rule repos, and remove those files on sync if they are still present.
  3. Left the workflow definitions in this repo for reference / possible use on public surfaces. They are no longer part of the private-rule sync bundle.

Out of scope for this decision: CodeQL and Codacy also use SARIF upload and can hit the same Code Security lock on private repos. They were not removed here. Revisit if they stay red for the same billing reason.

Related: tazama-lf/workflows#66 (CodeQL Action v3 → v4) is separate hygiene and does not unblock private-repo SARIF while Code Security is locked.

Target repositories

rule-001, rule-002, rule-003, rule-004, rule-006, rule-007, rule-008, rule-010, rule-011, rule-016, rule-017, rule-018, rule-020, rule-021, rule-024, rule-025, rule-026, rule-027, rule-028, rule-030, rule-044, rule-045, rule-048, rule-054, rule-063, rule-074, rule-075, rule-076, rule-078, rule-083, rule-084, rule-090, rule-091

Workflow documentation

Individual workflow documentation is in workflow-docs/. For workflows shared with tazama-lf/workflows, docs contain a redirect link to the canonical entry in that repo. Docs for frmscoe-specific behaviour (publish.yml, package-rule*.yml, sync-workflows.yml) are maintained here.

Doc Status
branch-target-check.md → tazama-lf docs
codacy.md → tazama-lf docs
codeql.md → tazama-lf docs
conventional-commits.md → tazama-lf docs
dco-check.md → tazama-lf docs (⚠️ known issue #37)
dependency-review.md → tazama-lf docs
dockerfile-linter.md Not in frmscoe/workflows
dockerhub-image-build.md Not in frmscoe/workflows
gpg-verify.md → tazama-lf docs
milestone.md → tazama-lf docs
njsscan.md Not synced to private frmscoe rules (public rule-901/902)
node-ci.md frmscoe-specific (NPM_SCOPE=@frmscoe)
nodejs.md → tazama-lf docs
package-rule-rc.md frmscoe-specific
package-rule.md frmscoe-specific
publish.md frmscoe-specific (@frmscoe scope)
release-train.md → tazama-lf docs
release.md → tazama-lf docs
sbom.md → tazama-lf docs (⚠️ known issue #39)
scorecard.md Not synced to private frmscoe rules (public rule-901/902)
sync-workflows.md frmscoe-specific
version-check.md → tazama-lf docs

Updating this repo

To apply a workflow change from tazama-lf/workflows:

  1. Confirm the source PR in tazama-lf/workflows is merged to dev.
  2. Open a PR in this repo with the same changes, referencing the source PR.
  3. Update the corresponding workflow-docs/ entry if the frmscoe behaviour differs.
  4. On merge to dev, sync-workflows.yml will open sync-workflows-update PRs in all 33 target repos.
  5. Review and merge the sync PRs in each target repo.