ci: make workflows public-repo safe & unblock Dependabot - #14
Merged
Conversation
- deploy-worker: manual trigger only (no auto-deploy of live infra from a public repo) - health-check / ripe-atlas: drop schedule (avoid leaking live endpoints in public logs; run manually) - release: fall back to GITHUB_TOKEN when RELEASE_TOKEN is unset - commitlint: relax body/footer line length so Dependabot PRs pass
There was a problem hiding this comment.
Pull request overview
This PR hardens GitHub Actions workflows for a public repository by disabling automated infra/monitoring triggers that either fail without private secrets or could expose sensitive operational details in public logs, and by relaxing commitlint rules to allow Dependabot-generated commit bodies.
Changes:
- Disable scheduled triggers for
health-checkandripe-atlas-check, leaving manual dispatch only. - Disable
deploy-workerauto-deploy onpush, leaving manual/reusable invocation paths. - Make the release workflow fall back to the default GitHub token and relax commitlint max line-length rules for bodies/footers.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| commitlint.config.js | Disables body/footer max line-length rules to allow Dependabot commit formats. |
| .github/workflows/ripe-atlas-check.yml | Removes cron scheduling; keeps manual triggering with a note about public log exposure. |
| .github/workflows/release.yml | Falls back to GITHUB_TOKEN when RELEASE_TOKEN is not configured. |
| .github/workflows/health-check.yml | Removes cron scheduling; keeps manual triggering with rationale for public repos. |
| .github/workflows/deploy-worker.yml | Removes push-based auto-deploy trigger and documents the intent for public-repo safety. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+4
to
7
| # Auto-deploy on push is intentionally disabled for the public repo — deploying | ||
| # live infrastructure is a manual, credentialed action. Trigger by hand instead. | ||
| workflow_call: | ||
| workflow_dispatch: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes CI green on the public repo and applies the review's CI hardening:
schedule— public run logs would expose live endpoints, and public cron auto-disables after 60 days. Run manually or from a private repo.GITHUB_TOKENwhenRELEASE_TOKENis unset (was failing on push).body/footer-max-line-lengthso Dependabot PRs (chore(ci): bump DavidAnson/markdownlint-cli2-action from 22 to 24 #1–chore(ci): bump opentofu/setup-opentofu from 1 to 2 #4) pass.No functional/app code changes.