Skip to content

Ci hardening - #608

Open
Saul-STFC wants to merge 4 commits into
stackabletech:mainfrom
Saul-STFC:CI-Hardening
Open

Ci hardening#608
Saul-STFC wants to merge 4 commits into
stackabletech:mainfrom
Saul-STFC:CI-Hardening

Conversation

@Saul-STFC

@Saul-STFC Saul-STFC commented Jul 14, 2026

Copy link
Copy Markdown

This PR introduces a collection of 'correctness fixes' and 'hygiene' improvements to the CI templates:

Including:

  • Fix failure condition to check actual job results e.g a skipped job will silently pass
  • Add missing job dependencies to notify and validate all required jobs in finished
  • Guard build-container-image, publish, provenance, preflight and notify jobs with github.repository_owner == 'stackabletech' so fork PRs no longer queue runners or attempt to push images
  • Pinned deps to latest hashes
  • Some other small hardening improvements

* ci: Bump actions/checkout to v7.0.0
* ci: Add explicit permissions to jobs
* ci: Conditionally install host dependencies without cache
* ci: Conditionally set rust-cache lookup-only
* ci: Skip publish jobs for forks
* ci: Remove checkout step from notify job
@Techassi
Techassi self-requested a review July 14, 2026 18:10
* Prevent notification on cancelled workflows
* Update failure condition to check job results
* Add missing job dependencies to notify job
* Validate required jobs in finished job
* Fix detect-changes globs to cover subdirectory Rust sources
* Match dependency versions across templates
* Guard publish/provenance jobs with stackabletech owner check
* Fix daily security workflow
@Saul-STFC
Saul-STFC marked this pull request as ready for review July 20, 2026 09:24
@sbernauer sbernauer moved this to Development: In Review in Stackable Engineering Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Development: In Review

Development

Successfully merging this pull request may close these issues.

2 participants