Merge branch 'AliceO2Group:master' into NetChargeFluctuations

Author: pravatp98

.github/dependabot.yml

@@ -0,0 +1,10 @@
+---
+# Dependabot configuration
+# Reference: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/mega-linter.yml

@@ -38,7 +38,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/flavors/
-        uses: oxsecurity/megalinter@v8.3.0
+        uses: oxsecurity/megalinter@v8.5.0
         env:
           # All available variables are described in documentation:
           # https://megalinter.io/configuration/

.github/workflows/o2-linter.yml

@@ -2,10 +2,10 @@
 # Find issues in O2 code
 name: O2 linter
 
-'on': [pull_request, push]
+"on": [pull_request_target, push]
 permissions: {}
 env:
-  MAIN_BRANCH: master
+  BRANCH_MAIN: master
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -15,20 +15,47 @@ jobs:
   o2-linter:
     name: O2 linter
     runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
     steps:
+      - name: Set branches
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            branch_head="${{ github.ref }}"
+            branch_base="${{ env.BRANCH_MAIN }}"
+          else
+            branch_head="refs/pull/${{ github.event.pull_request.number }}/merge"
+            branch_base="${{ github.event.pull_request.base.ref }}"
+          fi
+          echo BRANCH_HEAD="$branch_head" >> "$GITHUB_ENV"
+          echo BRANCH_BASE="$branch_base" >> "$GITHUB_ENV"
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
+          ref: ${{ env.BRANCH_HEAD }}
           fetch-depth: 0 # needed to get the full history
       - name: Run tests
+        id: linter
         run: |
-          # Diff against the common ancestor of the source branch and the main branch.
-          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.MAIN_BRANCH }}...)
+          # Diff against the common ancestor of the source (head) branch and the target (base) branch.
+          echo "Diffing ${{ env.BRANCH_HEAD }} against ${{ env.BRANCH_BASE }}."
+          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.BRANCH_BASE }}...)
           if [ ${#files[@]} -eq 0 ]; then
               echo "::notice::No files to lint."
+              echo "linter_ran=0" >> "$GITHUB_OUTPUT"
               exit 0
           fi
-          [ ${{ github.event_name }} == 'pull_request' ] && options="-g"
+          echo "linter_ran=1" >> "$GITHUB_OUTPUT"
+          [[ "${{ github.event_name }}" == "pull_request_target" ]] && options="-g"
           # shellcheck disable=SC2086 # Ignore unquoted options.
           python3 Scripts/o2_linter.py $options "${files[@]}"
           echo "Tip: If you allow actions in your fork repository, O2 linter will run when you push commits."
+      - name: Comment PR
+        if: (success() || failure()) && (github.event_name == 'pull_request_target' && steps.linter.outputs.linter_ran == 1)
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          comment-tag: o2-linter
+          message: "**O2 linter results:**
+            ❌ ${{ steps.linter.outputs.n_issues }} errors,
+            ⚠️ ${{ steps.linter.outputs.n_tolerated }} warnings,
+            🔕 ${{ steps.linter.outputs.n_disabled }} disabled"

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v1
+      - uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: 'This PR has not been updated in the last 30 days. Is it still needed? Unless further action is taken, it will be closed in 5 days.'

.mega-linter.yml

@@ -15,7 +15,11 @@ DISABLE_LINTERS:
   - BASH_SHFMT
   - CPP_CLANG_FORMAT
   - JSON_PRETTIER
+  - PYTHON_BLACK
+  - PYTHON_FLAKE8
+  - PYTHON_ISORT
   - REPOSITORY_DEVSKIM
+  - REPOSITORY_GITLEAKS
   - REPOSITORY_KICS
   - REPOSITORY_SECRETLINT
   - REPOSITORY_TRIVY
@@ -35,3 +39,4 @@ PYTHON_PYRIGHT_CONFIG_FILE: pyproject.toml
 PYTHON_RUFF_CONFIG_FILE: pyproject.toml
 CPP_CPPLINT_FILE_EXTENSIONS: [".C", ".c", ".c++", ".cc", ".cl", ".cpp", ".cu", ".cuh", ".cxx", ".cxx.in", ".h", ".h++", ".hh", ".h.in", ".hpp", ".hxx", ".inc", ".inl", ".macro"]
 CPP_CLANG_FORMAT_FILE_EXTENSIONS: [".C", ".c", ".c++", ".cc", ".cl", ".cpp", ".cu", ".cuh", ".cxx", ".cxx.in", ".h", ".h++", ".hh", ".h.in", ".hpp", ".hxx", ".inc", ".inl", ".macro"]
+REPOSITORY_GITLEAKS_PR_COMMITS_SCAN: true

.pre-commit-config.yaml

@@ -7,6 +7,10 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: "v18.1.3" # clang-format version
+    rev: v18.1.3 # clang-format version
     hooks:
       - id: clang-format
+  - repo: https://github.com/cpplint/cpplint
+    rev: 2.0.0
+    hooks:
+      - id: cpplint