Feat/allow other orgs #43
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #43 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 8 8
=========================================
Hits 8 8 ☔ View full report in Codecov by Sentry. |
|
this remains in draft status because we see obvious security recommendations not to use secrets this way |
There was a problem hiding this comment.
Pull request overview
This PR enhances the reusability of GitHub Actions workflows by allowing other organizations to use them without hardcoding secret names. The changes make the workflows configurable through inputs, with sensible defaults for the current organization.
- Adds configurable input parameters for secret names (app ID, private keys, GPG keys, passphrases, fingerprints)
- Introduces feature flags to enable/disable commit signing, tag signing, and organization bot auto-merge
- Replaces hardcoded secret references with dynamic lookups using the new input parameters
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
.github/workflows/contributors.yml |
Adds inputs for configurable secret names and commit signing flag; updates secret references to use dynamic lookups |
.github/workflows/bump-release.yml |
Adds inputs for tag signing configuration and GPG-related secret names; updates secret references and adds conditional tag signing logic |
.github/workflows/auto-merge.yml |
Adds inputs to configure organization bot name and enable/disable auto-merge functionality |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
fredbi
force-pushed
the
feat/allow-other-orgs
branch
from
3cff92d to
5d8b74f
Compare
Problem statement ================= When using workflows such as: * contributors * bump-release * auto-merge the retrieval of secrets for commit or tag PGP-signature and token switch with a github app is currently specific to go-openapi. Proposed solution ================= The names of the secrets (not the secrets themselves) can be injected via optional input parameters into these shared workflows. To avoid excessive secret exposure in workflows, usage of the injected secrets is handed over to a dedicated action, that configures GPG (for signing secrets) or switches token (for github app token exchange). Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
fredbi
force-pushed
the
feat/allow-other-orgs
branch
from
5d8b74f to
43e4515
Compare
1 participant
Change type
Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update
Short description
Fixes
Full description
Checklist