chore: standardize GitHub Actions workflows by electrocucaracha · Pull Request #87 · electrocucaracha/bmaas

electrocucaracha · 2026-04-24T19:14:19Z

Summary

standardize pinned GitHub Actions versions in lint/linter, spellcheck, and update workflows
align workflow action references with the latest owner-wide conventions
preserve each repository's existing workflow behavior and repository-specific validations

Standardize pinned GitHub Actions versions across lint, spellcheck, and update workflows while preserving repository-specific behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

electrocucaracha · 2026-04-24T22:04:28Z

@copilot fix the linting issues, use make lint command to verify

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/4082a456-d67d-4449-9264-686ef8810ad0 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot · 2026-04-24T22:06:28Z

@copilot fix the linting issues, use make lint command to verify

Fixed in 23fd282. The yamllint warnings about "too few spaces before comment" were caused by single-space separators before the # version comments on action uses: lines. Updated all affected lines in linter.yml, spell.yml, and update.yml to use two spaces before # as required. tox -e lint now passes cleanly for all changed files.

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/382bd557-9c4e-4202-a73c-3f9e6e8da525 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

- Add persist-credentials: false to all checkout steps (artipacked) - Replace permissions: read-all with minimal explicit permissions in ci.yml, linter.yml, spell.yml - Move contents/pull-requests write permissions to job level in update.yml (excessive-permissions) - Suppress secrets-outside-env for WORKFLOW_TOKEN in update.yml - Add gitleaks:allow to tinkerbell/deploy.sh false positive - Run prettier to fix YAML formatting in all affected workflow files Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/8c1c69d8-ea31-4c4e-bda7-6eb784822079 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/9cf8ee63-1d48-4d6c-928e-120fe7fbf661 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

- BIOME_FORMAT: convert bifrost/testvm.json, mlc_config.json, tinkerbell/testvm.json from 2-space to tab indentation using biome formatter - EDITORCONFIG: remove EDITORCONFIG_FILE_NAME env var from linter.yml that caused ec to parse the INI-format .editorconfig as a JSON config file - ENV: reorder tinkerbell/defaults.env TINKERBELL_* keys alphabetically (CERT_URL, CERTS_PATH, GRPC_AUTHORITY, HOST_IP, HOST_NAME) and add dotenv-linter:off/on SubstitutionKey blocks around ${VAR:-default} patterns - GITHUB_ACTIONS_ZIZMOR: move statuses:write to check-super-linter job level in linter.yml; move checks:write and pull-requests:write to check-reviewdog job level in spell.yml Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/9cf8ee63-1d48-4d6c-928e-120fe7fbf661 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/f899d6f9-431c-420b-9304-7d73461dc2c7 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot

Pull request overview

Standardizes GitHub Actions workflow action pinning and permissions to align with owner-wide conventions, while keeping repository-specific validations intact.

Changes:

Updates multiple workflows to use standardized pinned action revisions and more granular permissions.
Adds a biome.json formatter configuration.
Adjusts Tinkerbell deployment/env files to satisfy linters/secret scanners.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`tinkerbell/deploy.sh`	Adds a gitleaks suppression annotation on the local-registry curl auth check.
`tinkerbell/defaults.env`	Reorders/annotates env exports with dotenv-linter directives.
`biome.json`	Introduces Biome formatter configuration.
`.github/workflows/update.yml`	Tightens permissions and updates pinned action revisions; checkout uses `persist-credentials: false`.
`.github/workflows/spell.yml`	Updates pinned action revisions and job permissions; checkout uses `persist-credentials: false`.
`.github/workflows/linter.yml`	Updates pinned action revisions, permissions, and switches link-check + super-linter action references.
`.github/workflows/ci.yml`	Tightens top-level permissions and sets `persist-credentials: false` on checkout steps.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/c039fa9a-c96f-42c0-9a91-5e257311c524 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

electrocucaracha · 2026-04-25T00:22:54Z

@copilot apply changes based on the comments in this thread

…oy.sh; fix yamllint spacing in ci.yml Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/368fc335-1a10-477e-9bf4-aebcaecc12a2 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot · 2026-04-25T00:25:57Z

@copilot apply changes based on the comments in this thread

Applied in 7a14f3e:

tinkerbell/deploy.sh: removed inline :-docker/:-secret defaults from the docker login and curl calls, relying on the variables already exported by defaults.env; dropped the # gitleaks:allow suppression
ci.yml: fixed yamllint "too few spaces before comment" warnings on all pinned action lines

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/e48bb7e5-6e64-4d0c-b82c-a401ffdf04d4 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-25T01:00:57Z

+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
        with:
+          persist-credentials: false
          # Fine-grained PAT with contents:write and workflows:write scopes
-          token: ${{ secrets.WORKFLOW_TOKEN }}
+          token: ${{ secrets.WORKFLOW_TOKEN }} # zizmor: ignore[secrets-outside-env]
      - uses: technote-space/create-pr-action@91114507cf92349bec0a9a501c2edf1635427bc5 # 2.1.4


actions/checkout is configured with persist-credentials: false, so the WORKFLOW_TOKEN provided to checkout will not be persisted in the git remote credentials. The subsequent technote-space/create-pr-action step is not passed this token, so it may be unable to git push the commit (especially if it needs the fine-grained PAT scopes mentioned in the comment). Consider either removing persist-credentials: false for this job, or explicitly providing WORKFLOW_TOKEN to create-pr-action (and/or configuring the git remote) so the push/PR creation reliably uses the intended credentials.

Copilot · 2026-04-25T01:00:57Z

+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          persist-credentials: false
      - uses: technote-space/create-pr-action@91114507cf92349bec0a9a501c2edf1635427bc5 # 2.1.4


This job runs create-pr-action but actions/checkout is set to persist-credentials: false and no explicit token is provided for pushing changes. If create-pr-action relies on the checkout step’s persisted credentials for git push, it will fail. Either allow checkout to persist credentials for this job or pass an explicit token/remote configuration that create-pr-action can use to push.

Copilot · 2026-04-25T01:00:57Z

      - name: Check broken links
-        uses: gaurav-nelson/github-action-markdown-link-check@636e17b35a5803e014b7272d9e46a8262705416a # 1.0.16
+        uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # 1.1.2


This changes the markdown link checker action implementation (from gaurav-nelson/github-action-markdown-link-check to tcort/github-action-markdown-link-check). Since the PR description says workflow behavior should be preserved, please verify the new action’s defaults/config match the previous behavior (e.g., config file discovery, fail-on-error behavior) or add equivalent configuration inputs to keep results consistent.

Copilot · 2026-04-25T01:00:57Z

+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: super-linter/super-linter@9e863354e3ff62e0727d37183162c4a88873df41 # 8.6.0


This upgrades Super Linter from the previous major version (v7) to 8.6.0 and switches the action owner (github/super-linter -> super-linter/super-linter). Major version upgrades can change enabled linters/rules and therefore lint results. If the intent is to preserve existing behavior, consider pinning to the prior major or reviewing and adjusting configuration to keep output stable.

Copilot · 2026-04-25T01:00:57Z

+{
+  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
+  "formatter": {
+    "indentStyle": "space",
+    "indentWidth": 2
+  }
+}


biome.json is added, but the repo’s formatting automation currently uses Prettier (Makefile target fmt) and there are no other references to Biome in the repo. If Biome isn’t actually used by CI/tooling here, consider removing this file to avoid confusion, or wire Biome into the formatting workflow/documentation so it’s clear why it exists.

Suggested change

{

"$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",

"formatter": {

"indentStyle": "space",

"indentWidth": 2

}

}

chore: standardize GitHub Actions workflows

87bd4f1

Standardize pinned GitHub Actions versions across lint, spellcheck, and update workflows while preserving repository-specific behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot started work on behalf of electrocucaracha April 24, 2026 22:04 View session

fix: add two spaces before inline comments to satisfy yamllint

23fd282

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/4082a456-d67d-4449-9264-686ef8810ad0 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 24, 2026 22:07

Copilot started work on behalf of electrocucaracha April 24, 2026 22:18 View session

fix: add fetch-depth: 0 to super-linter checkout for branch access

35d4258

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/382bd557-9c4e-4202-a73c-3f9e6e8da525 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 24, 2026 22:20

Copilot started work on behalf of electrocucaracha April 24, 2026 23:31 View session

Copilot finished work on behalf of electrocucaracha April 24, 2026 23:37

Copilot started work on behalf of electrocucaracha April 24, 2026 23:40 View session

Copilot AI and others added 2 commits April 24, 2026 23:49

placeholder

853fa8a

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/9cf8ee63-1d48-4d6c-928e-120fe7fbf661 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 24, 2026 23:51

Copilot started work on behalf of electrocucaracha April 24, 2026 23:58 View session

fix: add biome.json to align JSON indentation with prettier (2-space)

1e7640c

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/f899d6f9-431c-420b-9304-7d73461dc2c7 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 25, 2026 00:00

electrocucaracha requested a review from Copilot April 25, 2026 00:08

Copilot started reviewing on behalf of electrocucaracha April 25, 2026 00:08 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread tinkerbell/deploy.sh Outdated

Comment thread .github/workflows/ci.yml Outdated

Comment thread .github/workflows/ci.yml Outdated

Copilot started work on behalf of electrocucaracha April 25, 2026 00:17 View session

chore: update actions/checkout to v6.0.2 in ci.yml

5e7a59e

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/c039fa9a-c96f-42c0-9a91-5e257311c524 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 25, 2026 00:18

Copilot started work on behalf of electrocucaracha April 25, 2026 00:23 View session

Copilot finished work on behalf of electrocucaracha April 25, 2026 00:26

Copilot started work on behalf of electrocucaracha April 25, 2026 00:42 View session

fix: run prettier on ci.yml to fix YAML_PRETTIER CI failure

4fb52c4

Agent-Logs-Url: https://github.com/electrocucaracha/bmaas/sessions/e48bb7e5-6e64-4d0c-b82c-a401ffdf04d4 Co-authored-by: electrocucaracha <2782150+electrocucaracha@users.noreply.github.com>

Copilot finished work on behalf of electrocucaracha April 25, 2026 00:43

electrocucaracha requested a review from Copilot April 25, 2026 00:57

Copilot started reviewing on behalf of electrocucaracha April 25, 2026 00:57 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

electrocucaracha merged commit b1e05f5 into master Apr 25, 2026
30 checks passed

electrocucaracha deleted the chore/standardize-github-actions-20260424 branch April 25, 2026 01:10

Conversation

electrocucaracha commented Apr 24, 2026

Summary

Uh oh!

electrocucaracha commented Apr 24, 2026

Uh oh!

Copilot AI commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

electrocucaracha commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants