This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch add-ci-asf-yaml in repository https://gitbox.apache.org/repos/asf/airflow-steward.git
commit f0ccc4a407c3480c28ac22038222858b5ea34beb Author: Jarek Potiuk <[email protected]> AuthorDate: Wed Apr 29 01:56:58 2026 +0200 ci: add prek/zizmor/codeql/allowlist workflows, dependabot, .asf.yaml Bootstraps the standard ASF/security CI surface for the framework repo, mirroring what airflow-s and apache/airflow run. The framework had no CI of its own — the .pre-commit-config.yaml hooks defined hooks (ruff/format/mypy/pytest for the two Python projects) but nothing was actually invoking them on PRs. Files added: - .github/workflows/pre-commit.yml — runs `prek` on every PR and push to main. Sets up Python and uv before invoking `j178/prek-action`; uv is required because the per-project hooks under tools/{vulnogram/generate-cve-json,gmail/oauth-draft}/ invoke `uv run --directory ...`. - .github/workflows/zizmor.yml — GitHub Actions security analysis via zizmorcore/zizmor-action. Reads .zizmor.yml at the repo root. - .github/workflows/codeql.yml — weekly + per-PR CodeQL analysis for Python (the only hand-written language in this repo). Uses the `security-and-quality` query suite; no security-extended needed (the code is stdlib-only / single OAuth dep and does not process untrusted runtime input). - .github/workflows/asf-allowlist-check.yml — ASF infra's allowlist-check action, scoped to PRs that touch .github/. Catches actions that haven't been allow-listed by ASF Infra. - .github/dependabot.yml — weekly bumps with a 7-day cooldown for four ecosystems: github-actions (root), pre-commit (root), and uv with a directory entry per Python project (tools/vulnogram/generate-cve-json, tools/gmail/oauth-draft). - .zizmor.yml — empty rule overrides, so every finding surfaces initially. Add ignores here when accepting a known false positive. - .asf.yaml — repo metadata that ASF Infra picks up: description (replacing the current incorrect "Apache airflow"), homepage, labels, feature flags (issues/projects/discussions on, wiki off), squash-only merge, no auto-merge, head branch deletion on merge, and notification routing to airflow.apache.org lists (the framework lives under the Airflow PMC umbrella for now). Deliberately **no `protected_branches:` block** — branch protection stays in GitHub UI for now until the project's release/branching policy stabilises. All actions are pinned to SHAs (matching the airflow-s convention); versions chosen are the latest as used by airflow-s/airflow at the time of writing. Test plan: - `prek` passes on the new workflow files (yaml-lint, doctoc skip, end-of-file-fixer all green). - `zizmor` v1.24.1 audit of the four workflow files plus dependabot.yml: no findings. - The actual CI runs will fire on the PR and validate the workflows themselves end-to-end. Generated-by: Claude Code (Claude Opus 4.7) --- .asf.yaml | 63 +++++++++++++++++++++++++ .github/dependabot.yml | 78 +++++++++++++++++++++++++++++++ .github/workflows/asf-allowlist-check.yml | 34 ++++++++++++++ .github/workflows/codeql.yml | 65 ++++++++++++++++++++++++++ .github/workflows/pre-commit.yml | 44 +++++++++++++++++ .github/workflows/zizmor.yml | 45 ++++++++++++++++++ .zizmor.yml | 7 +++ 7 files changed, 336 insertions(+) diff --git a/.asf.yaml b/.asf.yaml new file mode 100644 index 0000000..9b8692b --- /dev/null +++ b/.asf.yaml @@ -0,0 +1,63 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# https://cwiki.apache.org/confluence/display/INFRA/git+-+.asf.yaml+features +--- +github: + description: "Reusable framework for handling security vulnerabilities in Apache projects — agent skills, tracker conventions, and tooling." + homepage: "https://github.com/apache/airflow-steward"; + labels: + # Note that GitHub only supports <=20 labels/topics per repo! Pipeline + # will fail if you add more. + - apache + - security + - cve + - vulnerability-management + - vulnerability-disclosure + - agent-skills + - claude-code + - automation + features: + issues: true + projects: true + wiki: false + discussions: true + + enabled_merge_buttons: + squash: true + merge: false + rebase: false + + pull_requests: + allow_auto_merge: false + allow_update_branch: true + del_branch_on_merge: true + + # No `protected_branches:` block by design — branch protections are + # configured directly in GitHub for now. Add here when the project's + # release / branching policy stabilises. + +notifications: + # The framework is hosted under the Airflow PMC umbrella for now; + # routing notifications to airflow.apache.org lists matches the + # current ownership. Revisit if/when the repo moves to + # `apache/steward` under a different PMC. + jobs: [email protected] + commits: [email protected] + issues: [email protected] + pullrequests: [email protected] + discussions: [email protected] diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..ef8b9ee --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,78 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +--- +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + # 7-day cooldown so a just-released action tag has a chance to + # settle (retags, withdrawal, CI incidents on the upstream) before + # Dependabot proposes bumping to it. + cooldown: + default-days: 7 + semver-major-days: 7 + semver-minor-days: 7 + semver-patch-days: 7 + groups: + github-actions: + patterns: + - "*" + + - package-ecosystem: "pre-commit" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + semver-major-days: 7 + semver-minor-days: 7 + semver-patch-days: 7 + groups: + pre-commit-hooks: + patterns: + - "*" + + - package-ecosystem: "uv" + directory: "/tools/vulnogram/generate-cve-json" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + semver-major-days: 7 + semver-minor-days: 7 + semver-patch-days: 7 + groups: + generate-cve-json-deps: + patterns: + - "*" + + - package-ecosystem: "uv" + directory: "/tools/gmail/oauth-draft" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + semver-major-days: 7 + semver-minor-days: 7 + semver-patch-days: 7 + groups: + oauth-draft-deps: + patterns: + - "*" diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml new file mode 100644 index 0000000..3c5c10b --- /dev/null +++ b/.github/workflows/asf-allowlist-check.yml @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +--- +name: "ASF Allowlist Check" +"on": + pull_request: + paths: [".github/**"] + push: + branches: [main] + paths: [".github/**"] +permissions: + contents: read +jobs: + asf-allowlist-check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8 # main diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..e42a095 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,65 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +--- +name: "CodeQL" + +on: # yamllint disable-line rule:truthy + push: + branches: [main] + pull_request: + branches: [main] + schedule: + # Run weekly on Sunday at 07:13 UTC. Off-peak hour chosen so the job + # doesn't collide with Monday-morning CI surges. + - cron: "13 7 * * 0" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze Python + runs-on: ubuntu-24.04 + permissions: + # Writing security-events is required for CodeQL to upload results to + # the repository's "Security" tab. The rest stay read-only. + actions: read + contents: read + security-events: write + + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 + with: + languages: python + # The hand-written Python in this repo lives under + # `tools/{vulnogram/generate-cve-json,gmail/oauth-draft}/`. Both + # are stdlib-only / a single OAuth dep and do not process + # untrusted network input at runtime, so the default + # `security-and-quality` query suite is sufficient — no need + # for `security-extended`. + queries: security-and-quality + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 + with: + category: "/language:python" diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml new file mode 100644 index 0000000..119f95c --- /dev/null +++ b/.github/workflows/pre-commit.yml @@ -0,0 +1,44 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +--- +name: prek + +on: # yamllint disable-line rule:truthy + pull_request: + push: + branches: [main] + +permissions: {} + +jobs: + prek: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + # `uv` is required by the per-project prek hooks under + # `tools/{vulnogram/generate-cve-json,gmail/oauth-draft}/`, which + # invoke `uv run --directory ...` for ruff / mypy / pytest. + - uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0 + with: + enable-cache: true + - uses: j178/prek-action@0bb87d7f00b0c99306c8bcb8b8beba1eb581c037 # v1.1.1 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..77ecdf4 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,45 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +--- +name: "GitHub Actions Security Analysis" + +on: # yamllint disable-line rule:truthy + push: + branches: [main] + pull_request: + branches: [main] + +permissions: {} + +jobs: + zizmor: + name: "zizmor" + runs-on: ubuntu-latest + permissions: + contents: read + actions: read + steps: + - name: "Checkout repository" + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: "Run zizmor" + uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 + with: + advanced-security: false + config: .zizmor.yml diff --git a/.zizmor.yml b/.zizmor.yml new file mode 100644 index 0000000..185d700 --- /dev/null +++ b/.zizmor.yml @@ -0,0 +1,7 @@ +# zizmor — GitHub Actions security analyser. Configuration overrides +# go here when a finding is a known false positive or otherwise +# accepted; the file is intentionally empty to start so that every +# finding is surfaced and reviewed. +# +# Docs: https://docs.zizmor.sh/configuration/ +rules: {}
