From e89970ee5f5acea5203949150704eb1f0ebf90e8 Mon Sep 17 00:00:00 2001 From: Praveen Babu J D Date: Fri, 28 Aug 2026 14:05:14 -0700 Subject: [PATCH] Fix and harden GitHub automation Co-authored-by: TRAE CLI --- .github/CODEOWNERS | 8 +++++ .github/dependabot.yml | 14 +++++++++ .github/workflows/ci.yml | 39 +++++++++++++++++++++++-- .github/workflows/codeql.yml | 38 ++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 19 ++++++++++++ .github/workflows/docs.yml | 8 +++-- README.md | 2 +- docs/12-custom-allocators.md | 4 ++- 8 files changed, 126 insertions(+), 6 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..ec03985 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,8 @@ +# SPDX-FileCopyrightText: 2026 ByteDance Ltd. and/or its affiliates +# SPDX-License-Identifier: Apache-2.0 + +# Route project-wide reviews to the repository maintainers. +* @jdpraveen @PICO-XR-Dev + +# Changes to repository automation and ownership rules require the same owners. +/.github/ @jdpraveen @PICO-XR-Dev diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8f7a525 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +# SPDX-FileCopyrightText: 2026 ByteDance Ltd. and/or its affiliates +# SPDX-License-Identifier: Apache-2.0 + +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" + open-pull-requests-limit: 5 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7c50a3..bb6d3f3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -85,11 +85,13 @@ jobs: vcpkg: name: vcpkg overlay package consumer runs-on: ubuntu-latest - env: - VCPKG_ROOT: ${{ runner.temp }}/vcpkg steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Configure vcpkg path + shell: bash + run: echo "VCPKG_ROOT=${RUNNER_TEMP}/vcpkg" >> "${GITHUB_ENV}" + - name: Bootstrap pinned vcpkg run: | git clone --depth 1 --branch 2026.07.29 \ @@ -335,3 +337,36 @@ jobs: - name: Run pathological input tests explicitly shell: bash run: ctest --test-dir out/build-debug --output-on-failure -R '^pjson\.pathological_' + + required: + name: Required CI checks + if: always() + needs: + - licensing + - fuzz + - distribution + - conan + - vcpkg + - build-test + - msvc + - format + - tidy + - benchmark + - benchmark-compare + - conformance + - lsan + runs-on: ubuntu-latest + steps: + - name: Require every CI job to succeed + env: + REQUIRED_RESULTS: ${{ toJSON(needs) }} + shell: bash + run: | + if jq -e 'all(.[]; .result == "success")' <<<"${REQUIRED_RESULTS}"; then + exit 0 + fi + + jq -r 'to_entries[] | select(.value.result != "success") | + "::error title=Required CI job did not succeed::\(.key): \(.value.result)"' \ + <<<"${REQUIRED_RESULTS}" + exit 1 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..b17a48a --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,38 @@ +# SPDX-License-Identifier: Apache-2.0 + +name: CodeQL + +on: + push: + branches: + - main + pull_request: + schedule: + - cron: "17 9 * * 1" + workflow_dispatch: + +permissions: + contents: read + +jobs: + analyze: + name: Analyze C++ + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4 + with: + languages: c-cpp + build-mode: manual + + - name: Build library and tests + shell: bash + run: ./build.sh --clean --debug-only --auto + + - name: Analyze + uses: github/codeql-action/analyze@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..391323f --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: Apache-2.0 + +name: Dependency review + +on: + pull_request: + +permissions: + contents: read + +jobs: + review: + name: Review dependency changes + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Review dependency changes + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index e8f720e..030d1b8 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -42,7 +42,9 @@ jobs: if-no-files-found: error - name: Prepare GitHub Pages artifact - if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' + if: >- + github.ref == 'refs/heads/main' && + (github.event_name == 'push' || github.event_name == 'workflow_dispatch') id: pages-artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: @@ -50,7 +52,9 @@ jobs: pages: name: Publish API reference to GitHub Pages - if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' + if: >- + github.ref == 'refs/heads/main' && + (github.event_name == 'push' || github.event_name == 'workflow_dispatch') needs: reference runs-on: ubuntu-latest permissions: diff --git a/README.md b/README.md index e4e34bb..21ba3b6 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ - A single class, `ByteDance::pjson`, represents any JSON value (null, bool, number, string, array, or object) and provides an ergonomic `obj["key"][i] = value` style API. -- Licensed under Apache-2.0; please keep credit to the author, Praveen Babu J D. +- Licensed under Apache-2.0; - Current source version: **1.0.0** (`pjson::getVersion()` / the `PJSON_VERSION` macro). This version remains unreleased until the `release-1.0.0` tag is published. diff --git a/docs/12-custom-allocators.md b/docs/12-custom-allocators.md index ec37e83..69cb24e 100644 --- a/docs/12-custom-allocators.md +++ b/docs/12-custom-allocators.md @@ -191,5 +191,7 @@ CountingAllocator storage; - The hook covers persistent DOM nodes and wrapper objects, not every allocation made by their standard-library internals or temporary algorithms. -Return to the [tutorial index](README.md), or consult the +Return to the +[tutorial index](https://github.com/Pico-Developer/pjson/blob/main/docs/README.md), +or consult the [browsable API reference](https://pico-developer.github.io/pjson/).