From 235355b7a6a41d5c4469821d9c8ebe906f4d6209 Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 12:17:02 +0200 Subject: [PATCH 1/6] SRE-927: Migrate same-repo action references to $/ and fix actionlint findings --- .github/actions/docker-build-push/action.yml | 2 +- .github/actions/install-tools/action.yml | 4 +- .github/workflows/bench.yml | 46 ++++++------- .github/workflows/canary-release.yml | 8 +-- .github/workflows/codspeed.yml | 12 ++-- .github/workflows/deploy.yml | 28 ++++---- .github/workflows/lint.yml | 68 ++++++++++---------- .github/workflows/test.yml | 45 +++++++------ .github/workflows/warm-up-vercel.yml | 4 +- 9 files changed, 109 insertions(+), 108 deletions(-) diff --git a/.github/actions/docker-build-push/action.yml b/.github/actions/docker-build-push/action.yml index fa5365b3107..3a5e8af41b7 100644 --- a/.github/actions/docker-build-push/action.yml +++ b/.github/actions/docker-build-push/action.yml @@ -63,7 +63,7 @@ runs: steps: - name: Login to ECR if: inputs.PUSH == 'true' && inputs.ECR_TAGS != '' - uses: ./.github/actions/docker-ecr-login + uses: $/.github/actions/docker-ecr-login # Log in to GHCR for the build cache (and the by-digest push). Skipped for # fork PRs: their token can't read the private cache package, and a failed diff --git a/.github/actions/install-tools/action.yml b/.github/actions/install-tools/action.yml index bdca6a21efa..25ad032395f 100644 --- a/.github/actions/install-tools/action.yml +++ b/.github/actions/install-tools/action.yml @@ -36,7 +36,7 @@ runs: GITHUB_TOKEN: ${{ inputs.token }} - name: Install package manager via corepack - uses: ./.github/actions/install-corepack + uses: $/.github/actions/install-corepack - name: Setup environment shell: bash @@ -57,7 +57,7 @@ runs: - name: "Install sccache" if: ${{ (inputs.rust == true || inputs.rust == 'true') && (inputs.sccache == true || inputs.sccache == 'true') && inputs.cf_access_client_secret != '' }} continue-on-error: true - uses: ./.github/actions/install-sccache + uses: $/.github/actions/install-sccache with: vault_address: ${{ inputs.vault_address }} cf_access_client_id: ${{ inputs.cf_access_client_id }} diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 1b715a14d18..009c915c005 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -48,7 +48,7 @@ jobs: fetch-depth: 2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -67,8 +67,8 @@ jobs: INTEGRATION_BENCH_PACKAGES=$(turbo query "$INTEGRATION_BENCH_QUERY" \ | jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }') - echo "unit=$UNIT_BENCH_PACKAGES" | tee -a $GITHUB_OUTPUT - echo "integration=$INTEGRATION_BENCH_PACKAGES" | tee -a $GITHUB_OUTPUT + echo "unit=$UNIT_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT" + echo "integration=$INTEGRATION_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT" unit-benches: name: Unit @@ -90,11 +90,11 @@ jobs: - name: Clean up disk if: github.event_name == 'pull_request' - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools if: github.event_name == 'pull_request' - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -103,7 +103,7 @@ jobs: - name: Prune repository if: github.event_name == 'pull_request' - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} @@ -111,7 +111,7 @@ jobs: - name: Warm up repository if: github.event_name == 'pull_request' - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Run base benches if: github.event_name == 'pull_request' @@ -132,10 +132,10 @@ jobs: - name: Clean up disk if: github.event_name != 'pull_request' - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -143,14 +143,14 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} @rust/hash-repo-chores - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Run head benches run: turbo run bench:unit --filter "${{ matrix.name }}" @@ -159,7 +159,7 @@ jobs: if: github.event_name == 'pull_request' run: | TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g') - echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> $GITHUB_ENV + echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> "$GITHUB_ENV" echo '

${{ matrix.name }} – Units

' > "/tmp/$TRIMMED_PACKAGE_NAME.md" echo >> "/tmp/$TRIMMED_PACKAGE_NAME.md" turbo run analyze-benchmarks -- --output "/tmp/benches.md" --artifacts-path "$(pwd)/${{ matrix.path }}/out" --enforce-flame-graph @@ -210,11 +210,11 @@ jobs: - name: Clean up disk if: github.event_name == 'pull_request' - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools if: github.event_name == 'pull_request' - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -223,7 +223,7 @@ jobs: - name: Prune repository if: github.event_name == 'pull_request' - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} @@ -231,7 +231,7 @@ jobs: - name: Warm up repository if: github.event_name == 'pull_request' - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Create temp files and folders run: mkdir -p var/logs @@ -265,7 +265,7 @@ jobs: mkdir -p logs turbo run start --env-mode=loose --log-order stream >var/logs/base-background-task.log 2>&1 & PID=$! - echo "pid=$PID" | tee -a $GITHUB_OUTPUT + echo "pid=$PID" | tee -a "$GITHUB_OUTPUT" turbo run start:healthcheck --env-mode=loose @@ -311,10 +311,10 @@ jobs: - name: Clean up disk if: github.event_name != 'pull_request' - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -323,14 +323,14 @@ jobs: sccache: false # sccache is already running in the background - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} @rust/hash-repo-chores - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Create temp files and folders run: mkdir -p var/logs @@ -362,7 +362,7 @@ jobs: mkdir -p logs turbo run start --env-mode=loose --log-order stream >var/logs/head-background-task.log 2>&1 & PID=$! - echo "pid=$PID" | tee -a $GITHUB_OUTPUT + echo "pid=$PID" | tee -a "$GITHUB_OUTPUT" turbo run start:healthcheck --env-mode=loose @@ -379,7 +379,7 @@ jobs: if: github.event_name == 'pull_request' run: | TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g') - echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> $GITHUB_ENV + echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> "$GITHUB_ENV" echo '

${{ matrix.name }} – Integrations

' > "/tmp/$TRIMMED_PACKAGE_NAME.md" echo >> "/tmp/$TRIMMED_PACKAGE_NAME.md" turbo run analyze-benchmarks -- --output "/tmp/benches.md" --artifacts-path "$(pwd)/${{ matrix.path }}/out" --enforce-flame-graph diff --git a/.github/workflows/canary-release.yml b/.github/workflows/canary-release.yml index e02b8be0b51..fd30bdf459b 100644 --- a/.github/workflows/canary-release.yml +++ b/.github/workflows/canary-release.yml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -22,7 +22,7 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Publish changesets to npm, with 'canary' tags run: | @@ -31,9 +31,9 @@ jobs: git config user.email "support@hash.ai" git config user.name "hashdotai" git commit -am "temporarily convert changesets to canary releases" - git revert `git rev-parse HEAD` --no-edit + git revert "$(git rev-parse HEAD)" --no-edit git push - git checkout `git rev-parse HEAD~1` + git checkout "$(git rev-parse HEAD~1)" cat << EOF > "$HOME/.npmrc" //registry.npmjs.org/:_authToken=$NPM_TOKEN diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index 934b853f165..6dce471a689 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -27,7 +27,7 @@ jobs: fetch-depth: 2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -42,7 +42,7 @@ jobs: PACKAGES=$(turbo query "$PACKAGES_QUERY" \ | jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }') - echo "packages=$PACKAGES" | tee -a $GITHUB_OUTPUT + echo "packages=$PACKAGES" | tee -a "$GITHUB_OUTPUT" benchmarks: name: Run benchmarks @@ -59,10 +59,10 @@ jobs: fetch-depth: 2 - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -70,12 +70,12 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: ${{ matrix.name }} - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Build the benchmark target run: turbo run build:codspeed --filter=${{ matrix.name }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 4e862b8b9c5..4d7343e194e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -52,7 +52,7 @@ jobs: fetch-depth: 2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -84,7 +84,7 @@ jobs: SOURCEMAPS_PACKAGES=$(turbo query "$SOURCEMAPS_QUERY" \ | jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }') - echo "sourcemaps=$SOURCEMAPS_PACKAGES" | tee -a $GITHUB_OUTPUT + echo "sourcemaps=$SOURCEMAPS_PACKAGES" | tee -a "$GITHUB_OUTPUT" CATALOG=$(jq -nc '[ { @@ -226,10 +226,10 @@ jobs: map(select(.push | index("ecr"))) | { service: [.[].service] } ' <<<"$AFFECTED_CATALOG") - echo "backend-images=$BUILD_MATRIX" | tee -a $GITHUB_OUTPUT - echo "backend-manifests=$MANIFEST_MATRIX" | tee -a $GITHUB_OUTPUT - echo "backend-deploys=$DEPLOY_MATRIX" | tee -a $GITHUB_OUTPUT - echo "backend-staging=$STAGING_MATRIX" | tee -a $GITHUB_OUTPUT + echo "backend-images=$BUILD_MATRIX" | tee -a "$GITHUB_OUTPUT" + echo "backend-manifests=$MANIFEST_MATRIX" | tee -a "$GITHUB_OUTPUT" + echo "backend-deploys=$DEPLOY_MATRIX" | tee -a "$GITHUB_OUTPUT" + echo "backend-staging=$STAGING_MATRIX" | tee -a "$GITHUB_OUTPUT" sourcemaps: name: Sourcemaps @@ -276,7 +276,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -284,12 +284,12 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: ${{ matrix.name }} - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Log in to Sentry run: sentry-cli login --auth-token ${{ steps.secrets.outputs.SENTRY_AUTH_TOKEN }} @@ -388,7 +388,7 @@ jobs: - name: Build${{ steps.targets.outputs.push == 'true' && ' and push' || '' }} ${{ matrix.service }} (${{ matrix.arch }}) id: build - uses: ./.github/actions/docker-build-push + uses: $/.github/actions/docker-build-push with: CONTEXT_PATH: ${{ github.workspace }}/${{ matrix.context }} DOCKERFILE_LOCATION: ${{ github.workspace }}/${{ matrix.dockerfile }} @@ -450,7 +450,7 @@ jobs: aws-region: ${{ env.AWS_REGION }} - name: Log in to ECR - uses: ./.github/actions/docker-ecr-login + uses: $/.github/actions/docker-ecr-login - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 @@ -458,7 +458,7 @@ jobs: # ECR images are single-arch (arm64). Advance :staging onto this commit's # immutable sha tag only if it is newer than the one currently tagged. - name: Advance :staging if newer - uses: ./.github/actions/tag-if-newer + uses: $/.github/actions/tag-if-newer with: image: ${{ env.AWS_ECR_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ github.repository }}/${{ matrix.service }} mutable-tag: staging @@ -528,7 +528,7 @@ jobs: # descends from, permanently blocking the guard from ever advancing it again. - name: Advance :latest if newer if: github.ref == 'refs/heads/main' - uses: ./.github/actions/tag-if-newer + uses: $/.github/actions/tag-if-newer with: image: ghcr.io/${{ github.repository_owner }}/hash/${{ matrix.service }} mutable-tag: latest @@ -561,7 +561,7 @@ jobs: aws-region: ${{ env.AWS_REGION }} - name: Redeploy ${{ matrix.service }} staging service - uses: ./.github/actions/redeploy-ecs-service + uses: $/.github/actions/redeploy-ecs-service with: ECS_CLUSTER_NAME: ${{ matrix.cluster }} ECS_SERVICE_NAME: ${{ matrix.service_name }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 77666f26c79..5923c69262e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -30,7 +30,7 @@ jobs: fetch-depth: 2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -45,7 +45,7 @@ jobs: PACKAGES=$(turbo query "$PACKAGES_QUERY" \ | jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }') - echo "packages=$PACKAGES" | tee -a $GITHUB_OUTPUT + echo "packages=$PACKAGES" | tee -a "$GITHUB_OUTPUT" package: name: Package @@ -66,10 +66,10 @@ jobs: fetch-depth: 2 - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -77,7 +77,7 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: ${{ matrix.name }} @@ -87,25 +87,25 @@ jobs: set -x ESLINT=$(turbo run lint:eslint --filter '${{ matrix.name }}' --dry-run=json \ | jq '[.tasks[] | select(.task == "lint:eslint" and .command != "")] != []' || echo 'false') - echo "eslint=$ESLINT" | tee -a $GITHUB_OUTPUT + echo "eslint=$ESLINT" | tee -a "$GITHUB_OUTPUT" TSC=$(turbo run lint:tsc --filter '${{ matrix.name }}' --dry-run=json \ | jq '[.tasks[] | select(.task == "lint:tsc" and .command != "")] != []' || echo 'false') - echo "tsc=$TSC" | tee -a $GITHUB_OUTPUT + echo "tsc=$TSC" | tee -a "$GITHUB_OUTPUT" CODEGEN=$(turbo run codegen --filter '${{ matrix.name }}' --dry-run=json \ | jq '[.tasks[] | select(.task == "codegen" and .command != "")] != []' || echo 'false') - echo "codegen=$CODEGEN" | tee -a $GITHUB_OUTPUT + echo "codegen=$CODEGEN" | tee -a "$GITHUB_OUTPUT" CLIPPY=$(turbo run lint:clippy --filter '${{ matrix.name }}' --dry-run=json \ | jq '[.tasks[] | select(.task == "lint:clippy" and .command != "")] != []' || echo 'false') - echo "clippy=$CLIPPY" | tee -a $GITHUB_OUTPUT + echo "clippy=$CLIPPY" | tee -a "$GITHUB_OUTPUT" HAS_RUST=$([[ -f "${{ matrix.path }}/Cargo.toml" || ${{ matrix.path }} = "apps/hash-graph" ]] && echo 'true' || echo 'false') - echo "has-rust=$HAS_RUST" | tee -a $GITHUB_OUTPUT + echo "has-rust=$HAS_RUST" | tee -a "$GITHUB_OUTPUT" - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Show disk usage run: df -h @@ -167,9 +167,11 @@ jobs: - name: Print clippy errors to summary if: failure() && steps.lints.outputs.clippy == 'true' run: | - echo '```' >> $GITHUB_STEP_SUMMARY - cat ${{ matrix.path }}/clippy.sarif | sarif-fmt >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY + { + echo '```' + cat ${{ matrix.path }}/clippy.sarif | sarif-fmt + echo '```' + } >> "$GITHUB_STEP_SUMMARY" - name: Upload SARIF file uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2 @@ -212,10 +214,10 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -223,7 +225,7 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Validate package.json generated from Cargo.toml if: ${{ success() || failure() }} @@ -244,7 +246,7 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Try running `yarn fix:constraints` locally to apply autofixes.' + echo 'Try running "yarn fix:constraints" locally to apply autofixes.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -259,7 +261,7 @@ jobs: echo '' echo 'ℹ️ ℹ️ ℹ️' echo 'Please fix the above errors locally for the check to pass.' - echo 'If you don’t see them, try merging target branch into yours.' + echo 'If you do not see them, try merging target branch into yours.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -271,7 +273,7 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Try running `yarn fix:markdownlint` locally to apply autofixes.' + echo 'Try running "yarn fix:markdownlint" locally to apply autofixes.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -283,7 +285,7 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Try running `yarn fix:format` locally to apply autofixes.' + echo 'Try running "yarn fix:format" locally to apply autofixes.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -298,9 +300,9 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Changes were detected in .claude/skills/skill-rules.json file after running `yarn agents:skill-management generate-skill-rules`.' + echo 'Changes were detected in .claude/skills/skill-rules.json file after running "yarn agents:skill-management generate-skill-rules".' echo 'This indicates that there are changes inside of the skill files that haven not yet been upstreamed into the skill-rules.json file.' - echo 'Try running `yarn agents:skill-management generate-skill-rules` locally to apply autofixes.' + echo 'Try running "yarn agents:skill-management generate-skill-rules" locally to apply autofixes.' echo 'ℹ️ ℹ️ ℹ️' exit 1; fi @@ -312,7 +314,7 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Try running `yarn fix:taplo` locally to apply autofixes.' + echo 'Try running "yarn fix:taplo" locally to apply autofixes.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -326,7 +328,7 @@ jobs: echo 'ℹ️ ℹ️ ℹ️' echo 'Some dependencies can be deduplicated, which will make node_modules' echo 'lighter and potentially save us from unexplainable bugs.' - echo 'Please run `yarn fix:yarn-deduplicate` locally and commit yarn.lock.' + echo 'Please run "yarn fix:yarn-deduplicate" locally and commit yarn.lock.' echo 'You may need to run the command 2-3 times in some rare cases.' echo 'ℹ️ ℹ️ ℹ️' exit 1 @@ -343,10 +345,10 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Changes were detected in yarn.lock file after running `yarn install`.' + echo 'Changes were detected in yarn.lock file after running "yarn install".' echo 'This makes runtime less stable, so should be avoided.' - echo 'Please run `yarn install` locally and commit yarn.lock.' - echo 'You may also want to run `yarn fix:yarn-deduplicate` just in case.' + echo 'Please run "yarn install" locally and commit yarn.lock.' + echo 'You may also want to run "yarn fix:yarn-deduplicate" just in case.' echo 'ℹ️ ℹ️ ℹ️' exit 1; fi @@ -358,9 +360,9 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Changes were detected in Cargo.lock file after running `cargo update --workspace`.' + echo 'Changes were detected in Cargo.lock file after running "cargo update --workspace".' echo 'This makes runtime less stable, so should be avoided.' - echo 'Please run `cargo update --workspace` locally and commit Cargo.lock.' + echo 'Please run "cargo update --workspace" locally and commit Cargo.lock.' echo 'ℹ️ ℹ️ ℹ️' exit 1; fi @@ -373,7 +375,7 @@ jobs: echo '' echo 'ℹ️ ℹ️ ℹ️' echo 'Please fix the above errors locally for the check to pass.' - echo 'If you don’t see them, try merging target branch into yours.' + echo 'If you do not see them, try merging target branch into yours.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi @@ -385,8 +387,8 @@ jobs: echo '' echo '' echo 'ℹ️ ℹ️ ℹ️' - echo 'Try running `sqlfluff fix` locally to apply autofixes.' - echo 'Note, that SQLFluff does not come with `yarn install` and you may need to install it yourself.' + echo 'Try running "sqlfluff fix" locally to apply autofixes.' + echo 'Note, that SQLFluff does not come with "yarn install" and you may need to install it yourself.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fc14d27faca..26edca20370 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -46,7 +46,7 @@ jobs: fetch-depth: 2 - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -96,9 +96,9 @@ jobs: fi done <<< "$(find . -name 'Cargo.toml' -type f | sed 's|\./||')" - echo "unit-tests=$UNIT_TEST_PACKAGES" | tee -a $GITHUB_OUTPUT - echo "integration-tests=$INTEGRATION_TEST_PACKAGES" | tee -a $GITHUB_OUTPUT - echo "publish-rust=$PUBLISH_PACKAGES" | tee -a $GITHUB_OUTPUT + echo "unit-tests=$UNIT_TEST_PACKAGES" | tee -a "$GITHUB_OUTPUT" + echo "integration-tests=$INTEGRATION_TEST_PACKAGES" | tee -a "$GITHUB_OUTPUT" + echo "publish-rust=$PUBLISH_PACKAGES" | tee -a "$GITHUB_OUTPUT" unit-tests: name: Unit @@ -117,10 +117,10 @@ jobs: ref: ${{ github.event.pull_request.head.sha }} - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -128,25 +128,25 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} @rust/hash-repo-chores - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Find test steps to run id: tests run: | HAS_RUST=$([[ -f "${{ matrix.path }}/Cargo.toml" || ${{ matrix.path }} = "apps/hash-graph" ]] && echo 'true' || echo 'false') - echo "has-rust=$HAS_RUST" | tee -a $GITHUB_OUTPUT + echo "has-rust=$HAS_RUST" | tee -a "$GITHUB_OUTPUT" if [[ "$HAS_RUST" == "true" ]]; then - echo "COVERAGE_KEY=rust" >> $GITHUB_ENV + echo "COVERAGE_KEY=rust" >> "$GITHUB_ENV" else - echo "COVERAGE_KEY=javascript" >> $GITHUB_ENV + echo "COVERAGE_KEY=javascript" >> "$GITHUB_ENV" fi - name: Show disk usage @@ -158,7 +158,7 @@ jobs: TEST_COVERAGE: ${{ github.event_name != 'merge_group' }} run: | turbo run test:unit --env-mode=loose --filter "${{ matrix.name }}" - echo "TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')" >> $GITHUB_ENV + echo "TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')" >> "$GITHUB_ENV" - name: Show disk usage run: df -h @@ -216,10 +216,10 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Install tools - uses: ./.github/actions/install-tools + uses: $/.github/actions/install-tools with: token: ${{ secrets.GITHUB_TOKEN }} vault_address: ${{ vars.VAULT_STAGE_ADDR }} @@ -227,23 +227,22 @@ jobs: cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }} - name: Prune repository - uses: ./.github/actions/prune-repository + uses: $/.github/actions/prune-repository with: scope: | ${{ matrix.name }} - name: Warm up repository - uses: ./.github/actions/warm-up-repo + uses: $/.github/actions/warm-up-repo - name: Find test steps to run id: tests run: | - TEST_TASKS=$(turbo run test:integration --env-mode=loose --dry-run=json --filter "${{ matrix.name }}" | jq -c '.tasks[]') HAS_BACKGROUND_TASKS=$(turbo run start:test --dry-run json | jq -c '[.tasks[] | select(.command != "") | .name] != []' || echo 'false') - echo "has-background-tasks=$HAS_BACKGROUND_TASKS" | tee -a $GITHUB_OUTPUT + echo "has-background-tasks=$HAS_BACKGROUND_TASKS" | tee -a "$GITHUB_OUTPUT" HAS_RUST=$([[ -f "${{ matrix.path }}/Cargo.toml" || ${{ matrix.path }} = "apps/hash-graph" ]] && echo 'true' || echo 'false') - echo "has-rust=$HAS_RUST" | tee -a $GITHUB_OUTPUT + echo "has-rust=$HAS_RUST" | tee -a "$GITHUB_OUTPUT" - name: Create temp files and folders run: mkdir -p var/logs @@ -291,7 +290,7 @@ jobs: mkdir -p logs turbo run start:test --env-mode=loose --log-order stream >var/logs/background-task.log 2>&1 & PID=$! - echo "pid=$PID" | tee -a $GITHUB_OUTPUT + echo "pid=$PID" | tee -a "$GITHUB_OUTPUT" # Not strictly needed to run the healthchecks here as they are also run in the integration # tests but it this way we can fail the job early if the background tasks are not healthy. @@ -305,7 +304,7 @@ jobs: continue-on-error: ${{ steps.tests.outputs.allow-failure == 'true' }} run: | turbo run test:integration --env-mode=loose --filter "${{ matrix.name }}" - echo "TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')" >> $GITHUB_ENV + echo "TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')" >> "$GITHUB_ENV" - name: Show disk usage run: df -h @@ -353,7 +352,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Clean up disk - uses: ./.github/actions/clean-up-disk + uses: $/.github/actions/clean-up-disk - name: Build package flags id: flags @@ -361,7 +360,7 @@ jobs: PUBLISH_PACKAGES: ${{ needs.setup.outputs.publish-rust }} run: | PACKAGES=$(echo "$PUBLISH_PACKAGES" | jq -r '.[]' | while read -r pkg; do echo -n "-p $pkg "; done) - echo "packages=$PACKAGES" | tee -a $GITHUB_OUTPUT + echo "packages=$PACKAGES" | tee -a "$GITHUB_OUTPUT" - name: Login run: | diff --git a/.github/workflows/warm-up-vercel.yml b/.github/workflows/warm-up-vercel.yml index f05c5d26dc3..01affb6fef6 100644 --- a/.github/workflows/warm-up-vercel.yml +++ b/.github/workflows/warm-up-vercel.yml @@ -2,7 +2,7 @@ name: Scheduled production Vercel lambda warm-up on: schedule: - - cron: "*/3 * * * *" ## Every 3 minutes + - cron: "*/5 * * * *" ## Every 5 minutes permissions: contents: read @@ -19,6 +19,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: ./.github/actions/warm-up-vercel + - uses: $/.github/actions/warm-up-vercel with: deployment-base-url: "https://app.hash.ai" From 3cb71656b1d86552c51cb33c7073ff0461c9594e Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 12:17:05 +0200 Subject: [PATCH 2/6] SRE-927: Call the centralized actionlint preflight workflow --- .github/workflows/preflight-lint.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/preflight-lint.yml diff --git a/.github/workflows/preflight-lint.yml b/.github/workflows/preflight-lint.yml new file mode 100644 index 00000000000..8a9111d7ab6 --- /dev/null +++ b/.github/workflows/preflight-lint.yml @@ -0,0 +1,14 @@ +name: Preflight + +on: + pull_request: + merge_group: + +permissions: {} + +jobs: + lint: + name: Lint + permissions: + contents: read + uses: hashintel/.github/.github/workflows/preflight-actionlint.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main From c1e13a80ff59955069f60eccf461b7b6809751fe Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 12:26:10 +0200 Subject: [PATCH 3/6] SRE-927: Drop useless-cat pipelines in the lint workflow --- .github/workflows/lint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 5923c69262e..9eb0f3203b2 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -120,7 +120,7 @@ jobs: echo "Checking diff of ${{ matrix.path }}/$line" git --no-pager diff --exit-code --color -- "${{ matrix.path }}/$line" fi - done <<< "$(cat ${{ matrix.path }}/turbo.json | grep -v '^ *//' | jq -r '.pipeline.codegen.outputs | if . == null then "." else .[] end')" + done <<< "$(grep -v '^ *//' ${{ matrix.path }}/turbo.json | jq -r '.pipeline.codegen.outputs | if . == null then "." else .[] end')" - name: Show disk usage run: df -h @@ -152,7 +152,7 @@ jobs: | jq '.runs[].results |= unique' \ > clippy.sarif popd - cat ${{ matrix.path }}/clippy.sarif | sarif-fmt + sarif-fmt < ${{ matrix.path }}/clippy.sarif jq -e '.runs[].results == []' ${{ matrix.path }}/clippy.sarif > /dev/null # Cargo's manifest lints (e.g. `cargo::unused_dependencies`) are plain text, not compiler @@ -169,7 +169,7 @@ jobs: run: | { echo '```' - cat ${{ matrix.path }}/clippy.sarif | sarif-fmt + sarif-fmt < ${{ matrix.path }}/clippy.sarif echo '```' } >> "$GITHUB_STEP_SUMMARY" From fc290bb2a7b3c1aa8ade39ec0e8e318e43b72c7a Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 12:46:44 +0200 Subject: [PATCH 4/6] SRE-927: Consolidate the pull_request preflights into one file --- .github/workflows/preflight-lint.yml | 14 ------- .github/workflows/preflight-target.yml | 40 +++++++++++++++++++ .github/workflows/preflight-todo-comments.yml | 14 ------- .github/workflows/preflight.yml | 36 +++++------------ 4 files changed, 49 insertions(+), 55 deletions(-) delete mode 100644 .github/workflows/preflight-lint.yml create mode 100644 .github/workflows/preflight-target.yml delete mode 100644 .github/workflows/preflight-todo-comments.yml diff --git a/.github/workflows/preflight-lint.yml b/.github/workflows/preflight-lint.yml deleted file mode 100644 index 8a9111d7ab6..00000000000 --- a/.github/workflows/preflight-lint.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: Preflight - -on: - pull_request: - merge_group: - -permissions: {} - -jobs: - lint: - name: Lint - permissions: - contents: read - uses: hashintel/.github/.github/workflows/preflight-actionlint.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main diff --git a/.github/workflows/preflight-target.yml b/.github/workflows/preflight-target.yml new file mode 100644 index 00000000000..3ecea8cfd57 --- /dev/null +++ b/.github/workflows/preflight-target.yml @@ -0,0 +1,40 @@ +name: Preflight + +on: + pull_request: + paths: + - ".github/workflows/preflight-target.yml" + pull_request_target: + types: [opened, synchronize, reopened, edited] + merge_group: + +jobs: + dependencies: + name: Dependencies + permissions: + contents: read + pull-requests: write + uses: hashintel/.github/.github/workflows/preflight-dependencies.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main + with: + # GHSA-frvp-7c67-39w9: advisory has a wrong affected-version range; the fix was + # backported in @hono/node-server. Remove once github/advisory-database#8824 merges. + allow-ghsas: GHSA-frvp-7c67-39w9 + + labeler: + name: Labeler + if: github.event_name != 'merge_group' + permissions: + contents: read + pull-requests: write + runs-on: ubuntu-24.04 + steps: + - name: Apply labels + uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 + with: + sync-labels: true + + pr-title: + name: PR title + permissions: + contents: read + uses: hashintel/.github/.github/workflows/preflight-pr-title.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main diff --git a/.github/workflows/preflight-todo-comments.yml b/.github/workflows/preflight-todo-comments.yml deleted file mode 100644 index f30384bda6f..00000000000 --- a/.github/workflows/preflight-todo-comments.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: Preflight - -on: - pull_request: - # `edited` matters: the scan derives its ticket IDs from the PR title. - types: [opened, synchronize, reopened, edited] - merge_group: - -jobs: - todo-comments: - name: Todo comments - permissions: - contents: read - uses: hashintel/.github/.github/workflows/preflight-todo-comments.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main diff --git a/.github/workflows/preflight.yml b/.github/workflows/preflight.yml index 45394a48b22..16edd89fd4a 100644 --- a/.github/workflows/preflight.yml +++ b/.github/workflows/preflight.yml @@ -2,39 +2,21 @@ name: Preflight on: pull_request: - paths: - - ".github/workflows/preflight.yml" - pull_request_target: + # `edited` matters: the todo-comments scan derives its ticket IDs from the PR title. types: [opened, synchronize, reopened, edited] merge_group: -jobs: - dependencies: - name: Dependencies - permissions: - contents: read - pull-requests: write - uses: hashintel/.github/.github/workflows/preflight-dependencies.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main - with: - # GHSA-frvp-7c67-39w9: advisory has a wrong affected-version range; the fix was - # backported in @hono/node-server. Remove once github/advisory-database#8824 merges. - allow-ghsas: GHSA-frvp-7c67-39w9 +permissions: {} - labeler: - name: Labeler - if: github.event_name != 'merge_group' +jobs: + todo-comments: + name: Todo comments permissions: contents: read - pull-requests: write - runs-on: ubuntu-24.04 - steps: - - name: Apply labels - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 - with: - sync-labels: true + uses: hashintel/.github/.github/workflows/preflight-todo-comments.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main - pr-title: - name: PR title + lint: + name: Lint permissions: contents: read - uses: hashintel/.github/.github/workflows/preflight-pr-title.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main + uses: hashintel/.github/.github/workflows/preflight-actionlint.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main From 94065d9b0f55213456d7e5a05a128d08e1ff0a62 Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 13:08:43 +0200 Subject: [PATCH 5/6] SRE-927: Drop the default token permissions in the target preflight --- .github/workflows/preflight-target.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/preflight-target.yml b/.github/workflows/preflight-target.yml index 3ecea8cfd57..83f329d2534 100644 --- a/.github/workflows/preflight-target.yml +++ b/.github/workflows/preflight-target.yml @@ -8,6 +8,8 @@ on: types: [opened, synchronize, reopened, edited] merge_group: +permissions: {} + jobs: dependencies: name: Dependencies From bd85fb3ab5c6fb4df4f12629bac45d9d54dac9bf Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Tue, 11 Aug 2026 13:32:30 +0200 Subject: [PATCH 6/6] SRE-927: Drop the checkout the warm-up action no longer needs --- .github/workflows/warm-up-vercel.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/warm-up-vercel.yml b/.github/workflows/warm-up-vercel.yml index 01affb6fef6..acbbc3c5a66 100644 --- a/.github/workflows/warm-up-vercel.yml +++ b/.github/workflows/warm-up-vercel.yml @@ -17,8 +17,6 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: $/.github/actions/warm-up-vercel with: deployment-base-url: "https://app.hash.ai"