Pages' starter workflows on the main branch are not compatible with GHES anymore until artifacts v4 makes it there. We have attempted various way to work around the GHES sync in this repo (what keep in sync the starter workflow between the main and ghes branch for GHES). The current state is "ok-ish", as in, our icons have disappeared but at least our workflows are there. This PR fixes that with a better solution. It's still a bit hard to wrap once's head around the whole thing, but it does what it should.
Pre-requisites
[ ] Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.
Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.
Tasks
For all workflows, the workflow:
[ ] Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
[ ] Should use sentence case for the names of workflows and steps (for example, "Run tests").
[ ] Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
[ ] Should include comments in the workflow for any parts that are not obvious or could use clarification.
[ ] Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.
[ ] Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
[ ] Packaging workflows should run on release with types: [ created ].
[ ] Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).
[ ] creator: Name of the organization/user producing the Code Scanning integration.
[ ] description: Short description of the Code Scanning integration.
[ ] categories: Array of languages supported by the Code Scanning integration.
[ ] iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
[ ] Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).
[ ] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
[ ] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
[ ] Automation and CI workflows cannot be dependent on a paid service or product.
@yoannchaudet - Should this be pulled into the GA of 3.13.0?
If so, would you please open and merge a 3.13 backport? Once that is completed I can cherry-pick this into 3.13.0
Thanks!
A read-only synced folder is a folder that:
Icons associated with a read-only folder should still stay on the
ghes
branch.More context:
In PRs:
In English:
Pre-requisites
Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.
Tasks
For all workflows, the workflow:
.yml
file with the language or platform as its filename, in lower, kebab-cased format (for example,docker-image.yml
). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").GITHUB_TOKEN
so that the workflow runs successfully.For CI workflows, the workflow:
ci
directory.ci/properties/*.properties.json
file (for example,ci/properties/docker-publish.properties.json
).push
tobranches: [ $default-branch ]
andpull_request
tobranches: [ $default-branch ]
.release
withtypes: [ created ]
.docker-publish.yml
).For Code Scanning workflows, the workflow:
code-scanning
directory.code-scanning/properties/*.properties.json
file (for example,code-scanning/properties/codeql.properties.json
), with properties set as follows:name
: Name of the Code Scanning integration.creator
: Name of the organization/user producing the Code Scanning integration.description
: Short description of the Code Scanning integration.categories
: Array of languages supported by the Code Scanning integration.iconName
: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in theicons
directory.push
tobranches: [ $default-branch, $protected-branches ]
andpull_request
tobranches: [ $default-branch ]
. We also recommend aschedule
trigger ofcron: $cron-weekly
(for example,codeql.yml
).Some general notes:
actions
organization, or