Standardize Branch Patterns Across Workflows

[coderabbitai[bot]]

Issue Description:

There are inconsistencies in branch patterns across various workflow files in the repository. These inconsistencies could lead to workflows not triggering as expected. Standardizing the branch patterns across all workflows will ensure consistent CI/CD behavior.

References:

• Original PR: https://github.com/reactive-firewall/multicast/pull/175
• Original Comment: https://github.com/reactive-firewall/multicast/pull/175#discussion_r1823767568

[reactive-firewall]

• linters like 'makefile-lint.yml', 'markdown-lint.yml', 'yaml-lint.yml' should be consistent and use ["main", "master", "stable", patch-*, feature-*, HOTFIX-*]
• bandit.yml should be libral on all pull requests but only run on select pushes as with the linters using ["main", "master", "stable", patch-*, feature-*, HOTFIX-*]
• codeql-analysis.yml should be more selective and use only the default branch and stable branches or tags ["main", "master", "stable"] and v[0-9].[0-9].[0-9] respectively
• Tests.yml is rather monolithic right now, and thus must be limited to ration GHA CPU credit usage: only running for the master branch, tags and critical pull requests that target merges to the default branch and "stable"

[reactive-firewall]

@coderabbitai, please verify this issue is resolved on the branch testing-coverage

[coderabbitai[bot]]

[!TIP] For best results, initiate chat on the files or code changes.

@reactive-firewall, I have verified the workflows on the testing-coverage branch. Here's a summary:

1. makefile-lint.yml:

   • Push branches: ["main", "master", "stable", feature*]
   • Pull request branches: ["main", "master", "stable"]
   • Observation: Missing patch-*, feature-*, and HOTFIX-* in branch patterns.

2. markdown-lint.yml:

   • Push branches: ["main", "master", draft, draft*]
   • Pull request branches: ["main", "master"]
   • Observation: Branch patterns are inconsistent and do not include stable, patch-*, feature-*, or HOTFIX-*.

3. yaml-lint.yml:

   • Push branches: ["main", "master", "stable", feature*]
   • Pull request branches: ["main", "master", "stable"]
   • Observation: Missing patch-*, feature-*, and HOTFIX-* in branch patterns.

4. bandit.yml:

   • Push branches: ["master", "stable", feature-*, HOTFIX-*]
   • Pull request branches: ["master", "stable"]
   • Observation: Missing patch-* in branch patterns.

5. codeql-analysis.yml:

   • Push branches: ["master", "stable"]
   • Pull request branches: ["stable"]
   • Observation: Missing main in branches and tags matching v[0-9].[0-9].[0-9].

6. Tests.yml:

   • Push branches: ["master", "stable"]
   • Tags: v*
   • Pull request types: opened, edited, reopened, synchronize, ready_for_review
   • Observation: The workflow runs on master, stable, and tags starting with v*. However, it may still run on more pull requests than intended.

Based on the above, the issue is not fully resolved on the testing-coverage branch. The branch patterns need to be updated to match your specified criteria:

• Linters (makefile-lint.yml, markdown-lint.yml, yaml-lint.yml) should consistently use:

  branches: ["main", "master", "stable", "patch-*", "feature-*", "HOTFIX-*"]

• bandit.yml should use the same branch patterns as the linters for both pushes and pull requests.

• codeql-analysis.yml should be more selective, using branches ["main", "master", "stable"] and tags matching v[0-9].[0-9].[0-9]:

  branches: ["main", "master", "stable"]
  tags: ["v[0-9].[0-9].[0-9]"]

• Tests.yml should be limited to:

  • Pushes: Only on master, stable, and tags.
  • Pull requests: Only on critical pull requests targeting merges to the default branch and stable.

I referred to your previous preferences regarding consistent branch patterns for linters when reviewing these workflows.

Please let me know if you need any further assistance.

🔗 Analysis chain

🏁 Scripts executed

The following scripts were executed for the analysis: Script: ```shell #!/bin/bash # Check branch patterns in the specified workflows on branch 'testing-coverage' # List of workflows to check workflows=( ".github/workflows/makefile-lint.yml" ".github/workflows/markdown-lint.yml" ".github/workflows/yaml-lint.yml" ".github/workflows/bandit.yml" ".github/workflows/codeql-analysis.yml" ".github/workflows/Tests.yml" ) for file in "${workflows[@]}"; do echo "Checking $file" if [[ -f "$file" ]]; then echo "Branch patterns in $file:" # Extract the 'on' section including branches and tags sed -n '/^[ ]*on:/,/^[a-zA-Z]/p' "$file" else echo "File $file does not exist." fi echo "" done ``` Length of output: 3734

---

🧠 Learnings used

``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-12T00:41:41.731Z Learning: For future scripts, reactive-firewall prefers to use only POSIX built-ins (like `printf` instead of `echo`) to align with CEP-8 conventions. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-21T04:40:19.258Z Learning: For future reviews, remember that reactive-firewall prefers to keep un-mapped exit codes as they are until they are ready to be mapped. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-12T03:22:28.902Z Learning: For future scripts, reactive-firewall prefers to keep the shebang line with an extra space (e.g., `#! /bin/bash`) as per project style. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#110 File: docs/CI.md:32-32 Timestamp: 2024-10-08T21:59:30.537Z Learning: Reactive-firewall prefers to keep the word "own" in headings when emphasizing the reader's personal test. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#110 File: docs/CI.md:32-32 Timestamp: 2024-09-17T06:40:42.918Z Learning: Reactive-firewall prefers to keep the word "own" in headings when emphasizing the reader's personal test. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-08T03:15:05.171Z Learning: For future reviews, remember that when drafting or updating CEP documents, it's important to adhere to the project's standard format and include all relevant sections such as Motivation, Detailed Explanation, Implementation Guidelines, Impact, and References. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-08T21:59:30.537Z Learning: For future reviews, remember that when drafting or updating CEP documents, it's important to adhere to the project's standard format and include all relevant sections such as Motivation, Detailed Explanation, Implementation Guidelines, Impact, and References. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#110 File: docs/USAGE.md:66-66 Timestamp: 2024-10-08T21:59:30.537Z Learning: Reactive-firewall prefers to use "Caveat" as a heading instead of "Caution". ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#110 File: docs/USAGE.md:66-66 Timestamp: 2024-09-17T03:38:28.677Z Learning: Reactive-firewall prefers to use "Caveat" as a heading instead of "Caution". ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#118 File: tests/check_pip:92-197 Timestamp: 2024-10-08T21:59:30.537Z Learning: Reactive-firewall prefers defining functions before they are called in Bash scripts to avoid errors due to Bash's sequential interpretation. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#175 File: .github/workflows/markdown-lint.yml:6-6 Timestamp: 2024-10-31T21:13:43.866Z Learning: For 'codeql-analysis.yml', it should be more selective and use only the default branch and stable branches or tags ["main", "master", "stable"] and 'v[0-9].[0-9].[0-9]' respectively. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#175 File: .github/workflows/markdown-lint.yml:6-6 Timestamp: 2024-10-31T21:13:43.866Z Learning: For 'bandit.yml', it should be liberal on all pull requests but only run on select pushes, using ["main", "master", "stable", patch-*, feature-*, HOTFIX-*] as branch patterns. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#175 File: .github/workflows/markdown-lint.yml:6-6 Timestamp: 2024-10-31T21:13:43.866Z Learning: For future reviews, remember that linters like 'makefile-lint.yml', 'markdown-lint.yml', and 'yaml-lint.yml' should be consistent and use ["main", "master", "stable", patch-*, feature-*, HOTFIX-*] as branch patterns. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#175 File: .github/workflows/markdown-lint.yml:6-6 Timestamp: 2024-10-31T21:13:43.866Z Learning: For 'Tests.yml', it should be limited to running only on the 'master' branch, tags, and critical pull requests that target merges to the default branch and 'stable' to conserve GitHub Actions CPU credits. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#148 File: .github/workflows/Tests.yml:271-274 Timestamp: 2024-10-08T22:15:34.012Z Learning: For future reviews, remember that in the `STYLE` job in `.github/workflows/Tests.yml`, the `build` package version `>=1.2.2` is appropriate for Python 3.12 and should remain as is. ``` --- ``` Learnt from: reactive-firewall PR: reactive-firewall/multicast#0 File: :0-0 Timestamp: 2024-10-11T21:15:37.121Z Learning: For future reviews, remember that reactive-firewall prefers to use a centralized `EXIT_CODES` dictionary in Python scripts to standardize exit codes and messages as per CEP-8. This work is tracked in GH issue #117. ```