From 7152d914c1b8fe4905a7bcd0987f12fdc6125552 Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 13:43:14 +0530 Subject: [PATCH 1/6] Add cooldown period to deps update --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c3b52d4a..b892131b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,8 @@ updates: labels: - 'go' - 'dependencies' + cooldown: + default-days: 7 - package-ecosystem: github-actions directory: '/' @@ -21,6 +23,8 @@ updates: labels: - 'dependencies' - 'github-actions' + cooldown: + default-days: 7 - package-ecosystem: github-actions directory: '.github/actions/build-wpm' @@ -34,3 +38,5 @@ updates: labels: - 'dependencies' - 'github-actions' + cooldown: + default-days: 7 From 2e50434cdfd96e4e0db4afa338badcc531d84638 Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 13:46:12 +0530 Subject: [PATCH 2/6] Add `persist-credentials: false` in checkout step --- .github/workflows/ci.yml | 8 ++++++++ .github/workflows/codeql.yml | 1 + 2 files changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e5338394..45cbc377 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,6 +27,8 @@ jobs: steps: - name: checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: determine build platforms id: platforms @@ -45,6 +47,8 @@ jobs: steps: - name: checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 @@ -71,6 +75,8 @@ jobs: steps: - name: checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: set platform pair id: platform @@ -177,6 +183,8 @@ jobs: steps: - name: checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: setup qemu uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2c1909e2..3e591139 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,6 +28,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 2 + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 From bb28769d506469ab0a0d4536f1ffd7c99b139628 Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 13:49:50 +0530 Subject: [PATCH 3/6] Update setup go to resolve go version from go.mod --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 45cbc377..4ff5a257 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -53,7 +53,7 @@ jobs: - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '^1.25' + go-version-file: 'go.mod' - name: check dependencies run: | From 22ad1383d05b135fd6542bb3ea92a043b7149dec Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 14:07:14 +0530 Subject: [PATCH 4/6] Remove template evaluation and use env vars --- .github/workflows/ci.yml | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4ff5a257..1575b134 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,9 @@ jobs: echo platforms=$(docker buildx bake binary-cross --print | jq -cr '.target."binary-cross".platforms') >> $GITHUB_OUTPUT - name: print platforms - run: echo ${{ steps.platforms.outputs.platforms }} + run: echo "$PLATFORMS" + env: + PLATFORMS: ${{ steps.platforms.outputs.platforms }} lint: runs-on: ubuntu-latest @@ -81,8 +83,9 @@ jobs: - name: set platform pair id: platform run: | - platform=${{ matrix.platform }} - echo "pair=${platform//\//-}" >> $GITHUB_OUTPUT + echo "pair=${PLATFORM//\//-}" >> $GITHUB_OUTPUT + env: + PLATFORM: ${{ matrix.platform }} - name: setup qemu uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 @@ -137,9 +140,11 @@ jobs: - name: comment body id: comment-body uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 + env: + PLATFORMS: ${{ needs.prepare.outputs.platforms }} with: script: | - const platforms = JSON.parse(${{ toJson(needs.prepare.outputs.platforms) }}) + const platforms = JSON.parse(process.env.PLATFORMS) const builds = platforms.map((platform) => { const platformPair = platform.split('/') const buildPath = `wpm-${platformPair[0]}-${platformPair[1]}${platformPair[2] ? `-v${platformPair[2]}` : ''}` @@ -152,25 +157,30 @@ jobs: - name: create comment if: ${{ steps.find-existing-comment.outputs.result == 'null' }} uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 + env: + COMMENT_BODY: ${{ steps.comment-body.outputs.result }} with: script: | github.rest.issues.createComment({ repo: context.repo.repo, owner: context.repo.owner, issue_number: context.issue.number, - body: ${{ steps.comment-body.outputs.result }}, + body: JSON.parse(process.env.COMMENT_BODY), }); - name: update comment if: ${{ steps.find-existing-comment.outputs.result != 'null' }} uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 + env: + COMMENT_ID: ${{ steps.find-existing-comment.outputs.result }} + COMMENT_BODY: ${{ steps.comment-body.outputs.result }} with: script: | github.rest.issues.updateComment({ repo: context.repo.repo, owner: context.repo.owner, - body: ${{ steps.comment-body.outputs.result }}, - comment_id: ${{ steps.find-existing-comment.outputs.result }}, + body: JSON.parse(process.env.COMMENT_BODY), + comment_id: JSON.parse(process.env.COMMENT_ID), }); release: @@ -244,10 +254,12 @@ jobs: - name: upload release assets uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 + env: + UPLOAD_URL: ${{ steps.draft-release.outputs.upload_url }} with: script: | const fs = require('fs'); - let uploadUrl = '${{ steps.draft-release.outputs.upload_url }}'; + let uploadUrl = process.env.UPLOAD_URL; const templateMarkerPos = uploadUrl.indexOf("{"); if (templateMarkerPos !== -1) { uploadUrl = uploadUrl.substring(0, templateMarkerPos); From eff96d0cb0e0aeb7cc59263768213a77a68f0349 Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 14:25:51 +0530 Subject: [PATCH 5/6] Move templates to env var --- .github/workflows/ci.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1575b134..7ea72b12 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -113,8 +113,10 @@ jobs: - name: s3 upload if: ${{ github.ref_type == 'branch' && github.actor != 'dependabot[bot]' }} - run: aws s3 cp build/ s3://wpm-cli-builds/${{ github.event.number && github.event.number != null && github.event.number || 'latest' }}/ --exclude "*" --include "wpm-*" --recursive --endpoint-url ${{ secrets.S3_ENDPOINT_URL }} --region auto --checksum-algorithm CRC32 + run: aws s3 cp build/ "s3://wpm-cli-builds/${UPLOAD_PATH}/" --exclude "*" --include "wpm-*" --recursive --endpoint-url "$S3_ENDPOINT" --region auto --checksum-algorithm CRC32 env: + S3_ENDPOINT: ${{ secrets.S3_ENDPOINT_URL }} + UPLOAD_PATH: ${{ github.event.number || 'latest' }} AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} @@ -141,6 +143,7 @@ jobs: id: comment-body uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 env: + PR_NUMBER: ${{ github.event.number }} PLATFORMS: ${{ needs.prepare.outputs.platforms }} with: script: | @@ -148,7 +151,7 @@ jobs: const builds = platforms.map((platform) => { const platformPair = platform.split('/') const buildPath = `wpm-${platformPair[0]}-${platformPair[1]}${platformPair[2] ? `-v${platformPair[2]}` : ''}` - const buildUrl = `https://pub-bea4f3d05c4f49e0b54ccf1dad0da103.r2.dev/${{ github.event.number }}/${buildPath}${platformPair[0] === 'windows' ? '.exe' : ''}` + const buildUrl = `https://pub-bea4f3d05c4f49e0b54ccf1dad0da103.r2.dev/${process.env.PR_NUMBER}/${buildPath}${platformPair[0] === 'windows' ? '.exe' : ''}` const spec = `${platformPair[0]}/${platformPair[1]}${platformPair[2] ? `/${platformPair[2]}` : ''}` return `- \`${spec}\` - [\`build\`](${buildUrl})` }).join('\n') From 56782d20064a3144401b7ef9adf53e5e5eb93076 Mon Sep 17 00:00:00 2001 From: thelovekesh Date: Fri, 22 May 2026 14:45:49 +0530 Subject: [PATCH 6/6] Trigger CI