Merge pull request #1251 from Goodnessukaigwe/fix/1219-prune-redundant-github-workflow-templates-and-standardize-on-one

[1219] Prune redundant GitHub workflow templates and standardize on one

Author: OtowoSamuel

.cargo/audit.toml

@@ -102,9 +102,9 @@ ignore = [
     "RUSTSEC-2026-0192",
 
     # ── Ignored advisories previously carried as inline --ignore flags ─────────
-    # These were maintained in 3 separate workflow YAML files (ci.yml,
-    # dependency-review.yml, maintenance.yml) and often drifted out of sync.
-    # Consolidated here so .cargo/audit.toml is the single source of truth.
+    # These were maintained across workflow YAML files and often drifted out of
+    # sync. Consolidated here so .cargo/audit.toml is the single source of truth.
+    # Canonical cargo-audit runners: ci.yml (PR/push) and security-audit.yml (schedule).
     #
     # time 0.3.36 – potential overflow in instant conversion (RUSTSEC-2020-0071).
     # Transitive via backoff → kube-runtime. No patched version available in our

.github/CI_COMMANDS.md

@@ -287,6 +287,20 @@ cargo audit  # Uses .cargo/audit.toml config
 - **PR/push path:** `ci.yml` `security-audit` (runs when dependency files change).
 - **Schedule / SBOM / cargo-deny / scorecard:** `.github/workflows/security-audit.yml`
   (schedule + `workflow_dispatch` only — no duplicate PR trigger).
+- **Not duplicated in:** `dependency-review.yml` or `maintenance.yml`.
+
+### Security scanning (Trivy / Checkov)
+- **Canonical workflow:** `.github/workflows/security-scan.yml` (push to `main`,
+  schedule, `workflow_dispatch`). Uses `.github/actions/security-scan` for image scans.
+- **CI image scan after publish:** `ci.yml` `security-scan` job (same composite action).
+
+### Maintenance workflow
+- **Unique job only:** `maintenance.yml` → stale-artifact regression tests.
+- Scheduled cargo-audit / docs link checks live in `security-audit.yml` / `link-check.yml`.
+
+### Issue templates
+- **Single maintenance/chore template:** `.github/ISSUE_TEMPLATE/maintenance.yml`
+  (covers dependency updates, CI hygiene, docs, refactors).
 
 ### Release gate vs release.yml
 - `release.yml` `validate` owns semver + Cargo.toml matching; helm job owns helm lint.

.github/CODEOWNERS

@@ -37,4 +37,4 @@ README.md              @stellar-k8s-maintainers @docs-team
 
 # Benchmarking
 /benchmarks/           @performance-team
-/.github/workflows/benchmark.yml @performance-team
+/.github/workflows/performance.yml @performance-team

.github/ISSUE_TEMPLATE/dependency_update.yml

@@ -9,6 +9,9 @@ body:
         Use this template for maintenance tasks: dependency bumps, CI fixes, doc updates,
         code cleanup, refactors, and other work that does not add features or fix bugs.
 
+        > When opening a PR for this issue, select **Maintenance / hygiene** in the PR
+        > template and fill in the **Maintenance task checklist** section.
+
   - type: dropdown
     id: category
     attributes:
@@ -20,6 +23,7 @@ body:
         - Documentation
         - Code cleanup / refactor
         - Build system / tooling
+        - Configuration drift
         - Repository hygiene
         - Other
     validations:
@@ -45,6 +49,15 @@ body:
     validations:
       required: true
 
+  - type: textarea
+    id: packages
+    attributes:
+      label: Package(s) Affected (dependencies only)
+      description: For dependency updates, list crate(s) or tool(s) with current → target versions. Leave blank otherwise.
+      placeholder: |
+        - `kube` 0.89 → 0.91
+        - `tokio` 1.36 → 1.38
+
   - type: textarea
     id: acceptance_criteria
     attributes:
@@ -64,6 +77,7 @@ body:
       placeholder: |
         - [ ] Run `cargo check` and paste the output
         - [ ] CI passes on the PR
+        - [ ] `cargo audit` is clean (for dependency changes)
     validations:
       required: true
 

.github/ISSUE_TEMPLATE/maintenance.yml

@@ -1,10 +1,11 @@
 name: Dependency & License Review
 
-# Automatically detects stale dependencies, license drift, and security
-# advisories on every push/PR that touches Cargo files, and on a weekly
-# schedule so that newly published advisories are caught promptly.
+# Unique dependency-review gates (stale deps, lockfile diff, license inventory,
+# cargo-deny on dep changes). cargo-audit is intentionally NOT duplicated here:
+#   - PR/push:  ci.yml `security-audit`
+#   - Schedule: security-audit.yml
 #
-# Addresses GitHub Issue #1119.
+# Addresses GitHub Issue #1119; deduplicated in #1219.
 
 on:
   push:
@@ -22,7 +23,7 @@ on:
       - "deny.toml"
       - ".cargo/audit.toml"
   schedule:
-    # Run weekly on Mondays at 08:00 UTC to catch newly published advisories.
+    # Run weekly on Mondays at 08:00 UTC for stale-deps + license inventory.
     - cron: "0 8 * * 1"
   workflow_dispatch:
     inputs:
@@ -43,48 +44,7 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  # ── 1. cargo audit — known vulnerabilities ──────────────────────────────────
-  cargo-audit:
-    name: Cargo Audit (Vulnerabilities)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-audit"
-          extra-tools: "cargo-audit"
-
-      - name: Install cargo-audit
-        run: |
-          for i in 1 2 3; do
-            cargo install --locked cargo-audit && break
-            echo "Attempt $i failed, retrying..."
-            sleep 5
-          done
-
-      - name: Run cargo audit
-        run: |
-          echo "── Security advisory audit ──────────────────────────────────────"
-          cargo audit
-
-      - name: Generate audit JSON report
-        if: always()
-        run: |
-          cargo audit --json 2>/dev/null > audit-report.json || true
-          echo "Audit report saved to audit-report.json"
-
-      - name: Upload audit report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: cargo-audit-report
-          path: audit-report.json
-          retention-days: 30
-
-  # ── 2. cargo deny — license + bans + advisories ─────────────────────────────
+  # ── 1. cargo deny — license + bans + advisories ─────────────────────────────
   cargo-deny:
     name: Cargo Deny (Licenses + Bans)
     runs-on: ubuntu-latest

.github/ISSUE_TEMPLATE/maintenance_task.yml

@@ -1,5 +1,12 @@
 name: Maintenance
 
+# Weekly hygiene that is NOT covered by other workflows:
+#   - security-audit.yml  → scheduled cargo-audit / cargo-deny / scorecard / SBOM
+#   - link-check.yml      → scheduled lychee link rot
+#   - ci.yml              → PR/push gates
+#
+# Unique value here: stale-artifact cleanup regression coverage.
+
 on:
   schedule:
     - cron: '0 9 * * 1' # Every Monday at 09:00 UTC
@@ -20,42 +27,3 @@ jobs:
 
       - name: Run stale artifact cleanup regression tests
         run: cargo test stale_artifact_cleanup -- --nocapture
-
-  dependency-audit:
-    name: Dependency Audit
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-audit-maintenance"
-          extra-tools: "cargo-audit"
-
-      - name: Install cargo-audit
-        run: |
-          for i in 1 2 3; do
-            cargo install cargo-audit --locked && break
-            echo "Attempt $i failed, retrying..."
-            sleep 5
-          done
-
-      - name: Run security audit
-        run: cargo audit
-
-  docs-health:
-    name: Docs Health Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
-
-      - name: Check documentation links
-        run: python3 scripts/check-links.py

.github/workflows/dependency-review.yml

@@ -1,15 +1,23 @@
 name: Security Scanning
 
+# Canonical Trivy / Checkov security scanning workflow.
+# Image Trivy on the published CI image also runs via the
+# `.github/actions/security-scan` composite from `ci.yml` (push to main).
+# This workflow covers filesystem + IaC scans and a standalone image build scan
+# on schedule / main pushes / manual dispatch.
+
 on:
   push:
-    branches: [develop]
+    branches: [main]
     paths:
       - "**.rs"
       - "**.yaml"
       - "**.yml"
       - "charts/**"
       - "Dockerfile*"
       - "Makefile"
+      - ".github/workflows/security-scan.yml"
+      - ".github/actions/security-scan/**"
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
@@ -55,19 +63,10 @@ jobs:
       - name: Build Docker image
         run: docker build -t stellar-operator:scan .
 
-      - name: Run Trivy on Docker image
-        uses: aquasecurity/trivy-action@v0.36.0
+      - name: Security Scan
+        uses: ./.github/actions/security-scan
         with:
           image-ref: stellar-operator:scan
-          format: sarif
-          output: trivy-docker.sarif
-          severity: CRITICAL,HIGH
-
-      - name: Upload Trivy Docker scan
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: trivy-docker.sarif
 
   iac-checkov:
     name: IaC Security Scan (Helm/K8s manifests)
@@ -82,7 +81,7 @@ jobs:
         uses: bridgecrewio/checkov-action@v12
         with:
           directory: charts/
-          framework: kubernetes
+          framework: helm
           output_format: sarif
           output_file_path: checkov-results.sarif
         continue-on-error: true
@@ -92,4 +91,3 @@ jobs:
         if: always()
         with:
           sarif_file: checkov-results.sarif
-