Merge branch 'main' into hephaestus-avatar-brand-refresh

Author: FelixTJDietrich

.github/workflows/ci-compose-validate.yml

@@ -1,28 +1,14 @@
 name: Validate Compose
 
-# The self-hosted stack (docker/self-host/) composes the reference deployment's
-# service definitions via `include`, so a change to docker/compose.*.yaml can
-# break a stranger's install without touching a single self-host file. Rendering
-# both stacks here turns interpolation- and merge-level breakage into a red check
-# instead of a bad first boot. (Semantic breakage — a renamed service silently
-# joining the stack, an inherited runtime bug — still needs a real boot.)
-#
-# Runs on every PR (not just docker/ changes) so it can be a required check,
-# matching how verify-changesets.yml is wired. It is cheap: only `docker compose
-# config`, no image pulls.
+# Shared Compose files can break either the reference or self-hosted stack, so
+# render both configurations.
 
 on:
-  pull_request:
-  push:
-    branches: [main]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: validate-compose-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   validate:
     name: "Render compose stacks"
@@ -37,9 +23,7 @@ jobs:
         working-directory: docker/self-host
         run: |
           set -euo pipefail
-          # Fill the required values the way an operator would; `docker compose
-          # config` fails on any variable the stack requires but .env.example
-          # does not carry, which is exactly the drift we want to catch.
+          # Supply required operator values; missing defaults must still fail rendering.
           cp .env.example .env
           sed -i \
             -e 's|^APP_HOSTNAME=$|APP_HOSTNAME=hephaestus.example.com|' \
@@ -66,8 +50,7 @@ jobs:
         working-directory: docker/self-host
         run: |
           set -euo pipefail
-          # `config` only warns about variables missing from .env; a warning here
-          # means .env.example has fallen behind the stack it renders.
+          # `config` warns rather than fails when .env omits a referenced variable.
           if docker compose config 2>&1 >/dev/null | grep "variable is not set"; then
             echo "::error::docker/self-host/.env.example is missing variables the stack references (see warnings above)"
             exit 1
@@ -86,9 +69,7 @@ jobs:
             grep -qx "$required" <<< "$services" || {
               echo "::error::'$required' is missing from the self-hosted stack"; exit 1; }
           done
-          # Compose 2.21-2.23 parse `!override` but silently ignore it, which would
-          # publish the reference's dashboard port and keep the maintainers' ACME
-          # email. Assert the merged result rather than trust the runner's version.
+          # Some Compose releases accept `!override` without applying it.
           rendered=$(docker compose config)
           for required in \
             'entrypoints.https.http.middlewares=security-headers@docker' \

.github/workflows/cicd.yml

@@ -34,6 +34,7 @@ jobs:
       ci-config: ${{ steps.filter.outputs.ci-config }}
       docker-config: ${{ steps.filter.outputs.docker-config }}
       pmd-canary: ${{ steps.filter.outputs.pmd-canary }}
+      version-bump: ${{ steps.version_bump.outputs.changed }}
       any-code: ${{ steps.filter.outputs.webapp == 'true' || steps.filter.outputs.application-server == 'true' || steps.filter.outputs.tooling == 'true' || steps.filter.outputs.agent-images == 'true' || steps.filter.outputs.postgres-image == 'true' }}
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     timeout-minutes: 5
@@ -48,6 +49,16 @@ jobs:
         with:
           do_not_skip: '["workflow_dispatch", "push", "merge_group"]'
 
+      - name: Detect version bump
+        id: version_bump
+        if: github.event_name == 'push'
+        run: |
+          current=$(jq -r .version package.json)
+          previous=$(git show HEAD^:package.json | jq -r .version)
+          changed=false
+          [ "$current" = "$previous" ] || changed=true
+          echo "changed=$changed" >> "$GITHUB_OUTPUT"
+
       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
@@ -183,6 +194,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [detect-changes]
     if: |
+      (github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true') &&
       needs.detect-changes.outputs.should_skip != 'true' && (
         needs.detect-changes.outputs.ci-config == 'true' ||
         github.event_name != 'pull_request'
@@ -207,6 +219,8 @@ jobs:
     name: "Zizmor"
     timeout-minutes: 10
     runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true'
     permissions:
       contents: read
       security-events: write
@@ -230,6 +244,7 @@ jobs:
     uses: ./.github/workflows/ci-quality-gates.yml
     needs: [detect-changes]
     if: |
+      (github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true') &&
       needs.detect-changes.outputs.should_skip != 'true' && (
         needs.detect-changes.outputs.any-code == 'true' ||
         needs.detect-changes.outputs.ci-config == 'true' ||
@@ -251,6 +266,7 @@ jobs:
     uses: ./.github/workflows/ci-security-scan.yml
     needs: [detect-changes]
     if: |
+      (github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true') &&
       needs.detect-changes.outputs.should_skip != 'true' && (
         needs.detect-changes.outputs.any-code == 'true' ||
         needs.detect-changes.outputs.ci-config == 'true' ||
@@ -266,6 +282,7 @@ jobs:
     uses: ./.github/workflows/ci-tests.yml
     needs: [detect-changes]
     if: |
+      (github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true') &&
       needs.detect-changes.outputs.should_skip != 'true' && (
         needs.detect-changes.outputs.any-code == 'true' ||
         needs.detect-changes.outputs.ci-config == 'true' ||
@@ -292,6 +309,13 @@ jobs:
     permissions:
       contents: read
 
+  Compose:
+    needs: [detect-changes]
+    if: github.event_name != 'push' || needs.detect-changes.outputs.version-bump == 'true'
+    uses: ./.github/workflows/ci-compose-validate.yml
+    permissions:
+      contents: read
+
   Docker:
     uses: ./.github/workflows/ci-docker-build.yml
     secrets:
@@ -331,7 +355,7 @@ jobs:
     permissions:
       actions: read
       statuses: write
-    needs: [detect-changes, workflow-lint, zizmor, Quality, Security, Test, Changesets, Docker]
+    needs: [detect-changes, workflow-lint, zizmor, Quality, Security, Test, Changesets, Compose, Docker]
     if: always()
     steps:
       - name: Generate workflow timeline
@@ -388,6 +412,7 @@ jobs:
           echo "Security:       ${{ needs.Security.result }}"
           echo "Test:           ${{ needs.Test.result }}"
           echo "Changesets:     ${{ needs.Changesets.result }}"
+          echo "Compose:        ${{ needs.Compose.result }}"
           echo "Docker:         ${{ needs.Docker.result }}"
 
           if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
@@ -437,6 +462,7 @@ jobs:
           echo "| Quality | $(result_to_emoji '${{ needs.Quality.result }}') |" >> $GITHUB_STEP_SUMMARY
           echo "| Test | $(result_to_emoji '${{ needs.Test.result }}') |" >> $GITHUB_STEP_SUMMARY
           echo "| Changesets | $(result_to_emoji '${{ needs.Changesets.result }}') |" >> $GITHUB_STEP_SUMMARY
+          echo "| Compose | $(result_to_emoji '${{ needs.Compose.result }}') |" >> $GITHUB_STEP_SUMMARY
           echo "| Security | $(result_to_emoji '${{ needs.Security.result }}') |" >> $GITHUB_STEP_SUMMARY
           echo "| Docker | $(result_to_emoji '${{ needs.Docker.result }}') |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/review-policy.yml

@@ -4,72 +4,44 @@ on:
   pull_request_target: # zizmor: ignore[dangerous-triggers] API reads only; no pull-request code is executed.
     branches: [main]
     types: [opened, reopened, synchronize, ready_for_review]
-  pull_request_review:
-    types: [submitted, dismissed]
-  merge_group:
 
 permissions: {}
 
 concurrency:
-  # Never cancel: runs in a group are serialised, so the newest event's verdict is the one that
-  # lands, and a cancelled run publishes nothing rather than a half-written state.
-  group: review-policy-${{ github.event.pull_request.number || github.ref }}
+  # Never cancel: runs in a group are serialised, so the newest event's decision is the one that
+  # lands, and a cancelled run leaves an approval unsubmitted rather than half-written.
+  group: review-policy-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
 jobs:
-  # This job is *not* the required context. It publishes one — a check run named `review-policy`,
-  # which the `main` ruleset requires and binds to the GitHub Actions integration that a
-  # `GITHUB_TOKEN`-authenticated check run is attributed to. Reporting the verdict separately is
-  # what lets an unreviewed pull request sit pending instead of red: a job can only pass or fail,
-  # and a failing job made a healthy pull request awaiting its first review look broken on the pull
-  # request list. Renaming this job back to `review-policy` would put two check runs of that name
-  # on the same commit and make which one the ruleset reads a race.
-  publish:
-    name: Publish review-policy status
+  # This job is *not* a required status check, and must never become one. The `main` ruleset requires
+  # one native approving review; all this job does is supply that approval for the authors listed in
+  # `REVIEW_POLICY_MAINTAINERS`. A pull request by anyone else gets no approval here and sits in
+  # GitHub's own "Review required" state, which blocks merging, merge-queue entry and auto-merge.
+  #
+  # `synchronize` is load-bearing: the ruleset dismisses stale approvals on push, so every push has
+  # to earn a fresh one.
+  approve:
+    name: Approve a maintainer's pull request
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
-      checks: write
       contents: read
-      pull-requests: read
+      pull-requests: write
     steps:
-      # The queue re-reports every required context against the projected commit, and the policy was
-      # already decided on the pull request that entered the queue. Written out here rather than
-      # routed through the evaluator so the queue's path needs no checkout and no import: a merge
-      # group that never receives this context sits until the queue's timeout drops it.
-      - name: Pass the merge group
-        if: github.event_name == 'merge_group'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            await github.rest.checks.create({
-              ...context.repo,
-              // Kept equal to CHECK_NAME in scripts/review-policy.ts; a test asserts they agree.
-              name: 'review-policy',
-              head_sha: context.payload.merge_group.head_sha,
-              status: 'completed',
-              conclusion: 'success',
-              output: {
-                title: 'Satisfied before this merge group was created',
-                summary:
-                  'The review policy is decided on the pull request; entering the merge queue ' +
-                  'already required it to pass.',
-              },
-            });
-
-      # The default branch, never `github.sha`: that is the pull request's merge commit on
-      # `pull_request_review`, which contains pull-request code. The base branch's copy of the
-      # policy is the authoritative one.
+      # The default branch, never `github.sha` or the pull request's head: the base branch's copy of
+      # the policy is the authoritative one, and nothing from the pull request is fetched or run.
       - name: Load the trusted policy evaluator
-        if: github.event_name != 'merge_group'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
           sparse-checkout: scripts
 
-      - name: Publish the review-policy check run
-        if: github.event_name != 'merge_group'
+      # The review is attributed to `github-actions[bot]`, which counts toward the ruleset's
+      # `required_approving_review_count`. That needs the organisation's "Allow GitHub Actions to
+      # create and approve pull requests" setting left on.
+      - name: Approve when the author is a listed maintainer
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           MAINTAINERS: ${{ vars.REVIEW_POLICY_MAINTAINERS }}