From 941b3332568070ba4e7a0fc85f82b28d9d90a46c Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Tue, 18 Aug 2026 17:12:01 -0500 Subject: [PATCH 1/7] fix(do-7299): replace docker image with composite+binary for ARM64 support The upstream action uses 'docker://ghcr.io/mszostok/codeowners-validator:v0.7.2' which is a single-arch AMD64 image. v0.7.2 ships Linux arm64 binaries on GitHub Releases, so switch to a composite action that downloads the correct arch binary. Pinned to v0.7.2 to avoid the token scope regression introduced in v0.7.3+ (upstream issue #143). --- action.yml | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/action.yml b/action.yml index b08de56..e469bb6 100644 --- a/action.yml +++ b/action.yml @@ -58,10 +58,39 @@ inputs: required: false runs: - using: 'docker' - image: 'docker://ghcr.io/mszostok/codeowners-validator:v0.7.2' - env: - ENVS_PREFIX: "INPUT" + using: "composite" + steps: + - name: Install codeowners-validator + shell: bash + run: | + ARCH=$(uname -m) + case "$ARCH" in + x86_64) ARCH="x86_64" ;; + aarch64) ARCH="arm64" ;; + esac + TMP=$(mktemp -d) + curl -sSL "https://github.com/mszostok/codeowners-validator/releases/download/v0.7.2/codeowners-validator_0.7.2_Linux_${ARCH}.tar.gz" \ + | tar -xz -C "$TMP" + sudo mv "$TMP/codeowners-validator" /usr/local/bin/codeowners-validator + sudo chmod +x /usr/local/bin/codeowners-validator + + - name: Run codeowners-validator + shell: bash + env: + GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }} + GITHUB_BASE_URL: ${{ inputs.github_base_url }} + GITHUB_UPLOAD_URL: ${{ inputs.github_upload_url }} + EXPERIMENTAL_CHECKS: ${{ inputs.experimental_checks }} + CHECKS: ${{ inputs.checks }} + REPOSITORY_PATH: ${{ inputs.repository_path }} + CHECK_FAILURE_LEVEL: ${{ inputs.check_failure_level }} + NOT_OWNED_CHECKER_SKIP_PATTERNS: ${{ inputs.not_owned_checker_skip_patterns }} + OWNER_CHECKER_REPOSITORY: ${{ inputs.owner_checker_repository }} + OWNER_CHECKER_IGNORED_OWNERS: ${{ inputs.owner_checker_ignored_owners }} + OWNER_CHECKER_ALLOW_UNOWNED_PATTERNS: ${{ inputs.owner_checker_allow_unowned_patterns }} + OWNER_CHECKER_OWNERS_MUST_BE_TEAMS: ${{ inputs.owner_checker_owners_must_be_teams }} + ENVS_PREFIX: "INPUT" + run: codeowners-validator branding: icon: "shield" From e6a1765d5df6cba30e650282849719410fc96a27 Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:17:09 -0500 Subject: [PATCH 2/7] fix: set INPUT_* env vars explicitly for composite action Composite actions do not auto-set INPUT_* env vars the way Docker/JS actions do. codeowners-validator reads config via ENVS_PREFIX=INPUT, so each input must be explicitly exported with the INPUT_ prefix. --- action.yml | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/action.yml b/action.yml index e469bb6..07f2c90 100644 --- a/action.yml +++ b/action.yml @@ -77,19 +77,21 @@ runs: - name: Run codeowners-validator shell: bash env: - GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }} - GITHUB_BASE_URL: ${{ inputs.github_base_url }} - GITHUB_UPLOAD_URL: ${{ inputs.github_upload_url }} - EXPERIMENTAL_CHECKS: ${{ inputs.experimental_checks }} - CHECKS: ${{ inputs.checks }} - REPOSITORY_PATH: ${{ inputs.repository_path }} - CHECK_FAILURE_LEVEL: ${{ inputs.check_failure_level }} - NOT_OWNED_CHECKER_SKIP_PATTERNS: ${{ inputs.not_owned_checker_skip_patterns }} - OWNER_CHECKER_REPOSITORY: ${{ inputs.owner_checker_repository }} - OWNER_CHECKER_IGNORED_OWNERS: ${{ inputs.owner_checker_ignored_owners }} - OWNER_CHECKER_ALLOW_UNOWNED_PATTERNS: ${{ inputs.owner_checker_allow_unowned_patterns }} - OWNER_CHECKER_OWNERS_MUST_BE_TEAMS: ${{ inputs.owner_checker_owners_must_be_teams }} + # Composite actions do not automatically set INPUT_* env vars the way Docker/JS actions do. + # codeowners-validator reads config via ENVS_PREFIX=INPUT, so we set INPUT_* explicitly. ENVS_PREFIX: "INPUT" + INPUT_GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }} + INPUT_GITHUB_BASE_URL: ${{ inputs.github_base_url }} + INPUT_GITHUB_UPLOAD_URL: ${{ inputs.github_upload_url }} + INPUT_EXPERIMENTAL_CHECKS: ${{ inputs.experimental_checks }} + INPUT_CHECKS: ${{ inputs.checks }} + INPUT_REPOSITORY_PATH: ${{ inputs.repository_path }} + INPUT_CHECK_FAILURE_LEVEL: ${{ inputs.check_failure_level }} + INPUT_NOT_OWNED_CHECKER_SKIP_PATTERNS: ${{ inputs.not_owned_checker_skip_patterns }} + INPUT_OWNER_CHECKER_REPOSITORY: ${{ inputs.owner_checker_repository }} + INPUT_OWNER_CHECKER_IGNORED_OWNERS: ${{ inputs.owner_checker_ignored_owners }} + INPUT_OWNER_CHECKER_ALLOW_UNOWNED_PATTERNS: ${{ inputs.owner_checker_allow_unowned_patterns }} + INPUT_OWNER_CHECKER_OWNERS_MUST_BE_TEAMS: ${{ inputs.owner_checker_owners_must_be_teams }} run: codeowners-validator branding: From d60c2656f85397154f22e012e87b24cab407f5a4 Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:31:25 -0500 Subject: [PATCH 3/7] ci: fix broken upstream CI workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - codeql-analysis.yml: bump codeql-action v1 -> v3 (v1 incompatible with current runners) - pull-requests.yml: skip integration-test when TOKEN_INTEGRATION_TESTS secret absent (fork-safe) - hack/run-lint.sh: fix dead goreleaser.com linter install URL (see upstream PR #184) None of these affect action.yml behaviour — Go source is unchanged. --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/pull-requests.yml | 3 +++ hack/run-lint.sh | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 7108979..b0a43db 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -32,7 +32,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -41,7 +41,7 @@ jobs: # queries: ./path/to/local/query, your-org/your-repo/queries@main - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@v3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v3 diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml index e875c94..c1dbbca 100644 --- a/.github/workflows/pull-requests.yml +++ b/.github/workflows/pull-requests.yml @@ -45,6 +45,9 @@ jobs: - name: "Code Quality Analysis" run: make test-lint integration-test: + # Requires TOKEN_INTEGRATION_TESTS secret (PAT with access to gh-codeowners org). + # Skip in forks where this secret is not available. + if: ${{ secrets.TOKEN_INTEGRATION_TESTS != '' }} strategy: fail-fast: false matrix: diff --git a/hack/run-lint.sh b/hack/run-lint.sh index d735e9e..2dcbd8c 100755 --- a/hack/run-lint.sh +++ b/hack/run-lint.sh @@ -23,7 +23,7 @@ host::install::golangci() { export PATH="${TMP_DIR}/bin:${PATH}" shout "Install the golangci-lint ${GOLANGCI_LINT_VERSION} locally to a tempdir..." - curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://install.goreleaser.com/github.com/golangci/golangci-lint.sh + curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh chmod 700 "${TMP_DIR}/golangci-lint.sh" "${TMP_DIR}/golangci-lint.sh" -b "${TMP_DIR}/bin" ${GOLANGCI_LINT_VERSION} From 14bf4cf8329c1cc3e229b4ef8e59ae7e33bb8c1c Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:37:57 -0500 Subject: [PATCH 4/7] ci: add test-action workflow to verify action runs on amd64 and arm64 Runs the composite action end-to-end on both ubuntu-latest (amd64) and runs-on/pool=small-arm64 (arm64) to confirm the binary download and execution works on both architectures. Uses 'checks: syntax,files' to avoid needing a GitHub token. --- .github/workflows/test-action.yml | 39 +++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/workflows/test-action.yml diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml new file mode 100644 index 0000000..88b68a9 --- /dev/null +++ b/.github/workflows/test-action.yml @@ -0,0 +1,39 @@ +name: Test action (amd64 + arm64) + +on: + pull_request: + branches: [ main ] + workflow_dispatch: {} + +jobs: + test: + name: test (${{ matrix.runner }}) + strategy: + fail-fast: false + matrix: + include: + - runner: ubuntu-latest + arch: amd64 + - runner: runs-on/pool=small-arm64 + arch: arm64 + runs-on: ${{ matrix.runner }} + steps: + - uses: actions/checkout@v4 + + - name: Create minimal CODEOWNERS for validation + run: | + mkdir -p .github + # Use a user that definitely exists so owners check passes + echo "* @DriveWealth/devops" > .github/CODEOWNERS + + - name: Run codeowners-validator (${{ matrix.arch }}) + uses: ./ + with: + # Only run syntax/files checks — no token needed, no external API calls + checks: "syntax,files" + repository_path: "." + + - name: Confirm binary arch + run: | + file $(which codeowners-validator) 2>/dev/null || \ + file /usr/local/bin/codeowners-validator From 3ec4babaadddc5a288dd3d8482f64c2b5ffbf198 Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:39:58 -0500 Subject: [PATCH 5/7] docs: add fork notice explaining this is a shim for ARM64 support --- README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.md b/README.md index 0653666..026325c 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,18 @@ +> [!NOTE] +> **DriveWealth fork** — This is not a true fork. It is a shim that replaces the +> upstream Docker-based action with a composite action that downloads the official +> [`mszostok/codeowners-validator`](https://github.com/mszostok/codeowners-validator) +> binary directly from GitHub Releases, enabling ARM64 runner support. +> +> - Pinned to **v0.7.2** to avoid the GitHub App token scope regression in v0.7.3+ +> (see [upstream issue #143](https://github.com/mszostok/codeowners-validator/issues/143)) +> - The upstream Docker image (`ghcr.io/mszostok/codeowners-validator:v0.7.2`) is AMD64-only; +> v0.7.2 ships a `Linux_arm64` binary which this action uses instead +> - Reference as `DriveWealth/codeowners-validator@` — do **not** use a tag, +> tags point to the upstream release, not this shim +> +> Tracked in [DO-7299](https://drivewealth.atlassian.net/browse/DO-7299). +

From be817b9b36c08b8c6aa313f8c579dd6e5b339706 Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:42:40 -0500 Subject: [PATCH 6/7] chore: add CODEOWNERS to comply with DriveWealth org requirements --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..99240f2 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @DriveWealth/devops From 326bf8bb8a53ef0ec9dcfaad72f2e29da72a8480 Mon Sep 17 00:00:00 2001 From: DriveWealth CI Date: Wed, 19 Aug 2026 09:58:05 -0500 Subject: [PATCH 7/7] ci: remove upstream codeql-analysis.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DriveWealth has org-level default CodeQL scanning — the upstream codeql-analysis.yml (which uses the deprecated codeql-action@v1) is redundant and fails on current runners. --- .github/workflows/codeql-analysis.yml | 47 --------------------------- 1 file changed, 47 deletions(-) delete mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index b0a43db..0000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: "CodeQL" - -on: - push: - branches: [ main ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ main ] - schedule: - - cron: '15 15 * * 2' - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - language: [ 'go' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3