Uh oh!
There was an error while loading. Please reload this page.
CI: Bump allow-list pin and quieten repeat summaries - #91
Merged
ModeSevenIndustrialSolutions merged 1 commit intoSep 3, 2026
Conversation
Two unrelated pieces of workflow housekeeping. The harden-runner allow-list now points at v0.16.1 of the shared lfreleng-actions/.github list. Both forms that carry the reference move together: the harden_runner_allowlist input default and the literal config pin in the workflows that do not take that input. Every job also loaded the allow-list and wrote the same static block to the job summary, so a caller of one of these workflows saw it once per job rather than once per run. The action already exposes allow_list_summary for this, so the block is suppressed everywhere except the first invocation in each file: what a job hardened against is worth stating, but only the first time anyone reads it. Reusable workflows cannot see beyond themselves, so this is once per workflow rather than once per run. A caller invoking several still gets one block from each, which is a large reduction on one per job and as far as a workflow can enforce on its own behalf. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
requested review from
a team
and
a balanced review from CopilotSeptember 3, 2026 13:54
Copilotstarted reviewing on behalf of ModeSevenIndustrialSolutionsSeptember 3, 2026 13:54 View session
There was a problem hiding this comment.
🟢 Approval recommended
The pin is valid, the action supports the configured input, and each workflow retains exactly one emitting invocation.
Pull request overview
Updates CI workflow allow-list configuration and reduces repetitive job summaries.
Changes:
- Pins the shared allow-list to verified v0.16.1.
- Suppresses duplicate allow-list summaries after each workflow’s first invocation.
File summaries
| File | Description |
|---|---|
.github/workflows/release-drafter.yaml | Updates the allow-list pin. |
.github/workflows/merge.yaml | Updates the pin and suppresses nine duplicate summaries. |
.github/workflows/build-test.yaml | Updates the pin and suppresses six duplicate summaries. |
.github/workflows/build-test-release.yaml | Updates the pin and suppresses twelve duplicate summaries. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
zxiiro
approved these changes
Sep 3, 2026
zxiiro
left a comment
There was a problem hiding this comment.
🤖 Auto-approved by agent: code-reviewed low risk. Allow-list pin v0.16.0→v0.16.1 plus allow_list_summary:false on harden-runner-block; no permission/secret/trigger changes.
ModeSevenIndustrialSolutions
merged commit Sep 3, 2026
81ccc32
into
lfreleng-actions:main
27 checks passed
Uh oh!
There was an error while loading. Please reload this page.
ModeSevenIndustrialSolutions
deleted the
ci/harden-runner-allowlist-v0.16.1
branch
September 3, 2026 16:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI: Bump allow-list pin and quieten repeat summaries
Two pieces of workflow housekeeping, applied identically across the
*-workflowsestate.1. Allow-list pin → v0.16.1
Repoints the shared
lfreleng-actions/.githuballow-list atec0736244fc776e326283c6af6840e30f316f63c(v0.16.1), up from v0.16.0.Both forms that carry the reference move together:
allow_list.txt@<sha>harden_runner_allowlistinput defaultconfig: '@<sha>'release-drafter.yaml)2. One allow-list summary per workflow
Every job loads the allow-list, and each invocation wrote the same static
block to the job summary — once per job rather than once per run,
crowding out the build, test and audit output a reader came for.
The action already exposes
allow_list_summaryfor exactly this, so thisis configuration rather than a change to it. Suppressed everywhere except
the first invocation in each file.
The largest reduction in the estate:
build-test-release.yamlgoes from13 blocks to 1,
merge.yamlfrom 10 to 1, andbuild-test.yamlfrom 7to 1.
Scope note: once per workflow, not once per run
These are
workflow_callreusable workflows, so they cannot see beyondthemselves. A caller invoking several still receives one block from each.
That is as far as a reusable workflow can enforce on its own behalf — a
large reduction on one per job, but not literally one per run, so worth
stating rather than implying.
Validation
actionlintclean on every workflow;zizmorreports no findings; allprekhooks pass;aislop ci --changes --base upstream/main→ 0 errors,0 warnings. Verified that no stale allow-list SHA remains and that
exactly one invocation per file still emits.