opendefensecloud / solution-arsenal / 38277746211
79%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 94
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 78.641% (-0.03%) from 78.672%
38277746211

push

github

web-flow 
chore: migrate to dev-kit v3.0.0 (#858)

## What

Migrates to dev-kit v3.0.0 and replaces the five local governance
workflow copies with caller
stubs. Closes #825. Solar is the pilot; the other consumers follow.

`scorecard.yaml` stays standalone, as v3 intends.

## Not on the Renovate PR

The ticket asks for this to ride Renovate's v3.0.0 PR. It can't: the
default preset sets
`minimumReleaseAge: "10 days"` for majors, so that PR would not open
until **~2026-10-17**. And
it would only carry the pin bumps — deleting the copies, writing the
stubs and carrying the osv
arguments are manual either way. So this is a standalone PR with the
`flake.lock` commit done by
hand.

**The relock bot is armed, not yet exercised.**
`renovate-dev-kit-lock.yml` ships here, and its
gate (branch `renovate/dev-kit`, author `renovate[bot]`, same repo) is
all defaults, so the stub
needs no `with:`. The next dev-kit patch or minor gets a grouped PR, the
condition matches, and
the bot commits the relock — that is what answers "does the relock
work", not this PR. On every
other PR the job is skipped.

## Worth a look in review

- **The osv-scanner stub carries this repo's `scan-args`** —
`--include-git-root`,
`--config ./.osv-scanner.toml`, `-r`, `./`. dev-kit's README shows them
commented out. Without
them the scan loses its config and keeps passing while checking less,
which is the failure mode
  that does not announce itself.
- **Four dev-kit pins, not three.** The release notes name the Makefile,
the flake input and
`setup-nix`; this repo also pins the `diff-check` composite action. The
`renovate-auto-approve`
  stub is a fifth reference and was already a stub before this change.
- **`REPO_STATUS_CHECKS` is unchanged on purpose.** It is `["check",
"lint", "test", "CodeQL"]` —
`codegen` → `check`, `golang` → `lint`/`test`. No governance check is
required, so the
`<stub job> / <called job>` rename touches nothing and `make
repo-settings` needs no rerun. If
  anything *was* req... (continued)

5092 of 6475 relevant lines covered (78.64%)

27.42 hits per line

Coverage Regressions

Lines Coverage ∆ File
6
77.2
-0.2% pkg/controller/target_controller.go
2
86.64
-0.43% pkg/controller/rendertask_controller.go
Jobs
ID Job ID Ran Files Coverage
1 38277746211.1 94
78.64
GitHub Action Run
Source Files on build 38277746211