From c0a83754660cba7c64ecbd53829297a2353fadca Mon Sep 17 00:00:00 2001 From: zbhan Date: Sun, 2 Nov 2025 22:11:24 -0500 Subject: [PATCH] Fix validation error --- .github/PR_TITLE_GUIDE.md | 322 ++++++++++++++++++++++++++++ .github/PULL_REQUEST_TEMPLATE.md | 279 +++++++++++++++++------- .github/workflows/README.md | 1 + .github/workflows/pr-checks-run.yml | 6 +- .github/workflows/pr-checks.yml | 94 +++++++- 5 files changed, 620 insertions(+), 82 deletions(-) create mode 100644 .github/PR_TITLE_GUIDE.md diff --git a/.github/PR_TITLE_GUIDE.md b/.github/PR_TITLE_GUIDE.md new file mode 100644 index 00000000..95fbc12c --- /dev/null +++ b/.github/PR_TITLE_GUIDE.md @@ -0,0 +1,322 @@ +# PR 标题指南 + +## 📋 概述 + +我们使用 **Conventional Commits** 格式来保持 PR 标题的一致性，但这是**建议性的**，不会阻止你的 PR 被合并。 + +## ✅ 推荐格式 + +``` +type(scope): description +``` + +### 示例 + +``` +feat(trader): add new trading strategy +fix(api): resolve authentication issue +docs: update README +chore(deps): update dependencies +ci(workflow): improve GitHub Actions +``` + +--- + +## 📖 详细说明 + +### Type（类型）- 必需 + +描述这次变更的类型： + +| Type | 说明 | 示例 | +|------|------|------| +| `feat` | 新功能 | `feat(trader): add stop-loss feature` | +| `fix` | Bug 修复 | `fix(api): handle null response` | +| `docs` | 文档变更 | `docs: update installation guide` | +| `style` | 代码格式（不影响代码运行） | `style: format code with prettier` | +| `refactor` | 重构（既不是新功能也不是修复） | `refactor(exchange): simplify connection logic` | +| `perf` | 性能优化 | `perf(ai): optimize prompt processing` | +| `test` | 添加或修改测试 | `test(trader): add unit tests` | +| `chore` | 构建过程或辅助工具的变动 | `chore: update dependencies` | +| `ci` | CI/CD 相关变更 | `ci: add test coverage report` | +| `security` | 安全相关修复 | `security: update vulnerable dependencies` | +| `build` | 构建系统或外部依赖项变更 | `build: upgrade webpack to v5` | + +### Scope（范围）- 可选 + +描述这次变更影响的范围： + +| Scope | 说明 | +|-------|------| +| `exchange` | 交易所相关 | +| `trader` | 交易员/交易策略 | +| `ai` | AI 模型相关 | +| `api` | API 接口 | +| `ui` | 用户界面 | +| `frontend` | 前端代码 | +| `backend` | 后端代码 | +| `security` | 安全相关 | +| `deps` | 依赖项 | +| `workflow` | GitHub Actions workflows | +| `github` | GitHub 配置 | +| `actions` | GitHub Actions | +| `config` | 配置文件 | +| `docker` | Docker 相关 | +| `build` | 构建相关 | +| `release` | 发布相关 | + +**注意：** 如果变更影响多个范围，可以省略 scope 或选择最主要的。 + +### Description（描述）- 必需 + +- 使用现在时态（"add" 而不是 "added"） +- 首字母小写 +- 结尾不加句号 +- 简洁明了地描述变更内容 + +--- + +## 🎯 完整示例 + +### ✅ 好的 PR 标题 + +``` +feat(trader): add risk management system +fix(exchange): resolve connection timeout issue +docs: add API documentation for trading endpoints +style: apply consistent code formatting +refactor(ai): simplify prompt processing logic +perf(backend): optimize database queries +test(api): add integration tests for auth +chore(deps): update TypeScript to 5.0 +ci(workflow): add automated security scanning +security(api): fix SQL injection vulnerability +build(docker): optimize Docker image size +``` + +### ⚠️ 需要改进的标题 + +| 不好的标题 | 问题 | 改进后 | +|-----------|------|--------| +| `update code` | 太模糊 | `refactor(trader): simplify order execution logic` | +| `Fixed bug` | 首字母大写，不够具体 | `fix(api): handle edge case in login` | +| `Add new feature.` | 有句号，不够具体 | `feat(ui): add dark mode toggle` | +| `changes` | 完全不符合格式 | `chore: update dependencies` | +| `feat: Added new trading algo` | 时态错误 | `feat(trader): add new trading algorithm` | + +--- + +## 🤖 自动检查行为 + +### 当 PR 标题不符合格式时 + +1. **不会阻止合并** ✅ + - 检查会标记为"建议" + - PR 仍然可以被审查和合并 + +2. **会收到友好提示** 💬 + - 机器人会在 PR 中留言 + - 提供格式说明和示例 + - 建议如何改进标题 + +3. **可以随时更新** 🔄 + - 更新 PR 标题后会重新检查 + - 无需关闭和重新打开 PR + +### 示例评论 + +如果你的 PR 标题是 `update workflow`，你会收到这样的评论： + +```markdown +## ⚠️ PR Title Format Suggestion + +Your PR title doesn't follow the Conventional Commits format, +but this won't block your PR from being merged. + +**Current title:** `update workflow` + +**Recommended format:** `type(scope): description` + +### Valid types: +feat, fix, docs, style, refactor, perf, test, chore, ci, security, build + +### Common scopes (optional): +exchange, trader, ai, api, ui, frontend, backend, security, deps, +workflow, github, actions, config, docker, build, release + +### Examples: +- feat(trader): add new trading strategy +- fix(api): resolve authentication issue +- docs: update README +- chore(deps): update dependencies +- ci(workflow): improve GitHub Actions + +**Note:** This is a suggestion to improve consistency. +Your PR can still be reviewed and merged. +``` + +--- + +## 🔧 配置详情 + +### 支持的 Types + +在 `.github/workflows/pr-checks.yml` 中配置： + +```yaml +types: | + feat + fix + docs + style + refactor + perf + test + chore + ci + security + build +``` + +### 支持的 Scopes + +```yaml +scopes: | + exchange + trader + ai + api + ui + frontend + backend + security + deps + workflow + github + actions + config + docker + build + release +``` + +### 添加新的 Scope + +如果你需要添加新的 scope，请： + +1. 在 `.github/workflows/pr-checks.yml` 的 `scopes` 部分添加 +2. 在 `.github/workflows/pr-checks-run.yml` 更新正则表达式（可选） +3. 更新本文档 + +--- + +## 📚 为什么使用 Conventional Commits？ + +### 优点 + +1. **自动化 Changelog** 📝 + - 可以自动生成版本更新日志 + - 清晰地分类各种变更 + +2. **语义化版本** 🔢 + - `feat` → MINOR 版本（1.1.0） + - `fix` → PATCH 版本（1.0.1） + - `BREAKING CHANGE` → MAJOR 版本（2.0.0） + +3. **更好的可读性** 👀 + - 一眼看出 PR 的目的 + - 更容易浏览 Git 历史 + +4. **团队协作** 🤝 + - 统一的提交风格 + - 降低沟通成本 + +### 示例：自动生成的 Changelog + +```markdown +## v1.2.0 (2025-11-02) + +### Features +- **trader**: add risk management system (#123) +- **ui**: add dark mode toggle (#125) + +### Bug Fixes +- **api**: resolve authentication issue (#124) +- **exchange**: fix connection timeout (#126) + +### Documentation +- update API documentation (#127) +``` + +--- + +## 🎓 学习资源 + +- **Conventional Commits 官网:** https://www.conventionalcommits.org/ +- **Angular Commit Guidelines:** https://github.com/angular/angular/blob/main/CONTRIBUTING.md#commit +- **Semantic Versioning:** https://semver.org/ + +--- + +## ❓ FAQ + +### Q: 我必须遵循这个格式吗？ + +**A:** 不必须。这是建议性的，不会阻止你的 PR 被合并。但遵循格式可以提高项目的可维护性。 + +### Q: 如果我忘记了怎么办？ + +**A:** 机器人会在 PR 中提醒你，你可以随时更新标题。 + +### Q: 我可以在一个 PR 中做多种类型的变更吗？ + +**A:** 可以，但建议： +- 选择最主要的类型 +- 或者考虑拆分成多个 PR（更易于审查） + +### Q: Scope 可以省略吗？ + +**A:** 可以。`requireScope: false` 表示 scope 是可选的。 + +示例：`docs: update README` （没有 scope 也可以） + +### Q: 我想添加新的 type 或 scope，怎么做？ + +**A:** 提一个 PR 修改 `.github/workflows/pr-checks.yml`，并在本文档中说明新增项的用途。 + +### Q: Breaking Changes 怎么表示？ + +**A:** 在描述中添加 `BREAKING CHANGE:` 或在 type 后加 `!`： + +``` +feat!: remove deprecated API +feat(api)!: change authentication method + +BREAKING CHANGE: The old /auth endpoint is removed +``` + +--- + +## 📊 统计 + +想看项目的 commit 类型分布？运行： + +```bash +git log --oneline --no-merges | \ + grep -oE '^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|chore|ci|security|build)' | \ + cut -d' ' -f2 | sort | uniq -c | sort -rn +``` + +--- + +## ✅ 快速检查清单 + +在提交 PR 前，检查你的标题是否： + +- [ ] 包含有效的 type（feat, fix, docs 等） +- [ ] 使用小写字母开头 +- [ ] 使用现在时态（"add" 而不是 "added"） +- [ ] 简洁明了（最好在 50 字符内） +- [ ] 准确描述了变更内容 + +**记住：** 这些都是建议，不是强制要求！ diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 8fd87aeb..8d6a71b0 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,153 +1,288 @@ -# Pull Request +# Pull Request | PR 提交 -## 📝 Description +> **💡 提示 Tip:** 推荐 PR 标题格式 Recommended PR title format: `type(scope): description` +> 例如 Examples: `feat(trader): add new strategy` | `fix(api): resolve auth issue` +> 详情 Details: [PR Title Guide](./PR_TITLE_GUIDE.md) + +--- + +## 📝 Description | 描述 + -## 🎯 Type of Change +**English:** + +**中文：** + +--- + +## 🎯 Type of Change | 变更类型 + -- [ ] 🐛 Bug fix (non-breaking change which fixes an issue) -- [ ] ✨ New feature (non-breaking change which adds functionality) -- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected) -- [ ] 📝 Documentation update -- [ ] 🎨 Code style update (formatting, renaming) -- [ ] ♻️ Refactoring (no functional changes) -- [ ] ⚡ Performance improvement -- [ ] ✅ Test update -- [ ] 🔧 Build/config change +- [ ] 🐛 Bug fix | 修复 Bug（不影响现有功能的修复） +- [ ] ✨ New feature | 新功能（不影响现有功能的新增） +- [ ] 💥 Breaking change | 破坏性变更（会导致现有功能无法正常工作的修复或功能） +- [ ] 📝 Documentation update | 文档更新 +- [ ] 🎨 Code style update | 代码样式更新（格式化、重命名等） +- [ ] ♻️ Refactoring | 重构（无功能变更） +- [ ] ⚡ Performance improvement | 性能优化 +- [ ] ✅ Test update | 测试更新 +- [ ] 🔧 Build/config change | 构建/配置变更 +- [ ] 🔒 Security fix | 安全修复 -## 🔗 Related Issues +--- + +## 🔗 Related Issues | 相关 Issue + -- Closes # -- Related to # +- Closes # | 关闭 # +- Related to # | 相关 # -## 📋 Changes Made +--- + +## 📋 Changes Made | 具体变更 + +**English:** - Change 1 - Change 2 - Change 3 -## 🧪 Testing +**中文：** +- 变更 1 +- 变更 2 +- 变更 3 -### Manual Testing +--- + +## 🧪 Testing | 测试 + +### Manual Testing | 手动测试 + -- [ ] Tested locally (manual verification) -- [ ] Tested on testnet (for exchange integrations) -- [ ] Tested with different configurations -- [ ] Verified no existing functionality broke +- [ ] Tested locally | 本地测试通过 +- [ ] Tested on testnet | 测试网测试通过（交易所集成相关） +- [ ] Tested with different configurations | 测试了不同配置 +- [ ] Verified no existing functionality broke | 确认没有破坏现有功能 -### Test Environment +### Test Environment | 测试环境 -- **OS:** [e.g. macOS, Ubuntu] -- **Go Version:** [e.g. 1.21.5] -- **Exchange:** [if applicable] +- **OS | 操作系统:** [e.g. macOS, Ubuntu, Windows] +- **Go Version | Go 版本:** [e.g. 1.21.5] +- **Node Version | Node 版本:** [e.g. 18.x] (if applicable | 如适用) +- **Exchange | 交易所:** [if applicable | 如适用] -### Test Results +### Test Results | 测试结果 + ``` -Test output here +Test output here | 测试输出 ``` -## 📸 Screenshots / Demo +--- + +## 📸 Screenshots / Demo | 截图/演示 + + -**Before:** +**Before | 变更前:** -**After:** +**After | 变更后:** -## ✅ Checklist +--- + +## ✅ Checklist | 检查清单 + -### Code Quality +### Code Quality | 代码质量 -- [ ] My code follows the project's code style ([Contributing Guide](../CONTRIBUTING.md)) -- [ ] I have performed a self-review of my code -- [ ] I have commented my code, particularly in hard-to-understand areas -- [ ] My changes generate no new warnings or errors -- [ ] Code compiles successfully (`go build` / `npm run build`) -- [ ] I have run `go fmt` (for Go code) +- [ ] My code follows the project's code style | 我的代码遵循项目代码风格 ([Contributing Guide](../CONTRIBUTING.md)) +- [ ] I have performed a self-review of my code | 我已进行代码自查 +- [ ] I have commented my code, particularly in hard-to-understand areas | 我已添加代码注释，特别是难以理解的部分 +- [ ] My changes generate no new warnings or errors | 我的变更没有产生新的警告或错误 +- [ ] Code compiles successfully | 代码编译成功 (`go build` / `npm run build`) +- [ ] I have run `go fmt` (for Go code) | 我已运行 `go fmt`（Go 代码） +- [ ] I have run `npm run lint` (for frontend code) | 我已运行 `npm run lint`（前端代码） -### Testing +### Testing | 测试 -- [ ] I have added tests that prove my fix is effective or that my feature works -- [ ] New and existing unit tests pass locally -- [ ] I have tested on testnet (for trading/exchange changes) +- [ ] I have added tests that prove my fix is effective or that my feature works | 我已添加证明修复有效或功能正常的测试 +- [ ] New and existing unit tests pass locally | 新旧单元测试在本地通过 +- [ ] I have tested on testnet (for trading/exchange changes) | 我已在测试网测试（交易/交易所变更） +- [ ] Integration tests pass | 集成测试通过 -### Documentation +### Documentation | 文档 -- [ ] I have updated the documentation accordingly -- [ ] I have updated the README if needed -- [ ] I have added inline code comments where necessary -- [ ] I have updated type definitions (for TypeScript changes) +- [ ] I have updated the documentation accordingly | 我已相应更新文档 +- [ ] I have updated the README if needed | 我已更新 README（如需要） +- [ ] I have added inline code comments where necessary | 我已在必要处添加代码注释 +- [ ] I have updated type definitions (for TypeScript changes) | 我已更新类型定义（TypeScript 变更） +- [ ] I have updated API documentation (if applicable) | 我已更新 API 文档（如适用） ### Git -- [ ] My commits follow the conventional commits format (`feat:`, `fix:`, etc.) -- [ ] I have rebased my branch on the latest `dev` branch -- [ ] There are no merge conflicts +- [ ] My commits follow the conventional commits format | 我的提交遵循 Conventional Commits 格式 (`feat:`, `fix:`, etc.) +- [ ] I have rebased my branch on the latest `dev` branch | 我已将分支 rebase 到最新的 `dev` 分支 +- [ ] There are no merge conflicts | 没有合并冲突 +- [ ] Commit messages are clear and descriptive | 提交信息清晰明确 -## 🔒 Security Considerations +--- + +## 🔒 Security Considerations | 安全考虑 + -- [ ] No API keys or secrets are hardcoded -- [ ] User inputs are properly validated -- [ ] No SQL injection vulnerabilities introduced -- [ ] Authentication/authorization properly handled -- [ ] N/A (not security-related) +- [ ] No API keys or secrets are hardcoded | 没有硬编码 API 密钥或密钥 +- [ ] User inputs are properly validated | 用户输入已正确验证 +- [ ] No SQL injection vulnerabilities introduced | 未引入 SQL 注入漏洞 +- [ ] No XSS vulnerabilities introduced | 未引入 XSS 漏洞 +- [ ] Authentication/authorization properly handled | 认证/授权已正确处理 +- [ ] Sensitive data is encrypted | 敏感数据已加密 +- [ ] N/A (not security-related) | 不适用（非安全相关） -## ⚡ Performance Impact +--- + +## ⚡ Performance Impact | 性能影响 + -- [ ] No significant performance impact -- [ ] Performance improved -- [ ] Performance may be impacted (explain below) +- [ ] No significant performance impact | 无显著性能影响 +- [ ] Performance improved | 性能提升 +- [ ] Performance may be impacted (explain below) | 性能可能受影响（请在下方说明） + -## 📚 Additional Notes +**English:** + +**中文：** + +--- + +## 🌐 Internationalization | 国际化 + + + + +- [ ] All user-facing text supports i18n | 所有面向用户的文本支持国际化 +- [ ] Both English and Chinese versions provided | 提供了中英文版本 +- [ ] N/A | 不适用 + +--- + +## 📚 Additional Notes | 补充说明 + + +**English:** + +**中文：** --- -## For Bounty Claims +## 💰 For Bounty Claims | 赏金申请 + -- [ ] This PR is for bounty issue # -- [ ] All acceptance criteria from the bounty issue are met -- [ ] I have included a demo video/screenshots -- [ ] I am ready for payment upon merge +- [ ] This PR is for bounty issue # | 此 PR 用于赏金 issue # +- [ ] All acceptance criteria from the bounty issue are met | 满足赏金 issue 的所有验收标准 +- [ ] I have included a demo video/screenshots | 我已包含演示视频/截图 +- [ ] I am ready for payment upon merge | 我准备好在合并后接收付款 -**Payment Details:** +**Payment Details | 付款详情:** --- -## 🙏 Reviewer Notes +## 🙏 Reviewer Notes | 审查者注意事项 + + +**English:** + +**中文：** + +--- + +## 📋 PR Size Estimate | PR 大小估计 + + + + +- [ ] 🟢 Small (< 100 lines) | 小（< 100 行） +- [ ] 🟡 Medium (100-500 lines) | 中（100-500 行） +- [ ] 🔴 Large (> 500 lines) | 大（> 500 行） + + + + + + + +--- + +## 🎯 Review Focus Areas | 审查重点 + + + + +Please pay special attention to: +请特别注意： + +- [ ] Logic changes | 逻辑变更 +- [ ] Security implications | 安全影响 +- [ ] Performance optimization | 性能优化 +- [ ] API changes | API 变更 +- [ ] Database schema changes | 数据库架构变更 +- [ ] UI/UX changes | UI/UX 变更 --- **By submitting this PR, I confirm that:** -- [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md) -- [ ] I agree to the [Code of Conduct](../CODE_OF_CONDUCT.md) -- [ ] My contribution is licensed under the MIT License +**提交此 PR，我确认：** + +- [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md) | 我已阅读[贡献指南](../CONTRIBUTING.md) +- [ ] I agree to the [Code of Conduct](../CODE_OF_CONDUCT.md) | 我同意[行为准则](../CODE_OF_CONDUCT.md) +- [ ] My contribution is licensed under the MIT License | 我的贡献遵循 MIT 许可证 +- [ ] I understand this is a voluntary contribution | 我理解这是自愿贡献 +- [ ] I have the right to submit this code | 我有权提交此代码 + +--- + + diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 1110c69d..5eb6f985 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -9,6 +9,7 @@ This directory contains the GitHub Actions workflows for the NOFX project. - **[TRIGGERS.md](./TRIGGERS.md)** - Comparison of event triggers (pull_request vs pull_request_target vs workflow_run) - **[FORK_PR_FLOW.md](./FORK_PR_FLOW.md)** - Complete analysis of what happens when a fork PR is submitted - **[FLOW_DIAGRAM.md](./FLOW_DIAGRAM.md)** - Visual flow diagrams and quick reference +- **[SECRETS_SCANNING.md](./SECRETS_SCANNING.md)** - Secrets scanning solutions and TruffleHog setup ## 🚀 Quick Start diff --git a/.github/workflows/pr-checks-run.yml b/.github/workflows/pr-checks-run.yml index eacee17b..d228bb44 100644 --- a/.github/workflows/pr-checks-run.yml +++ b/.github/workflows/pr-checks-run.yml @@ -23,13 +23,13 @@ jobs: run: | PR_TITLE="${{ github.event.pull_request.title }}" - # Check if title follows conventional commits - if echo "$PR_TITLE" | grep -qE "^(feat|fix|docs|style|refactor|perf|test|chore|ci|security)(\(.+\))?: .+"; then + # Check if title follows conventional commits (expanded type list) + if echo "$PR_TITLE" | grep -qE "^(feat|fix|docs|style|refactor|perf|test|chore|ci|security|build)(\(.+\))?: .+"; then echo "status=✅ Good" >> $GITHUB_OUTPUT echo "message=PR title follows Conventional Commits format" >> $GITHUB_OUTPUT else echo "status=⚠️ Suggestion" >> $GITHUB_OUTPUT - echo "message=Consider using Conventional Commits format: type(scope): description" >> $GITHUB_OUTPUT + echo "message=Consider using format: type(scope): description. Valid types: feat, fix, docs, style, refactor, perf, test, chore, ci, security, build" >> $GITHUB_OUTPUT fi - name: Calculate PR size and save results diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 3e285920..0ad42e28 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -23,6 +23,8 @@ jobs: # Inherits workflow-level permissions (contents: read, pull-requests: write, issues: write) steps: - name: Check PR title format + id: semantic-pr + continue-on-error: true # Don't block PR if title format is invalid uses: amannn/action-semantic-pull-request@v5 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -38,6 +40,7 @@ jobs: chore ci security + build scopes: | exchange trader @@ -48,8 +51,67 @@ jobs: backend security deps + workflow + github + actions + config + docker + build + release requireScope: false + - name: Comment on invalid PR title + if: steps.semantic-pr.outcome == 'failure' + uses: actions/github-script@v7 + continue-on-error: true # Don't fail for fork PRs + with: + script: | + const prTitle = context.payload.pull_request.title; + const isFork = context.payload.pull_request.head.repo.full_name !== context.payload.pull_request.base.repo.full_name; + + const comment = [ + '## ⚠️ PR Title Format Suggestion', + '', + "Your PR title doesn't follow the Conventional Commits format, but **this won't block your PR from being merged**.", + '', + `**Current title:** \`${prTitle}\``, + '', + '**Recommended format:** `type(scope): description`', + '', + '### Valid types:', + '`feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`, `security`, `build`', + '', + '### Common scopes (optional):', + '`exchange`, `trader`, `ai`, `api`, `ui`, `frontend`, `backend`, `security`, `deps`, `workflow`, `github`, `actions`, `config`, `docker`, `build`, `release`', + '', + '### Examples:', + '- `feat(trader): add new trading strategy`', + '- `fix(api): resolve authentication issue`', + '- `docs: update README`', + '- `chore(deps): update dependencies`', + '- `ci(workflow): improve GitHub Actions`', + '', + '**Note:** This is a suggestion to improve consistency. Your PR can still be reviewed and merged.', + '', + '---', + '*This is an automated comment. You can update the PR title anytime.*' + ].join('\n'); + + if (!isFork) { + try { + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.pull_request.number, + body: comment + }); + } catch (error) { + console.log('Could not post comment (expected for fork PRs):', error.message); + } + } else { + console.log('Fork PR - comment will be posted by pr-checks-comment.yml'); + } + - name: Check PR size uses: actions/github-script@v7 continue-on-error: true # Don't fail for fork PRs @@ -250,10 +312,13 @@ jobs: with: fetch-depth: 0 - - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Run TruffleHog OSS + uses: trufflesecurity/trufflehog@main + with: + path: ./ + base: ${{ github.event.pull_request.base.sha }} + head: ${{ github.event.pull_request.head.sha }} + extra_args: --debug --only-verified # All checks passed all-checks: @@ -266,9 +331,24 @@ jobs: steps: - name: Check all jobs run: | - if [ "${{ contains(needs.*.result, 'failure') }}" == "true" ]; then - echo "Some checks failed" + # Note: validate-pr uses continue-on-error, so it won't block even if title format is invalid + # We only care about actual test failures + echo "validate-pr: ${{ needs.validate-pr.result }}" + echo "backend-tests: ${{ needs.backend-tests.result }}" + echo "frontend-tests: ${{ needs.frontend-tests.result }}" + echo "security-check: ${{ needs.security-check.result }}" + echo "secrets-check: ${{ needs.secrets-check.result }}" + + # Check if any critical checks failed (excluding validate-pr which is advisory) + if [[ "${{ needs.backend-tests.result }}" == "failure" ]] || \ + [[ "${{ needs.frontend-tests.result }}" == "failure" ]] || \ + [[ "${{ needs.security-check.result }}" == "failure" ]] || \ + [[ "${{ needs.secrets-check.result }}" == "failure" ]]; then + echo "❌ Critical checks failed" exit 1 else - echo "All checks passed!" + echo "✅ All critical checks passed!" + if [[ "${{ needs.validate-pr.result }}" != "success" ]]; then + echo "ℹ️ Note: PR title format check is advisory only and doesn't block merging" + fi fi