ci: modernize workflows, governance, and CI quality gates#344
Merged
Conversation
Remove deprecated bot workflows (labeler, lock, pr-labels, rebase, stale, legacy zunit). Add CodeQL v4 with actions-only scan. Add ZD integration test workflow (calls z-shell/zd reusable test). Add commit-lint, PR title validation, and branch naming checks. SHA-pin all external actions. Restructure CODEOWNERS: default owner @ss-o, core runtime (zi.zsh, lib/) requires @z-shell/tsc, CI/docs @ss-o only, CODEOWNERS itself protected by @z-shell/tsc. Update copilot-instructions.md, CONTRIBUTING.md, PR template with correct code block fencing and Conventional Commits guidance. Fix docs/README.md badge link typos.
There was a problem hiding this comment.
Pull request overview
This PR modernizes the zi repository’s CI/workflow setup and governance docs by removing deprecated bot automation, adding new quality gates (CodeQL, commit/PR linting, and reusable ZD integration tests), and tightening workflow security defaults (SHA pinning, permissions, concurrency).
Changes:
- Replace/remove legacy maintenance/bot workflows and add new workflows for CodeQL scanning, Conventional Commits/branch naming validation, and ZD-based ZUnit integration testing.
- Harden existing workflows by SHA-pinning
actions/checkout, adding minimalpermissions, and enabling concurrency cancellation. - Update governance and contributor-facing documentation/templates (CODEOWNERS, PR template, contributing guide, Copilot instructions), plus minor doc and completion cleanup.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
lib/_zi |
Fixes a Zsh setopt option typo in the completion script. |
docs/README.md |
Fixes badge/link markup and HTML attribute typos. |
docs/CONTRIBUTING.md |
Expands contribution guidelines (branch model + Conventional Commits). |
.github/workflows/zunit.yml |
Removes legacy in-repo ZUnit workflow (replaced by ZD integration). |
.github/workflows/zsh-n.yml |
Adds concurrency + read-only permissions; SHA-pins checkout. |
.github/workflows/zd-integration.yml |
Adds reusable ZD workflow invocation for integration tests. |
.github/workflows/trunk-check.yml |
Runs on next as well; SHA-pins checkout. |
.github/workflows/stale.yml |
Removes stale bot workflow. |
.github/workflows/rebase.yml |
Removes comment-driven rebase automation workflow. |
.github/workflows/pr-labels.yml |
Removes PR label enforcement workflow. |
.github/workflows/lock.yml |
Removes lock-threads bot workflow. |
.github/workflows/labeler.yml |
Removes PR labeler workflow. |
.github/workflows/commit-lint.yml |
Adds commit/PR title/branch naming validation workflow. |
.github/workflows/codeql.yml |
Adds SHA-pinned CodeQL v4 workflow (actions-only scan). |
.github/PULL_REQUEST_TEMPLATE.md |
Updates PR template to reflect branch/commit conventions and checklist. |
.github/labeler.yml |
Removes labeler configuration (no longer used). |
.github/dependabot.yml |
Retargets Dependabot to next and reduces cadence to weekly. |
.github/copilot-instructions.md |
Adds repository Copilot instructions (conventions/branch model/style). |
.github/CODEOWNERS |
Refines ownership rules by area and protects CODEOWNERS changes. |
Comments suppressed due to low confidence (3)
docs/CONTRIBUTING.md:37
- This code block also uses an invalid closing fence (```text). In Markdown, the closing fence should be only backticks (no language), and it should match the opening fence length.
```text
type(scope): short description
Optional body — explain what and why, not how.
Wrap at 72 characters.
Optional footer(s):
Fixes #123
BREAKING CHANGE: description of what breaks
```text
docs/CONTRIBUTING.md:60
- The file ends with a standalone four-backtick fence. As written (given earlier mismatched fences), this will leave the remainder of the document inside a code block in some renderers. After fixing the earlier code fences, ensure the final fence is either removed or is the correct matching close for an opened ````text block.
See also the [community contributing guidelines](https://github.com/z-shell/community/blob/main/docs/CONTRIBUTING_GUIDELINES.md) and the [Code of Conduct](CODE_OF_CONDUCT.md).
**.github/copilot-instructions.md:55**
* The Branch model code block closes with "```text"; closing fences must not include an info string. Use a proper closing fence (```), matching the opening fence length.
main ← production releases (tags only, squash-merged from next)
next ← integration branch (PR target for all work)
└─ feat/<name> feature branches
└─ fix/<name> bug-fix branches
└─ perf/<name> performance improvements
└─ docs/<name> documentation updates
└─ ci/<name> CI/workflow changes
└─ chore/<name> maintenance, refactors
```text
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+7
to
+18
| ````text | ||
| main ←─── production (tagged releases only) | ||
| ↑ | ||
| next ←─── integration branch ← open all PRs here | ||
| ↑ | ||
| ├── feat/<name> new features | ||
| ├── fix/<name> bug fixes | ||
| ├── perf/<name> performance improvements | ||
| ├── refactor/<name> code refactors | ||
| ├── docs/<name> documentation updates | ||
| └── ci/<name> CI / workflow changes | ||
| ```text |
Comment on lines
+30
to
+41
| ````text | ||
| feat(loader): add lazy-loading for completions | ||
|
|
||
| Defer completion setup until first TAB press to cut startup time | ||
| for users with large fpath trees. | ||
|
|
||
| BREAKING CHANGE: ZI_COMPLETION_LAZY must be set before zi is sourced. | ||
| ```text | ||
|
|
||
| ```text | ||
| fix(self-update): correctly set exit code on network failure | ||
| ```text |
| subject=$(git show -s --format='%s' "$sha") | ||
| checked=$((checked + 1)) | ||
|
|
||
| if ! echo "$subject" | grep -qE "$CONVENTIONAL_PATTERN"; then |
Comment on lines
+31
to
+59
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | ||
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | ||
| DISALLOWED_TRAILER_PATTERN: ${{ secrets.DISALLOWED_TRAILER_PATTERN }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| CONVENTIONAL_PATTERN='^(feat|fix|perf|refactor|docs|test|ci|chore|revert)(\([^)]+\))?!?: .{1,72}$' | ||
|
|
||
| errors=0 | ||
| checked=0 | ||
|
|
||
| while IFS= read -r sha; do | ||
| parent_count=$(git cat-file -p "$sha" | grep -c '^parent' || true) | ||
| [ "$parent_count" -gt 1 ] && continue | ||
|
|
||
| subject=$(git show -s --format='%s' "$sha") | ||
| checked=$((checked + 1)) | ||
|
|
||
| if ! echo "$subject" | grep -qE "$CONVENTIONAL_PATTERN"; then | ||
| echo "❌ Invalid commit message (${sha:0:7}): expected type(scope): description ≤72 chars" | ||
| errors=$((errors + 1)) | ||
| fi | ||
|
|
||
| if [ -n "${DISALLOWED_TRAILER_PATTERN:-}" ]; then | ||
| if git show -s --format='%B' "$sha" | grep -qE "$DISALLOWED_TRAILER_PATTERN"; then | ||
| echo "❌ Disallowed trailer found (${sha:0:7}): remove before merging" | ||
| errors=$((errors + 1)) | ||
| fi | ||
| fi |
| ├── perf/<name> performance improvements | ||
| ├── refactor/<name> code refactors | ||
| ├── docs/<name> documentation updates | ||
| └── ci/<name> CI / workflow changes |
|
Pull Request closed and locked due to lack of activity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Modernize the zi repository's CI, governance files, and quality gates.
Supersedes #341 — this PR contains only the CI and governance changes; the core
runtime fixes (autoload.zsh, zi.zsh) will be submitted separately.
Changes
Workflow removals (deprecated bot workflows):
labeler.yml,lock.yml,pr-labels.yml,rebase.yml,stale.yml,zunit.yml.github/labeler.yml(repo-level config)New workflows:
codeql.yml— CodeQL v4 withactions-only scan; SHA-pinned; replaces GitHub Default Setup which incorrectly detected JS/TScommit-lint.yml— Validates Conventional Commits format, PR title, branch naming, and blocks AI co-author trailerszd-integration.yml— Callsz-shell/zdreusable ZUnit test suite against the PR's branch refUpdated workflows:
trunk-check.yml,zsh-n.yml— SHA-pinactions/checkout@v4; addpermissions: contents: read; add concurrency cancelGovernance:
.github/CODEOWNERS— Restructured: default@ss-o, core runtime@z-shell/tsc, CI/docs@ss-o, CODEOWNERS itself@z-shell/tsccopilot-instructions.md— Added; defines Conventional Commits, branch model, AI-file policy, code stylePULL_REQUEST_TEMPLATE.md,CONTRIBUTING.md— Fix code block fencing (Trunk MD040), add checklistdocs/README.md— Fix badge link typos;lib/_zi— minor cleanupRelated issues
Closes #341
Type of change
ci— CI/workflow changechore— maintenance / dependency bumpChecklist
next(notmain)nextbranchzsh -n zi.zsh/ Trunk checks)