Problem:
- The `reviewers_add`/`reviewers_remove` CI jobs checkout the repo only
for the purpose of `require('…/reviewers_add.js')`.
- `reviewers_remove` also runs on `closed`, so a merged fork PR will trip
the new allow-unsafe-pr-checkout guard of `actions/checkout@v7`.
Solution:
- Drop the use of `actions/checkout`.
- Inline the script in the CI yaml definitions.
- Also await the mutating calls (previously fire-and-forget) and guard
empty reviewer lists.
Problem:
The backport workflow started failing since we updated to v7 of
`actions/checkout@v7.0.0`. The workflow runs on `pull_request_target`
(closed + merged) and failed with:
Refusing to check out fork pull request code from a 'pull_request_target'
workflow. Review the risks at https://gh.io/securely-using-pull_request_target
Example: https://github.com/neovim/neovim/actions/runs/28161004305
Analysis:
v7.0.0 added the `allow-unsafe-pr-checkout` guard, which refuses when the
resolved checkout SHA matches the PR's head.sha *or* merge_commit_sha. With no
explicit `ref`, checkout resolves to the base branch tip (`github.sha`). For a
merged PR that tip *is* the merge commit, so the guard refuses even
though it is already-merged trusted base code, not live fork code.
Solution:
Checkout the base branch by name. A branch ref is neither a SHA nor
a `refs/pull/*` ref, so the guard passes. This is also semantically more
correct: backports should branch off the ref the PR merged into.
ci: bump actions/checkout in the github-actions group across 1 directory
Bumps the github-actions group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout).
Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This is in preparation of zig 0.17 where b.install_path is no
longer known inside `pub fn build()`.
Builds which should hardcode a runtime path into the binary has to specify it.
We could use a nlua0 helper to encode the install path at build time but
I think this is cleaner anyway. (like currently the appimage still
encodes a temporary build path which is nonsensical, it is better to
just include none)
Similarily b.args will not be available anymore (there will just
be an opaque pass-through)
The new lua based runner replaces Makefile, runnvim.sh and runnvim.vim
As it happens, we run a `--headless` nvim inside a `:terminal` layer,
this is pointless.
Also there is still a lot remnants for oldesttests, but we don't
have any except for test1.in which just checks the environment
for following, nonexistant oldesttests. so just skip that.
For now, the actual vimscript code which runs in vim-under-test is
completely unchanged.
On macos, luajit is finally working with the latest ziglua master.
Also fix some minor bugs regarding locales, such as incorrect
HAVE_WORKING_LIBINTL checks
Problem: The `with-external-deps` workflow keeps failing because
adding the neovim-ppa/stable times out.
Solution: Don't add the PPA; it doesn't look to be necessary for
installing current dependencies.
Problem: Optional CI reevaluates on unrelated label events and shares
one workflow-wide concurrency group. One optional label change can
cancel in-flight jobs for the other optional suite.
Solution: Only reevaluate each optional job when its own label changes,
and move concurrency to the job level. This keeps `s390x` and
`windows-asan` from restarting each other.
Problem: The reviewer assignment workflow can run multiple times for
the same PR.
Solution: Ensure only the newest review-assignment run continues with
workflow concurrency.
Problem:
When auto-backport fails, it adds a `needs:backport` label. But that
label isn't being used AFAIK, based on the fact there were 30+ old PRs
with that label from last year (I have since cleaned those up). So the
extra step of having to remove the label is unnecessary friction.
In practice, when a manual backport is needed, it's best to either do it
immediately or just remove the `backport-xx` label.
Also, the presence of an unresolved "Failed backport" comment from the
bot is already a kind of marker that indicates a backport is needed.
Solution:
Don't add `needs:backport` label on failed backport.
Reverts https://github.com/neovim/neovim/pull/30363
Problem:
- Choosing a new EXX error code is tedious.
- It's possible to accidentally use an EXX error code for different
purposes.
Solution:
Add a lint check which requires EXX error codes to have a :help tag.
This also avoids duplicates because `make doc` does `:helptags ++t doc`
which fails if duplicates are found.
Replace the busted-based Lua test runner with a repo-local harness.
The new harness runs spec files directly under `nvim -ll`, ships its own
reporter and lightweight `luassert` shim, and keeps the helper/preload
flow used by the functional and unit test suites.
Keep the file boundary model shallow and busted-like by restoring `_G`,
`package.loaded`, `package.preload`, `arg`, and the process environment
between files, without carrying extra reset APIs or custom assertion
machinery.
Update the build and test entrypoints to use the new runner, add
black-box coverage for the harness itself, and drop the bundled
busted/luacheck dependency path.
AI-assisted: Codex
Add a simple AGENTS.md rule for the AI-Assisted trailer in commit
messages and a workflow that adds the AI assisted label when PR commits
include that trailer.
AI-Assisted: Codex
Add workflow that runs Zizmor, a static analysis tool for GitHub
Actions. This will automatically flag various common security issues
with CI workflows.
Replace all template expansions in code contexts with environment
variable substitutions. Template expansion in code contexts can be a
source of code injection vulnerabilities; for more info, see:
https://docs.zizmor.sh/audits/#template-injection
The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
Set `persist-credentials: false` for all uses of `actions/checkout`.
This prevents git credentials from being stored on disk, and fixes the
following Zizmor audit:
https://docs.zizmor.sh/audits/#artipacked
This improves CI security by ensuring that action dependencies cannot be
changed by upstream repositories without updating the use of the
dependency in this repo.
Official GitHub-maintained actions are excluded from this requirement
and are left pinned by a tag instead of a commit hash. This action
dependency pinning policy is codified in `.github/zizmor.yml` so that
Zizmor (a static analysis tool for GitHub Actions) doesn't flag these as
unpinned dependencies.
Also add cooldown timer for Dependabot. This fixes these two Zizmor
audits:
* https://docs.zizmor.sh/audits/#dependabot-cooldown
* https://docs.zizmor.sh/audits/#unpinned-uses
Try this since Cirrus CI ran out of compute credits last month.
Previously the tests use less than 1 CPU out of the 2 provided by Cirrus
runner. I'm not sure if CPU usage is taken into account when counting
compute credits, or if it always fully counts the 2 CPUs. But perhaps
this will help in either case?
- Use double underscores for the group targets as these targets usually
shouldn't be used directly.
- Use dash instead of underscore in the two targets that need to be used
directly. I'm not entirely sure about this, as both chars are used in
many targets, but a dash is easier to type than an underscore.
