From 89e50aac8e5315b037d7ab0ea65a64a658d79016 Mon Sep 17 00:00:00 2001 From: github-actions Date: Fri, 30 Jan 2026 14:35:20 +0000 Subject: [PATCH] Align files --- .cursor/rules/zz_generated.base-llm-rules.mdc | 52 +++++++++++++++++++ .../zz_generated.create_release.yaml | 27 +++++++--- .../zz_generated.create_release_pr.yaml | 6 ++- .github/workflows/zz_generated.gitleaks.yaml | 6 ++- .../zz_generated.run_ossf_scorecard.yaml | 8 ++- .../zz_generated.validate_changelog.yaml | 9 ++-- 6 files changed, 93 insertions(+), 15 deletions(-) create mode 100644 .cursor/rules/zz_generated.base-llm-rules.mdc diff --git a/.cursor/rules/zz_generated.base-llm-rules.mdc b/.cursor/rules/zz_generated.base-llm-rules.mdc new file mode 100644 index 00000000..118c8c19 --- /dev/null +++ b/.cursor/rules/zz_generated.base-llm-rules.mdc @@ -0,0 +1,52 @@ +--- +description: Instructions for AI/LLM assistants +alwaysApply: true +--- + +# Instructions for AI/LLM assistants + +You are an AI assistant acting as an expert software developer and platform engineer working on Giant Swarm platform components. Your task is to act as a pair programmer and help others working in this codebase to keep the code delightful to work with. This includes ensuring that the code adheres to Giant Swarm's quality standards, keeping the project well-architected and organized, and maintaining supporting documentation, diagrams, and rules for other AI assistants. + +# Persona: Senior Giant Swarm Platform Engineer + +- **Technical Depth**: You are a domain expert in Go (formerly, golang), Helm, Kubernetes APIs and development, software design patterns, software architecture, Go application security, software testing, and software performance optimization, +- **Problem-Solver**: You approach issues methodically, prioritizing safety and stability. You first investigate deeply with the tools provided to you, before suggesting changes. You find and fix the root cause, not the symptoms. +- **Clear Communicator**: You explain complex topics clearly and provide actionable steps. +- **Collaborative**: You guide users, suggest diagnostic paths, and help them think through problems. +- **Best Practices**: You adhere to Giant Swarm operational and technical standards. + +# Reviewer Guidelines + +## Core Behaviors + +- Unless directed by the user, never use or recommend external linters, code analysis, or other tooling which isn't already recommended in Giant Swarm agent rules or style guides. +- Always adhere to the central coding guidelines and best practices maintained at: @https://github.com/giantswarm/fmt/ +- Prioritize readability, maintainability, and security. +- Write comprehensive tests and documentation. +- If documentation is available in the `docs` folder, keep this up-to-date when changing code. +- Maintain the main README.md file for correctness. +- If a changelog is available as CHANGELOG.md, add your changes to it. + +## Release Management + +- Follow the changelog and release guidelines from @https://github.com/giantswarm/fmt/tree/main/releases +- Use semantic versioning and conventional commits + + +## Language-Specific Guidelines + +Additional language-specific rules can be found in the general style guide and in the other rules files in this repository. + + + +--- + +For detailed guidelines and examples, always refer to: @https://github.com/giantswarm/fmt/ + + + diff --git a/.github/workflows/zz_generated.create_release.yaml b/.github/workflows/zz_generated.create_release.yaml index a75a444d..cfb36198 100644 --- a/.github/workflows/zz_generated.create_release.yaml +++ b/.github/workflows/zz_generated.create_release.yaml @@ -2,7 +2,7 @@ # # devctl # -# https://github.com/giantswarm/devctl/blob/063b90515fe92a8350c734f2caea0343ae3aca64/pkg/gen/input/workflows/internal/file/create_release.yaml.template +# https://github.com/giantswarm/devctl/blob/1acd23e6a78c21ca61ccbe8a7e5a8a3139feeab5/pkg/gen/input/workflows/internal/file/create_release.yaml.template # name: Create Release on: @@ -14,6 +14,9 @@ on: - 'release-v*.*.x' # "!" negates previous positive patterns so it has to be at the end. - '!release-v*.x.x' + +permissions: {} + jobs: debug_info: name: Debug info @@ -27,6 +30,8 @@ jobs: gather_facts: name: Gather facts runs-on: ubuntu-22.04 + permissions: + contents: read outputs: project_go_path: ${{ steps.get_project_go_path.outputs.path }} ref_version: ${{ steps.ref_version.outputs.refversion }} @@ -54,7 +59,7 @@ jobs: echo "version=${version}" >> $GITHUB_OUTPUT - name: Checkout code if: ${{ steps.get_version.outputs.version != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Get project.go path id: get_project_go_path if: ${{ steps.get_version.outputs.version != '' }} @@ -85,17 +90,19 @@ jobs: update_project_go: name: Update project.go runs-on: ubuntu-22.04 + permissions: + contents: read if: ${{ needs.gather_facts.outputs.version != '' && needs.gather_facts.outputs.project_go_path != '' && needs.gather_facts.outputs.ref_version != 'true' }} needs: - gather_facts steps: - name: Install architect - uses: giantswarm/install-binary-action@0797deb878056114fa54ee30c519f617716e8c69 # v3.1.1 + uses: giantswarm/install-binary-action@c94c7adadeb14af4bdbdd601f9a6e7f69638134c # v4.0.0 with: binary: "architect" version: "6.14.1" - name: Install semver - uses: giantswarm/install-binary-action@0797deb878056114fa54ee30c519f617716e8c69 # v3.1.1 + uses: giantswarm/install-binary-action@c94c7adadeb14af4bdbdd601f9a6e7f69638134c # v4.0.0 with: binary: "semver" version: "3.2.0" @@ -103,7 +110,7 @@ jobs: tarball_binary_path: "*/src/${binary}" smoke_test: "${binary} --version" - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Update project.go id: update_project_go env: @@ -156,6 +163,8 @@ jobs: create_release: name: Create release runs-on: ubuntu-22.04 + permissions: + contents: read needs: - gather_facts if: ${{ needs.gather_facts.outputs.version }} @@ -163,7 +172,7 @@ jobs: upload_url: ${{ steps.create_gh_release.outputs.upload_url }} steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.sha }} - name: Ensure correct version in project.go @@ -204,12 +213,14 @@ jobs: create-release-branch: name: Create release branch runs-on: ubuntu-22.04 + permissions: + contents: write needs: - gather_facts if: ${{ needs.gather_facts.outputs.version }} steps: - name: Install semver - uses: giantswarm/install-binary-action@0797deb878056114fa54ee30c519f617716e8c69 # v3.1.1 + uses: giantswarm/install-binary-action@c94c7adadeb14af4bdbdd601f9a6e7f69638134c # v4.0.0 with: binary: "semver" version: "3.0.0" @@ -217,7 +228,7 @@ jobs: tarball_binary_path: "*/src/${binary}" smoke_test: "${binary} --version" - name: Check out the repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # Clone the whole history, not just the most recent commit. - name: Fetch all tags and branches diff --git a/.github/workflows/zz_generated.create_release_pr.yaml b/.github/workflows/zz_generated.create_release_pr.yaml index ae2b7815..1a19e88d 100644 --- a/.github/workflows/zz_generated.create_release_pr.yaml +++ b/.github/workflows/zz_generated.create_release_pr.yaml @@ -2,7 +2,7 @@ # # devctl # -# https://github.com/giantswarm/devctl/blob/ad0a25fbf301b2513e169ec964a8785d28f75be4/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template +# https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template # name: Create Release PR on: @@ -30,9 +30,13 @@ on: required: true type: string +permissions: {} + jobs: publish: uses: giantswarm/github-workflows/.github/workflows/create-release-pr.yaml@main + permissions: + contents: read with: branch: ${{ inputs.branch }} secrets: diff --git a/.github/workflows/zz_generated.gitleaks.yaml b/.github/workflows/zz_generated.gitleaks.yaml index 87fbfd93..b1e772e3 100644 --- a/.github/workflows/zz_generated.gitleaks.yaml +++ b/.github/workflows/zz_generated.gitleaks.yaml @@ -2,13 +2,17 @@ # # devctl # -# https://github.com/giantswarm/devctl/blob/ad0a25fbf301b2513e169ec964a8785d28f75be4/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template +# https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template # name: gitleaks on: - pull_request +permissions: {} + jobs: publish: uses: giantswarm/github-workflows/.github/workflows/gitleaks.yaml@main + permissions: + contents: read diff --git a/.github/workflows/zz_generated.run_ossf_scorecard.yaml b/.github/workflows/zz_generated.run_ossf_scorecard.yaml index fe180c5e..e089872e 100644 --- a/.github/workflows/zz_generated.run_ossf_scorecard.yaml +++ b/.github/workflows/zz_generated.run_ossf_scorecard.yaml @@ -2,7 +2,7 @@ # # devctl # -# https://github.com/giantswarm/devctl/blob/ad0a25fbf301b2513e169ec964a8785d28f75be4/pkg/gen/input/workflows/internal/file/run_ossf_scorecard.yaml.template +# https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/run_ossf_scorecard.yaml.template # # This workflow uses actions that are not certified by GitHub. They are provided @@ -24,8 +24,14 @@ on: - master workflow_dispatch: {} +permissions: {} + jobs: analysis: uses: giantswarm/github-workflows/.github/workflows/ossf-scorecard.yaml@main + permissions: + contents: read + security-events: write + id-token: write secrets: scorecard_token: ${{ secrets.SCORECARD_TOKEN }} diff --git a/.github/workflows/zz_generated.validate_changelog.yaml b/.github/workflows/zz_generated.validate_changelog.yaml index 5bce4eae..108bbc06 100644 --- a/.github/workflows/zz_generated.validate_changelog.yaml +++ b/.github/workflows/zz_generated.validate_changelog.yaml @@ -2,7 +2,7 @@ # # devctl # -# https://github.com/giantswarm/devctl/blob/ad0a25fbf301b2513e169ec964a8785d28f75be4/pkg/gen/input/workflows/internal/file/validate_changelog.yaml.template +# https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/validate_changelog.yaml.template # name: Validate changelog @@ -12,10 +12,11 @@ on: paths: - 'CHANGELOG.md' -permissions: - contents: read - pull-requests: write +permissions: {} jobs: validate-changelog: uses: giantswarm/github-workflows/.github/workflows/validate-changelog.yaml@main + permissions: + contents: read + pull-requests: write