[Sync] Update project files from source repository (bfde11d) by mrz1836 · Pull Request #271 · BitcoinSchema/go-bitcoin

mrz1836 · 2026-02-07T18:05:11Z

What Changed

Replaced monolithic .github/.env.base configuration file (550 lines) with a modular .github/env/ directory structure containing separate environment files
Split configuration into logical modules: 00-core.env, 10-coverage.env, 10-mage-x.env, 10-pre-commit.env, 10-security.env, 20-redis.env, and 20-workflows.env
Added new load-env.sh shell script to source environment files in order and a README.md documenting the new structure
Updated .github/actions/load-env/action.yml to use the new modular approach with the load-env.sh script
Added new .github/actions/download-artifact-resilient/action.yml composite action for resilient artifact downloads with retry logic
Updated all workflow files (fortress.yml, fortress-coverage.yml, fortress-completion-tests.yml, fortress-test-magex.yml, fortress-warm-cache.yml, pull-request-management.yml, pull-request-management-fork.yml, auto-merge-on-approval.yml, dependabot-auto-merge.yml, codeql-analysis.yml, scorecard.yml, stale-check.yml, sync-labels.yml) to use the new load-env action
Added .github/workflows/fortress-setup-config.yml reusable workflow to centralize environment configuration loading
Updated documentation files (workflows.md, repository-features.md) to reflect the new modular configuration approach
Added comprehensive technical conventions documentation in .github/tech-conventions/ (commit-branch-conventions.md, pre-commit.md)
Updated .github/CODEOWNERS and .github/.yamlfmt configuration files

Why It Was Necessary

The monolithic 550-line .env.base file was difficult to maintain, navigate, and understand - splitting into focused modules improves maintainability and clarity
Modular configuration allows teams to understand and modify specific subsystems (coverage, security, workflows) without needing to parse the entire configuration
Centralized environment loading through reusable workflows reduces duplication and ensures consistent configuration across all CI/CD workflows

Testing Performed

Verified that all workflow files correctly reference the new load-env action and fortress-setup-config reusable workflow
Validated that environment variable loading follows the documented precedence order (00-core, 10-, 20-) through the new load-env.sh script
Confirmed that the new download-artifact-resilient action includes proper retry logic and error handling for artifact operations

Impact / Risk

Breaking Change: Projects depending on .github/.env.base must migrate to the new .github/env/ structure - however, the load-env action maintains backward compatibility
Low Risk: The changes are primarily organizational - the same environment variables are defined, just in separate files with clearer ownership
Improved Maintainability: Modular structure makes it easier to understand, test, and modify specific configuration subsystems independently

Copilot

Pull request overview

This PR syncs CI/CD infrastructure from the upstream source repository by replacing the monolithic .github/.env.base configuration with a modular .github/env/ layout, updating workflows/actions to consume the new loader, and adding resiliency improvements for artifact downloads.

Changes:

Replaced .github/.env.base with modular .github/env/*.env files plus a shared load-env.sh loader and documentation.
Updated composite actions and workflows to load configuration from .github/env/ and adjusted associated outputs/documentation.
Added/updated GitHub Actions utilities (notably resilient artifact download behavior) and refreshed pinned action SHAs.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
.github/workflows/sync-labels.yml	Updates sparse checkout to include `.github/env` for modular config loading.
.github/workflows/stale-check.yml	Updates docs/sparse checkout to use `.github/env` modular config.
.github/workflows/scorecard.yml	Bumps pinned `upload-sarif` action SHA/version.
.github/workflows/pull-request-management.yml	Switches to `.github/env` and adds fork PR skip condition.
.github/workflows/pull-request-management-fork.yml	Switches to `.github/env` and adds same-repo PR skip condition; aligns comments.
.github/workflows/fortress.yml	Updates fortress metadata and replaces legacy env outputs with modular counts.
.github/workflows/fortress-warm-cache.yml	Updates sparse checkout to include `.github/env`.
.github/workflows/fortress-test-magex.yml	Updates sparse checkout to include `.github/env`.
.github/workflows/fortress-setup-config.yml	Replaces legacy env discovery outputs with modular env file/var counts in summary.
.github/workflows/fortress-coverage.yml	Updates user-facing guidance text to point at modular env file locations.
.github/workflows/fortress-completion-tests.yml	Updates user-facing guidance to reference modular env file locations.
.github/workflows/dependabot-auto-merge.yml	Updates comments and sparse checkout to use `.github/env`.
.github/workflows/codeql-analysis.yml	Bumps pinned CodeQL action SHAs/versions.
.github/workflows/auto-merge-on-approval.yml	Updates comments and sparse checkout to use `.github/env`.
.github/tech-conventions/pre-commit.md	Updates documentation to reference modular env layout.
.github/tech-conventions/commit-branch-conventions.md	Updates documentation to reference modular env layout.
.github/env/load-env.sh	Adds modular env loader to source `.env` fragments in order.
.github/env/README.md	Documents modular env structure, load order, and override strategy.
.github/env/20-workflows.env	Introduces workflow automation configuration variables (stale/labels/auto-merge/PR mgmt).
.github/env/20-redis.env	Introduces Redis service configuration variables for workflows/tests.
.github/env/10-security.env	Introduces security tool configuration variables and versions.
.github/env/10-pre-commit.env	Introduces go-pre-commit configuration variables and tool versions.
.github/env/10-mage-x.env	Introduces mage-x configuration variables and tool versions.
.github/env/10-coverage.env	Introduces go-coverage configuration variables and reporting behavior.
.github/env/00-core.env	Introduces core CI defaults (Go versions, runners, feature flags, timeouts).
.github/docs/workflows.md	Adds documentation index for workflows and config entrypoint.
.github/docs/repository-features.md	Adds repository feature overview and links to relevant automation/docs.
.github/actions/load-env/action.yml	Reworks env loading to use `load-env.sh` and produce workflow-consumable outputs.
.github/actions/download-artifact-resilient/action.yml	Adds fallback behavior when artifact listing fails and improves error messaging.
.github/CODEOWNERS	Updates ownership patterns for new `.github/env` and tech conventions paths.
.github/.yamlfmt	Excludes modular env directory from YAML formatting tooling.
.github/.env.base	Deletes the former monolithic env file in favor of modular files.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-07T18:13:31Z

.github/env/load-env.sh

+
+        # shellcheck source=/dev/null
+        source "$env_file"
+        ((count++))


load-env.sh runs with set -e, and ((count++)) returns exit status 1 on the first iteration (because the expression evaluates to 0). This will cause the loader to exit after sourcing the first .env file. Use a non-zero arithmetic form like ((++count)) / ((count+=1)) to avoid set -e aborts.

Suggested change

((count++))

((++count))

Copilot · 2026-02-07T18:13:32Z

.github/actions/load-env/action.yml

+        # Extract all exported variables to JSON for workflow compatibility
+        echo "📦 Extracting environment variables to JSON..."
+        ENV_JSON=$(env | grep -E '^[A-Z_][A-Z0-9_]*=' | while IFS='=' read -r key value; do
+          # Escape special characters in value for JSON
+          escaped_value=$(printf '%s' "$value" | jq -Rs '.')
+          echo "{\"$key\": $escaped_value}"
+        done | jq -s 'add // {}')


The action builds env-json from env, which captures the entire runner environment (PATH, HOME, GITHUB_, RUNNER_, etc.), not just config from .github/env/*.env. Downstream parse-env writes every key to GITHUB_ENV, so this can overwrite critical runner/GitHub variables and create hard-to-debug behavior. Consider constructing JSON only from keys defined in the modular env files (e.g., parse keys from .github/env/*.env and printenv them), or restrict to an allowlist/prefix set.

Copilot · 2026-02-07T18:13:32Z

.github/actions/load-env/action.yml

+          echo "❌ ERROR: Failed to load environment configuration" >&2
          exit 1
        fi



This loader no longer reads .github/.env.custom, but the repo still contains .github/.env.custom with active overrides (e.g., GO_COVERAGE_PROVIDER=codecov, GO_SECONDARY_VERSION=1.23.x). As a result, existing project-specific settings will silently stop applying. Either migrate those overrides into the modular .github/env/ files (e.g., add a repo-specific 90-project.env) or have load-env.sh/this action source .github/.env.custom for backward compatibility.

Suggested change

# Backward compatibility: load .github/.env.custom if present

CUSTOM_ENV_FILE=".github/.env.custom"

if [[ -f "$CUSTOM_ENV_FILE" ]]; then

echo "🧩 Loading project-specific overrides from $CUSTOM_ENV_FILE"

# Source after modular envs so project overrides take precedence

source "$CUSTOM_ENV_FILE"

fi

Copilot · 2026-02-07T18:13:32Z

.github/actions/download-artifact-resilient/action.yml

+            echo "↪ Falling back to direct download attempt (skipping preflight list)"
+
+            DOWNLOAD_CMD="gh run download ${{ github.run_id }} --pattern \"$ARTIFACT_PATTERN\" --dir \"$ARTIFACT_PATH\""
+            if timeout "$DOWNLOAD_TIMEOUT" bash -c "$DOWNLOAD_CMD"; then
+              echo "✅ Successfully downloaded artifacts via fallback"
+              DOWNLOAD_SUCCESS=true
+              ARTIFACTS_FOUND=1
+              break


DOWNLOAD_CMD is assembled as a single shell string and executed via bash -c, which is vulnerable to input containing quotes/shell metacharacters in ARTIFACT_PATTERN/ARTIFACT_PATH (action inputs). Prefer invoking gh run download with a bash array (no bash -c) so arguments are passed safely without shell interpretation.

Copilot · 2026-02-07T18:13:33Z

.github/docs/workflows.md

+| [fortress.yml](../workflows/fortress.yml) | Runs the GoFortress security and testing workflow, including linting, testing, releasing, and vulnerability checks. |
+| [pull-request-management.yml](../workflows/pull-request-management.yml) | Labels PRs by branch prefix, assigns a default user if none is assigned, and welcomes new contributors with a comment. |
+| [scorecard.yml](../workflows/scorecard.yml) | Runs [OpenSSF](https://openssf.org/) Scorecard to assess supply chain security. |
+| [stale.yml](../workflows/stale-check.yml) | Warns about (and optionally closes) inactive issues and PRs on a schedule or manual trigger. |


The link text says stale.yml but the actual workflow file is stale-check.yml. Update the table entry label to match the filename to avoid confusion for readers.

Suggested change

| [stale.yml](../workflows/stale-check.yml) | Warns about (and optionally closes) inactive issues and PRs on a schedule or manual trigger. |

| [stale-check.yml](../workflows/stale-check.yml) | Warns about (and optionally closes) inactive issues and PRs on a schedule or manual trigger. |

Copilot · 2026-02-07T18:13:33Z

.github/docs/repository-features.md

+* **Relentless Dependency & Vulnerability Scans** via [Dependabot](https://dependabot.com) (runs daily at 8am to ensure broadcast dependencies are always current), [Nancy](https://github.com/sonatype-nexus-community/nancy), and [govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck).
+* **Security Posture by Default** with [CodeQL](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning), [OpenSSF Scorecard](https://openssf.org), and secret‑leak detection via [gitleaks](https://github.com/gitleaks/gitleaks).
+* **Automatic Syndication** to [pkg.go.dev](https://pkg.go.dev/) on every release for instant godoc visibility.
+* **Polished Community Experience** using rich templates for [Issues & PRs](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-go-broadcastsitory).


This URL looks malformed: ...configuring-issue-templates-for-go-broadcastsitory (extra 'sitory'). It likely 404s; please correct the link target.

Suggested change

* **Polished Community Experience** using rich templates for [Issues & PRs](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-go-broadcastsitory).

* **Polished Community Experience** using rich templates for [Issues & PRs](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository).

Copilot · 2026-02-07T18:13:33Z

.github/CODEOWNERS

+.github/scripts/* @mrz1836
 .github/workflows/* @mrz1836
+.github/env/* @mrz1836
 .github/.env.base @mrz1836


CODEOWNERS still lists .github/.env.base, but that file is deleted in this PR. Leaving stale paths is confusing and can mislead reviewers about where configuration lives; remove or replace with the new .github/env/* entries only.

Suggested change

.github/.env.base @mrz1836

Copilot · 2026-02-07T18:13:33Z

.github/workflows/fortress.yml

 #
 #  Maintainer: @mrz1836
-#  Repository: https://github.com/mrz1836/go-fortress
+#  Repository: https://github.com/mrz1836/go-broadcast


The header comment now points to https://github.com/mrz1836/go-broadcast as the repository for GoFortress. If this is meant to reference the fortress project/template, this URL looks incorrect and may confuse maintainers troubleshooting CI provenance; consider updating it to the correct upstream/tooling repo or to this repository.

Suggested change

# Repository: https://github.com/mrz1836/go-broadcast

# Repository: https://github.com/mrz1836/go-fortress

sync(ci): restructure env config from monolithic to modular

47ac23f

Copilot AI review requested due to automatic review settings February 7, 2026 18:05

mrz1836 self-assigned this Feb 7, 2026

mrz1836 added automated-sync Automated sync PR, e.g. from a fork or external repo automerge Label to automatically merge pull requests that meet all required conditions chore Simple dependency updates or version bumps labels Feb 7, 2026

github-actions bot added update General updates size/XL Very large change (>500 lines) labels Feb 7, 2026

Copilot started reviewing on behalf of mrz1836 February 7, 2026 18:05 View session

mrz1836 merged commit 169f530 into master Feb 7, 2026
46 of 48 checks passed

github-actions bot deleted the chore/sync-files-bitcoin-schema-20260207-130452-bfde11d branch February 7, 2026 18:10

Copilot AI reviewed Feb 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Sync] Update project files from source repository (bfde11d)#271

[Sync] Update project files from source repository (bfde11d)#271
mrz1836 merged 1 commit intomasterfrom
chore/sync-files-bitcoin-schema-20260207-130452-bfde11d

mrz1836 commented Feb 7, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

+        # Backward compatibility: load .github/.env.custom if present
+        CUSTOM_ENV_FILE=".github/.env.custom"
+        if [[ -f "$CUSTOM_ENV_FILE" ]]; then
+          echo "🧩 Loading project-specific overrides from $CUSTOM_ENV_FILE"
+          # Source after modular envs so project overrides take precedence
+          source "$CUSTOM_ENV_FILE"
+        fi

	\| [stale.yml](../workflows/stale-check.yml) \| Warns about (and optionally closes) inactive issues and PRs on a schedule or manual trigger. \|
	\| [stale-check.yml](../workflows/stale-check.yml) \| Warns about (and optionally closes) inactive issues and PRs on a schedule or manual trigger. \|

	* Polished Community Experience using rich templates for [Issues & PRs](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-go-broadcastsitory).
	* Polished Community Experience using rich templates for [Issues & PRs](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository).

	# Repository: https://github.com/mrz1836/go-broadcast
	# Repository: https://github.com/mrz1836/go-fortress

Uh oh!

Conversation

mrz1836 commented Feb 7, 2026

What Changed

Why It Was Necessary

Testing Performed

Impact / Risk

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants