BUILD-7998 Update CODEOWNERS and update action ref#326
Merged
Conversation
60da450 to
26dc484
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR updates the repository’s automation and ownership configuration by switching certain GitHub Actions to local copies and tightening code ownership rules.
- Swap remote SonarSource release actions for local action folders in CI workflows
- Annotate the SonarCloud action and suggest version pinning
- Protect the CODEOWNERS file and set default ownership
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/maven-central.yaml | Use local download-build and maven-central-sync actions instead of remote references |
| .github/workflows/javadoc-publication.yaml | Use local aws-s3 action for Javadoc publication |
| .github/workflows/build.yml | Add comment and recommend pinning for SonarCloud action |
| .github/CODEOWNERS | Add default owner comment and protect the CODEOWNERS file |
Comments suppressed due to low confidence (3)
.github/workflows/maven-central.yaml:60
- [nitpick] Consider adding a similar inline comment to the
uses: ./maven-central-syncstep to clarify that both actions are local copies, improving maintainability and consistency.
uses: ./download-build # Local action
.github/workflows/javadoc-publication.yaml:95
- [nitpick] Add an inline comment (e.g., "# Local action") after this line to indicate that the
aws-s3action is a local implementation, matching the style used elsewhere.
uses: ./aws-s3
.github/workflows/build.yml:47
- For reproducible CI runs, pin this action to a specific release tag or version rather than
@masterto avoid unexpected changes whenmasteris updated.
uses: SonarSource/sonarcloud-github-action@master # First-party SonarSource action
julien-carsique-sonarsource
approved these changes
Jul 1, 2025
Contributor
julien-carsique-sonarsource
left a comment
There was a problem hiding this comment.
Also replace uses: SonarSource/gh-action_release/download-build@master with a local call?
Additional actions/checkout may be needed to access the local actions.
26dc484 to
a766dd9
Compare
d6aff0d to
26dc484
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request includes updates to the repository's configuration files to improve maintainability and streamline workflows. The most notable changes involve replacing external GitHub actions with local actions and refining ownership rules for the repository.
Repository Ownership Updates:
.github/CODEOWNERS: Added default owners for the entire repository and protected theCODEOWNERSfile by assigning ownership to the@sonarsource/platform-eng-xp-squadteam. Removed the rule that excluded.mdfiles from review.Workflow Enhancements:
.github/workflows/build.yml: Added a comment to clarify the use of the SonarSource GitHub action for SonarCloud scans..github/workflows/javadoc-publication.yaml: Replaced the externalSonarSource/gh-action_release/aws-s3action with a local./aws-s3action for publishing, deleting, and uploading javadoc files to S3. This change ensures better control over the actions used in the workflow. [1] [2] [3].github/workflows/maven-central.yaml: Replaced the externalSonarSource/gh-action_release/download-buildandSonarSource/gh-action_release/maven-central-syncactions with local actions (./download-buildand./maven-central-sync). Updated step names for clarity and added comments to indicate the use of local actions.