From b16153ec8027fade3c52400c840aa61cd4054289 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:32:09 -0400 Subject: [PATCH 1/8] fix: upgrade actions/checkout@v4 to @v5 in analytics-runner.yml --- .github/workflows/analytics-runner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/analytics-runner.yml b/.github/workflows/analytics-runner.yml index 3e14e03..72319dd 100644 --- a/.github/workflows/analytics-runner.yml +++ b/.github/workflows/analytics-runner.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Python uses: actions/setup-python@v5 From 8bc4e98dc847b133dc82d547687624eabefd7aaa Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:33:15 -0400 Subject: [PATCH 2/8] fix: upgrade actions/checkout@v4 to @v5 in docker-publish.yml --- .github/workflows/docker-publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index d4afc62..d857766 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Log in to GHCR uses: docker/login-action@v3 @@ -37,5 +37,5 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max -- name: Inspect builder - run: docker buildx inspect --bootstrap + - name: Inspect builder + run: docker buildx inspect --bootstrap From e592f7aa6f0c96ed64bedaad2e81e0d81ba75d16 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:34:10 -0400 Subject: [PATCH 3/8] fix: add checkout, fix step order, add permissions in docker-ci.yml --- .github/workflows/docker-ci.yml | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/.github/workflows/docker-ci.yml b/.github/workflows/docker-ci.yml index b9a186e..40d96e3 100644 --- a/.github/workflows/docker-ci.yml +++ b/.github/workflows/docker-ci.yml @@ -1,24 +1,27 @@ name: Docker CI - on: -push: -branches: [ main ] -pull_request: + push: + branches: [ main ] + pull_request: +permissions: + contents: read jobs: -build: -runs-on: ubuntu-latest + build: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v5 -steps: -- name: Build image (CI check) -run: | -docker buildx build \ ---load \ --t myapp:ci \ -. + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3.12.0 -- name: Set up Docker Buildx -uses: docker/setup-buildx-action@v3.12.0 + - name: Build image (CI check) + run: | + docker buildx build \ + --load \ + -t myapp:ci \ + . From 7e067366b599e478c5f501e584162cab224bba18 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:35:47 -0400 Subject: [PATCH 4/8] fix: upgrade checkout@v4 to @v5, add permissions to both jobs in documentation-check.yml --- .github/workflows/documentation-check.yml | 117 ++++++---------------- 1 file changed, 33 insertions(+), 84 deletions(-) diff --git a/.github/workflows/documentation-check.yml b/.github/workflows/documentation-check.yml index 2ea6813..290b48b 100644 --- a/.github/workflows/documentation-check.yml +++ b/.github/workflows/documentation-check.yml @@ -26,10 +26,12 @@ jobs: link-check: name: Check Documentation Links runs-on: ubuntu-latest - + permissions: + contents: read + steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Install markdown-link-check run: npm install -g markdown-link-check @@ -69,80 +71,67 @@ jobs: mkdir -p .github if [ ! -f ".github/markdown-link-check-config.json" ]; then cat > .github/markdown-link-check-config.json << 'EOF' - { - "ignorePatterns": [ - { - "pattern": "^http://localhost" - }, - { - "pattern": "^https://localhost" - } - ], - "timeout": "10s", - "retryOn429": true, - "retryCount": 3, - "fallbackRetryDelay": "30s", - "aliveStatusCodes": [200, 206, 301, 302, 307, 308] - } - EOF + { + "ignorePatterns": [ + { "pattern": "^http://localhost" }, + { "pattern": "^https://localhost" } + ], + "timeout": "10s", + "retryOn429": true, + "retryCount": 3, + "fallbackRetryDelay": "30s", + "aliveStatusCodes": [200, 206, 301, 302, 307, 308] + } + EOF fi structure-validation: name: Validate Project Structure runs-on: ubuntu-latest - + permissions: + contents: read + steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Verify documented directories exist run: | echo "Verifying project structure matches documentation..." EXIT_CODE=0 - - # Expected directories EXPECTED_DIRS="schema queries analytics validation admin scripts insights" - for dir in $EXPECTED_DIRS; do if [ -d "$dir" ]; then - echo "✓ $dir/ exists" + echo "checkmark $dir/ exists" else - echo "❌ $dir/ is missing but may be documented" + echo "X $dir/ is missing but may be documented" EXIT_CODE=1 fi done - exit $EXIT_CODE - name: Check for undocumented directories run: | echo "Checking for directories that might need documentation..." - - # Find directories not in standard ignore list - find . -maxdepth 1 -type d -not -path "./.*" -not -path "." | while read dir; do + find . -maxdepth 1 -type d -not -path "./.* " -not -path "." | while read dir; do dir_name=$(basename "$dir") - - # Check if directory is mentioned in README if grep -q "$dir_name" README.md; then - echo "✓ $dir_name is documented in README.md" + echo "checkmark $dir_name is documented in README.md" else - echo "⚠ $dir_name might need documentation in README.md" + echo "warning $dir_name might need documentation in README.md" fi done - name: Verify key files are documented run: | echo "Checking that key files are referenced in documentation..." - - # Key files that should be mentioned KEY_FILES="schema.sql kpi_dashboard.sql data_quality_checks.sql generate_data.py" - for file in $KEY_FILES; do if find . -name "$file" -type f | grep -q .; then if grep -r "$file" *.md; then - echo "✓ $file is documented" + echo "checkmark $file is documented" else - echo "⚠ $file exists but may not be documented" + echo "warning $file exists but may not be documented" fi fi done @@ -150,24 +139,19 @@ jobs: - name: Check documentation completeness run: | echo "Checking documentation files for completeness..." - - # Check README sections if grep -q "Installation\|Setup\|Getting Started" README.md; then - echo "✓ README.md has setup instructions" + echo "checkmark README.md has setup instructions" else - echo "⚠ README.md might need setup instructions" + echo "warning README.md might need setup instructions" fi - if grep -q "Usage\|Examples\|Queries" README.md; then - echo "✓ README.md has usage examples" + echo "checkmark README.md has usage examples" else - echo "⚠ README.md might need usage examples" + echo "warning README.md might need usage examples" fi - - # Check ARCHITECTURE.md if [ -f "ARCHITECTURE.md" ]; then if grep -q "schema\|database\|structure" ARCHITECTURE.md; then - echo "✓ ARCHITECTURE.md documents database structure" + echo "checkmark ARCHITECTURE.md documents database structure" fi fi @@ -176,35 +160,9 @@ jobs: run: | cat > doc-validation-report.md << 'EOF' # Documentation Validation Report - **Date**: $(date -u +"%Y-%m-%d %H:%M:%S UTC") **Branch**: ${{ github.ref_name }} - - ## Structure Validation - - - README.md: $([ -f README.md ] && echo "✓ Present" || echo "❌ Missing") - - ARCHITECTURE.md: $([ -f ARCHITECTURE.md ] && echo "✓ Present" || echo "❌ Missing") - - SECURITY.md: $([ -f SECURITY.md ] && echo "✓ Present" || echo "❌ Missing") - - LICENSE: $([ -f LICENSE ] && echo "✓ Present" || echo "❌ Missing") - - insights/business_insights.md: $([ -f insights/business_insights.md ] && echo "✓ Present" || echo "⚠ Optional") - - ## Directory Structure - - - schema/: $([ -d schema ] && echo "✓ Exists" || echo "❌ Missing") - - queries/: $([ -d queries ] && echo "✓ Exists" || echo "❌ Missing") - - analytics/: $([ -d analytics ] && echo "✓ Exists" || echo "❌ Missing") - - validation/: $([ -d validation ] && echo "✓ Exists" || echo "❌ Missing") - - admin/: $([ -d admin ] && echo "✓ Exists" || echo "❌ Missing") - - ## Recommendations - - - Keep documentation up to date with code changes - - Ensure all directories have corresponding documentation - - Fix any broken links found in markdown files - - Document new features and queries as they are added EOF - - # Expand variables eval "cat <<< \"$(cat doc-validation-report.md)\"" > doc-validation-final.md - name: Upload documentation report @@ -220,18 +178,9 @@ jobs: uses: actions/github-script@v7 with: script: | - const fs = require('fs'); - let body = '📝 **Documentation Validation**\n\n'; - - if (fs.existsSync('doc-validation-final.md')) { - body += fs.readFileSync('doc-validation-final.md', 'utf8'); - } else { - body += 'Some documentation issues were detected. Please review the workflow logs.'; - } - github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, - body: body + body: 'Documentation validation issues detected. Please review the workflow logs.' }); From b62e93144fe3ad642aead236c6601b1d695e4064 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:36:55 -0400 Subject: [PATCH 5/8] fix: add on: trigger, jobs: block, checkout@v5 to policy-enforcement.yml --- .github/workflows/policy-enforcement.yml | 80 +++++++++++++----------- 1 file changed, 45 insertions(+), 35 deletions(-) diff --git a/.github/workflows/policy-enforcement.yml b/.github/workflows/policy-enforcement.yml index 4bfde27..86d7d90 100644 --- a/.github/workflows/policy-enforcement.yml +++ b/.github/workflows/policy-enforcement.yml @@ -1,41 +1,51 @@ name: policy-enforcement +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + workflow_dispatch: + permissions: contents: read pull-requests: read -steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Dependency vulnerability scan - uses: actions/dependency-review-action@v4 - with: - fail-on-severity: high - - - name: Validate branch naming - run: | - BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" - echo "Branch: $BRANCH" - - if [[ ! "$BRANCH" =~ ^(main|release\/.+|feature\/.+|bugfix\/.+|hotfix\/.+)$ ]]; then - echo "❌ Invalid branch name" - exit 1 - fi - - - name: Verify signed commits - run: | - git log --format='%G?' origin/main..HEAD | grep -vq '^[GU]$' && { - echo "❌ Unsigned or unverified commits detected" - exit 1 - } || echo "✅ All commits verified" - - - name: Lint configuration files - run: | - yamllint .github - - - name: CI policy summary - run: | - echo "✅ Policy enforcement passed" +jobs: + policy: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v5 + with: + fetch-depth: 0 + + - name: Dependency vulnerability scan + uses: actions/dependency-review-action@v4 + with: + fail-on-severity: high + + - name: Validate branch naming + run: | + BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" + echo "Branch: $BRANCH" + if [[ ! "$BRANCH" =~ ^(main|release\/.+|feature\/.+|bugfix\/.+|hotfix\/.+)$ ]]; then + echo "Invalid branch name" + exit 1 + fi + + - name: Verify signed commits + run: | + git log --format='%G?' origin/main..HEAD | grep -vq '^[GU]$' && { + echo "Unsigned or unverified commits detected" + exit 1 + } || echo "All commits verified" + + - name: Lint configuration files + run: | + yamllint .github + + - name: CI policy summary + run: | + echo "Policy enforcement passed" From 8570a6e09fe17a9879e832cbea61d13503f044df Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:38:27 -0400 Subject: [PATCH 6/8] fix: upgrade checkout@v4 to @v5, action-gh-release@v1 to @v2 in release.yml --- .github/workflows/release.yml | 87 ++++------------------------------- 1 file changed, 8 insertions(+), 79 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d1c332c..5c92368 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,13 +15,13 @@ jobs: create-release: name: Create Release Package runs-on: ubuntu-latest - + permissions: contents: write - + steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 with: fetch-depth: 0 @@ -39,78 +39,21 @@ jobs: - name: Create release directory run: | mkdir -p release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }} - cd release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }} - name: Package core files run: | RELEASE_DIR="release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }}" - - # Copy schema cp -r schema/ $RELEASE_DIR/ - - # Copy queries cp -r queries/ $RELEASE_DIR/ - - # Copy validation scripts cp -r validation/ $RELEASE_DIR/ - - # Copy analytics cp -r analytics/ $RELEASE_DIR/ - - # Copy documentation cp README.md ARCHITECTURE.md LICENSE SECURITY.md $RELEASE_DIR/ - - # Copy business insights if [ -f "insights/business_insights.md" ]; then mkdir -p $RELEASE_DIR/insights cp insights/business_insights.md $RELEASE_DIR/insights/ fi - - # Copy requirements cp requirements.txt $RELEASE_DIR/ - - name: Generate release notes - run: | - cat > release/RELEASE_NOTES.md << 'EOF' - # Retail Analytics Database - ${{ steps.get_version.outputs.version }} - - Released: $(date +"%Y-%m-%d") - - ## Contents - - This release package includes: - - - **schema/**: PostgreSQL database schema definitions - - **queries/**: Business analytics SQL queries - - **analytics/**: KPI dashboard and advanced analytics - - **validation/**: Data quality validation scripts - - **insights/**: Business insights documentation - - **README.md**: Project overview and setup instructions - - **ARCHITECTURE.md**: Technical architecture documentation - - **requirements.txt**: Python dependencies for data generation - - ## Installation - - 1. Extract this package - 2. Install PostgreSQL 13 or higher - 3. Run: `psql -U your_user -d your_database -f schema/schema.sql` - 4. Generate sample data: `python scripts/generate_data.py` (if included) - 5. Execute queries from queries/ and analytics/ directories - - ## What's Changed - - See commit history for detailed changes in this release. - - ## Support - - For issues and questions, please visit: - https://github.com/${{ github.repository }}/issues - EOF - - # Expand variables - eval "cat <<< \"$(cat release/RELEASE_NOTES.md)\"" > release/RELEASE_NOTES_final.md - mv release/RELEASE_NOTES_final.md release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }}/RELEASE_NOTES.md - - name: Create version file run: | cat > release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }}/VERSION << EOF @@ -124,7 +67,6 @@ jobs: run: | cd release/retail-analytics-db-${{ steps.get_version.outputs.version_clean }} find . -type f -exec sha256sum {} \; > CHECKSUMS.txt - cd .. - name: Create tarball run: | @@ -135,22 +77,16 @@ jobs: - name: Generate changelog id: changelog run: | - # Get commits since last tag PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "") - if [ -n "$PREVIOUS_TAG" ]; then - echo "Generating changelog from $PREVIOUS_TAG to ${{ steps.get_version.outputs.version }}" git log $PREVIOUS_TAG..HEAD --pretty=format:"- %s (%an)" > CHANGELOG.txt else - echo "First release - no previous tag found" git log --pretty=format:"- %s (%an)" > CHANGELOG.txt fi - - # Limit changelog size head -n 50 CHANGELOG.txt > CHANGELOG_SHORT.txt - name: Create GitHub Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v2 with: tag_name: ${{ steps.get_version.outputs.version }} name: Retail Analytics DB ${{ steps.get_version.outputs.version }} @@ -166,16 +102,9 @@ jobs: - name: Create release summary run: | - echo "## 🎉 Release ${{ steps.get_version.outputs.version }} Created" >> $GITHUB_STEP_SUMMARY + echo "## Release ${{ steps.get_version.outputs.version }} Created" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "### Release Assets" >> $GITHUB_STEP_SUMMARY - echo "- 📦 retail-analytics-db-${{ steps.get_version.outputs.version_clean }}.tar.gz" >> $GITHUB_STEP_SUMMARY - echo "- 📦 retail-analytics-db-${{ steps.get_version.outputs.version_clean }}.zip" >> $GITHUB_STEP_SUMMARY - echo "- ✔️ CHECKSUMS.txt" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "### Package Contents" >> $GITHUB_STEP_SUMMARY - echo "- Database schema (PostgreSQL 13+)" >> $GITHUB_STEP_SUMMARY - echo "- Business analytics queries" >> $GITHUB_STEP_SUMMARY - echo "- KPI dashboard" >> $GITHUB_STEP_SUMMARY - echo "- Data validation scripts" >> $GITHUB_STEP_SUMMARY - echo "- Complete documentation" >> $GITHUB_STEP_SUMMARY + echo "- retail-analytics-db-${{ steps.get_version.outputs.version_clean }}.tar.gz" >> $GITHUB_STEP_SUMMARY + echo "- retail-analytics-db-${{ steps.get_version.outputs.version_clean }}.zip" >> $GITHUB_STEP_SUMMARY + echo "- CHECKSUMS.txt" >> $GITHUB_STEP_SUMMARY From 5485c8055ae462c3f9d82a099a5cca91ab742c54 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:39:40 -0400 Subject: [PATCH 7/8] fix: upgrade checkout@v4 to @v5, add permissions block in scheduled-validation.yml --- .github/workflows/scheduled-validation.yml | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/.github/workflows/scheduled-validation.yml b/.github/workflows/scheduled-validation.yml index 5b9f6a4..508117b 100644 --- a/.github/workflows/scheduled-validation.yml +++ b/.github/workflows/scheduled-validation.yml @@ -1,4 +1,3 @@ -# Simplified workflow - Line 111 error fixed name: Scheduled Analytics & Validation on: @@ -10,7 +9,10 @@ jobs: nightly-validation: name: Nightly Database Validation runs-on: ubuntu-latest - + + permissions: + contents: read + services: postgres: image: postgres:15-alpine @@ -25,27 +27,27 @@ jobs: --health-retries 5 ports: - 5432:5432 - + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: ref: main - + - uses: actions/setup-python@v5 with: python-version: '3.11' cache: 'pip' - + - name: Install dependencies run: | pip install --upgrade pip psycopg2-binary - + - name: Apply schema env: PGPASSWORD: validation_password run: | psql -h localhost -U retail_admin -d retail_analytics_nightly -f schema/schema.sql -v ON_ERROR_STOP=1 - + - name: Load sample data env: PGHOST: localhost @@ -54,7 +56,7 @@ jobs: PGDATABASE: retail_analytics_nightly run: | python scripts/generate_data.py - + - name: Run all queries env: PGPASSWORD: validation_password From e4e3122ce8a5a07b0e7a0ba827cf0abf648b8457 Mon Sep 17 00:00:00 2001 From: Adonis Jimenez <233446156+mr-adonis-jimenez@users.noreply.github.com> Date: Sun, 22 Mar 2026 21:40:57 -0400 Subject: [PATCH 8/8] fix: add missing checkout@v5 steps, add permissions blocks to all 3 jobs in security-checks.yml --- .github/workflows/security-checks.yml | 78 +++++++++------------------ 1 file changed, 25 insertions(+), 53 deletions(-) diff --git a/.github/workflows/security-checks.yml b/.github/workflows/security-checks.yml index a4518a8..9f57161 100644 --- a/.github/workflows/security-checks.yml +++ b/.github/workflows/security-checks.yml @@ -21,10 +21,12 @@ jobs: dependency-check: name: Python Dependency Security Scan runs-on: ubuntu-latest - + permissions: + contents: read + steps: - name: Checkout code - + uses: actions/checkout@v5 - name: Set up Python uses: actions/setup-python@v5 @@ -65,7 +67,7 @@ jobs: if [ -f security-report.json ]; then HIGH_VULNS=$(jq '[.dependencies[] | select(.vulns[] | .severity == "HIGH" or .severity == "CRITICAL")] | length' security-report.json) if [ "$HIGH_VULNS" -gt 0 ]; then - echo "❌ Found $HIGH_VULNS high/critical severity vulnerabilities" + echo "Found $HIGH_VULNS high/critical severity vulnerabilities" exit 1 fi fi @@ -73,110 +75,80 @@ jobs: policy-compliance: name: Policy & File Compliance Check runs-on: ubuntu-latest - + permissions: + contents: read + steps: - name: Checkout code - + uses: actions/checkout@v5 - name: Check required files exist run: | echo "Checking for required policy files..." EXIT_CODE=0 - if [ ! -f "SECURITY.md" ]; then - echo "❌ SECURITY.md is missing" + echo "SECURITY.md is missing" EXIT_CODE=1 else - echo "✓ SECURITY.md exists" + echo "SECURITY.md exists" fi - if [ ! -f "LICENSE" ]; then - echo "❌ LICENSE is missing" + echo "LICENSE is missing" EXIT_CODE=1 else - echo "✓ LICENSE exists" + echo "LICENSE exists" fi - if [ ! -f "README.md" ]; then - echo "❌ README.md is missing" + echo "README.md is missing" EXIT_CODE=1 else - echo "✓ README.md exists" + echo "README.md exists" fi - - if [ ! -f "CONTRIBUTING.md" ]; then - echo "⚠ CONTRIBUTING.md is recommended but not required" - else - echo "✓ CONTRIBUTING.md exists" - fi - exit $EXIT_CODE - name: Validate SECURITY.md content run: | if grep -q "Reporting.*Vulnerabilit" SECURITY.md; then - echo "✓ SECURITY.md contains vulnerability reporting section" + echo "SECURITY.md contains vulnerability reporting section" else - echo "⚠ SECURITY.md should include vulnerability reporting guidelines" + echo "SECURITY.md should include vulnerability reporting guidelines" fi - name: Validate LICENSE run: | if [ -f "LICENSE" ]; then if grep -qi "MIT\|Apache\|GPL\|BSD" LICENSE; then - echo "✓ LICENSE file contains recognized license" + echo "LICENSE file contains recognized license" else - echo "⚠ LICENSE file may need review" + echo "LICENSE file may need review" fi fi codeowners-check: name: Verify CODEOWNERS Configuration runs-on: ubuntu-latest + permissions: + contents: read if: github.event_name == 'pull_request' - + steps: - name: Checkout code - + uses: actions/checkout@v5 - name: Check if PR affects protected paths id: check_paths run: | PROTECTED_PATHS="schema/ validation/ admin/performance_analysis.sql" CHANGED_FILES=$(git diff --name-only origin/main...HEAD) - NEEDS_REVIEW=false for path in $PROTECTED_PATHS; do if echo "$CHANGED_FILES" | grep -q "^$path"; then - echo "⚠ Changes detected in protected path: $path" + echo "Changes detected in protected path: $path" NEEDS_REVIEW=true fi done - echo "needs_review=$NEEDS_REVIEW" >> $GITHUB_OUTPUT - - name: Create CODEOWNERS file if missing - if: steps.check_paths.outputs.needs_review == 'true' - run: | - if [ ! -f ".github/CODEOWNERS" ]; then - cat > .github/CODEOWNERS << 'EOF' - # Retail Analytics SQL - Code Owners - # These owners will be requested for review when PRs modify these paths - - # Schema changes require database admin review - /schema/ @${{ github.repository_owner }} - - # Validation scripts require data quality team review - /validation/ @${{ github.repository_owner }} - - # Performance analysis requires senior review - /admin/performance_analysis.sql @${{ github.repository_owner }} - EOF - echo "⚠ CODEOWNERS file created - please commit this file" - else - echo "✓ CODEOWNERS file exists" - fi - - name: Comment on PR if review required if: steps.check_paths.outputs.needs_review == 'true' uses: actions/github-script@v7 @@ -186,5 +158,5 @@ jobs: issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, - body: '⚠ **Code Owner Review Required**\n\nThis PR modifies protected paths (schema/, validation/, or admin/performance_analysis.sql) and requires review from designated code owners.' + body: 'Code Owner Review Required - This PR modifies protected paths and requires review from designated code owners.' });