From 32decc08be3083ab839b401ad40a73d2ab632beb Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 10:35:58 -0700 Subject: [PATCH 1/4] chore(ci): take fork-reachable jobs off the self-hosted runners (ENG-2017) test_on_pr runs on pull_request and installed the pull request's own requirements.txt on mdb-dev, so an approved fork PR ran its own code on a pod in the newdev cluster. Move the matrix to ubuntu-latest. The hosted image carries builds for 3.8 through 3.11, so the matrix is unchanged. The CLA workflow moves to the shared reusable in the same change, which takes it off mdb-dev and pins the third-party action it runs. Refs: ENG-2017 --- .github/workflows/cla.yml | 30 ++++++++++++------------------ .github/workflows/test_on_pr.yml | 2 +- 2 files changed, 13 insertions(+), 19 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 6a9f04d..9532fdf 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -1,27 +1,21 @@ name: "MindsDB CLA Assistant" -on: - issue_comment: - types: [created] - pull_request_target: - types: [opened,closed,synchronize] permissions: - actions: write + actions: read contents: write pull-requests: write statuses: write +on: + issue_comment: + types: [created] + pull_request_target: + types: [opened,closed,synchronize] + jobs: CLAssistant: - runs-on: mdb-dev - steps: - - name: "CLA Assistant" - if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - uses: contributor-assistant/github-action@v2.6.1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - path-to-signatures: 'assets/contributions-agreement/cla.json' - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' - branch: 'cla' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz + uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main + with: + path-to-signatures: 'assets/contributions-agreement/cla.json' + path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' + allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz diff --git a/.github/workflows/test_on_pr.yml b/.github/workflows/test_on_pr.yml index 1cd0d21..32d6f9b 100644 --- a/.github/workflows/test_on_pr.yml +++ b/.github/workflows/test_on_pr.yml @@ -12,7 +12,7 @@ jobs: runs-on: ${{ matrix.os }} strategy: matrix: - os: [mdb-dev] + os: [ubuntu-latest] python-version: ['3.8', '3.9', '3.10', '3.11'] steps: - uses: actions/checkout@v4 From 7ade25409a8c951ca151406e89b0abfc14bc4323 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 14:31:55 -0700 Subject: [PATCH 2/4] fix(cla): point the agreement link at the canonical repository (ENG-2017) Both URLs the org uses for this document are rename redirects that resolve to the same repository and serve byte-identical content. A redirect is fine until somebody creates a repository at the old name, and this is the page a contributor reads before agreeing to it. Name the repository that actually holds the file. Refs: ENG-2017 --- .github/workflows/cla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 9532fdf..038d3ed 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -17,5 +17,5 @@ jobs: uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main with: path-to-signatures: 'assets/contributions-agreement/cla.json' - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' + path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz From 7cfda778f19441f4cac95bcb8c1ce047a02460d4 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 17:16:25 -0700 Subject: [PATCH 3/4] chore(cla): stop passing an allowlist, the reusable owns it now (ENG-2017) The allowlist moved into mindsdb/github-actions and is bots only. This repo carried one of six hand-maintained copies naming people, and 11 of the 25 names across those copies had already left the org while still being exempt from signing. Staff sign like everybody else now. A bot cannot sign, so the two that actually open pull requests in this org stay exempt in the reusable. Dropping the line also drops two defects that rode inside it. `bot*` compiled to an unanchored `new RegExp("bot.*").test(login)`, so it exempted any login containing "bot", `robotnik` and `sabotage` included. And `Stpmax` never matched the real login `StpMax`, because non-wildcard entries are compared with a case-sensitive `===`. Needs mindsdb/github-actions#56 first, which gives the input a default. --- .github/workflows/cla.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 038d3ed..d88cf7f 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -18,4 +18,3 @@ jobs: with: path-to-signatures: 'assets/contributions-agreement/cla.json' path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, lucas-koontz From 61c6aaf5640226dbb40abeb2730e0eaa6ec54473 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 17:18:30 -0700 Subject: [PATCH 4/4] chore(ci): require DevOps review on .github/ (ENG-2017) This repo accepts pull requests from outside contributors and had no CODEOWNERS at all, so a workflow change here needed no particular reviewer. Everything under .github/ decides what runs in CI, on which runner, and with which secrets in scope, which is a trust boundary rather than product code. Auto-request only for now. Making it a hard gate needs require_code_owner_reviews in branch protection, which this repo does not have; that rides ENG-2013's org ruleset. --- .github/CODEOWNERS | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7a7c12f --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,5 @@ +# Everything under .github/ decides what runs in CI, on which runner, and with +# which secrets in scope. This repo accepts pull requests from outside +# contributors, so a change here is a change to a trust boundary rather than to +# the product. DevOps reviews it. +.github/ @mindsdb/devops