Derive repository from github context, drop with: inputs #3

Merged

james merged 2 commits from simplify/derive-repo-from-context into main 2026-09-06 21:54:14 +00:00

Conversation 0 Commits 2 Files changed 3 +58 -24

james commented 2026-09-06 21:48:57 +00:00

Owner

Copy link

Reusable workflows run with the calling repo's own github context, so github.repository is already owner/name for whichever repo invoked this � no input needed, and nothing for a caller to get wrong. (This already happened once: security-scan.yml callers were copy-pasted with the wrong repo name under the wrong input key.)

• security-scan.yml drops product-name, derives it from github.repository.
• renovate.yml drops repository, passes github.repository to the Renovate CLI directly.

A caller now needs nothing but uses: + secrets: � no with: block at all.

Also documents pinning callers to a commit SHA rather than @main.

Reusable workflows run with the calling repo's own `github` context, so `github.repository` is already `owner/name` for whichever repo invoked this � no input needed, and nothing for a caller to get wrong. (This already happened once: `security-scan.yml` callers were copy-pasted with the wrong repo name under the wrong input key.) - `security-scan.yml` drops `product-name`, derives it from `github.repository`. - `renovate.yml` drops `repository`, passes `github.repository` to the Renovate CLI directly. A caller now needs nothing but `uses:` + `secrets:` � no `with:` block at all. Also documents pinning callers to a commit SHA rather than `@main`.

james added 1 commit 2026-09-06 21:48:58 +00:00

Derive repository from github context, drop with: inputs ... bb403bed1d

Reusable workflows run with the calling repo's own github context, so
github.repository is already "owner/name" for whichever repo invoked
this. Passing it as an explicit input just gave callers a value to get
wrong (already happened once: security-scan.yml callers were copy-pasted
with the wrong repo name under the wrong input key).

- security-scan.yml: drops the product-name input, derives it from
  github.repository instead.
- renovate.yml: drops the repository input, passes github.repository to
  the renovate CLI directly.

A caller now needs nothing but uses: + secrets: — no with: block, and
nothing left to copy-paste wrong.

Also documents: pin callers to a commit SHA, not @main (a mutable ref
would let a future push here change what every caller executes, since
these run with access to whatever secrets the caller passes).

james referenced this pull request from ColibriSec/balam 2026-09-06 21:50:00 +00:00

fix: correct security-scan.yml reusable-workflow call #13

james referenced this pull request from ColibriSec/balam-forgejo 2026-09-06 21:51:18 +00:00

fix: correct security-scan.yml reusable-workflow call #6

james referenced this pull request from ColibriSec/ojo-forgejo 2026-09-06 21:52:33 +00:00

fix: correct security-scan.yml reusable-workflow call #15

james added 1 commit 2026-09-06 21:53:31 +00:00

Run these workflows on this repo too, not just as callees ... 80555fad49

Both files now trigger directly (push/pull_request for security-scan,
schedule/workflow_dispatch for renovate) in addition to workflow_call —
same behavior either way since everything's derived from context, so
there's nothing repo-specific to duplicate into a separate caller file.

Needs BALAM_URL, BALAM_TOKEN, and RENOVATE_TOKEN secrets configured on
this repo directly (previously only needed by callers).

james merged commit 8f90496e34 into main 2026-09-06 21:54:14 +00:00

james deleted branch simplify/derive-repo-from-context 2026-09-06 21:54:14 +00:00

james referenced this pull request from a commit 2026-09-06 21:54:16 +00:00

Merge pull request 'Derive repository from github context, drop with: inputs' (#3) from simplify/derive-repo-from-context into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ColibriSec/forgejo-workflows!3

No description provided.