Files
carbon-lang/.github/workflows
Chandler Carruth a50feb64ce Simplify proposal labels and fix GitHub label workflows (#7904)
We now only use a single `proposal` label on proposal PRs rather than
separate state labels (`proposal draft`, `proposal rfc`, `proposal
accepted`, `proposal declined`, and `proposal deferred`), as draft,
open, merged, and closed PR states already capture the proposal
lifecycle.

- Remove the `proposal_labeled.yaml` and `proposal_ready.yaml`
workflows.
- Update `new_proposal.py`, `template.md`, `evolution.md`, and
`CONTRIBUTING.md` to only use the `proposal` label and filter non-draft
proposal PRs with `draft:false`.
- Fix `auto_label_prs.yaml` to apply the `bot` label instead of the
non-existent `automated` label and fix the `proposals/scripts/**` path
filter typo.
- Update `triage_inactive.yaml` to exempt `needs design doc update`
instead of the old `design update` label.

Assisted-by: Antigravity with Gemini
2026-10-06 17:18:20 +00:00
..

Workflows

Hardening

Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.

Allowed endpoints

Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:

  • clangd_tidy.yaml (Bazel)
  • prek.yaml (Bazel, prek)
  • nightly_release.yaml (Bazel)
  • tests.yaml (Bazel)

When updating one of these, consider updating all of them.

We try to keep allowed-endpoints with one per line. Prettier wants to wrap them, which we fix this with prettier-ignore.

Testing

We keep around an action-test branch in carbon-lang, which can be used to test triggers with push: configurations. For example:

on:
  push:
    branches: [action-test]