3 Commits

Author SHA1 Message Date
Rohit Yanamadala 00759548aa fix: resolve zizmor security findings in GitHub Actions workflows
Merge https://github.com/google/adk-python/pull/6601

This PR resolves 58 security and workflow linting findings identified by zizmor across 13 GitHub Actions workflow files.

PiperOrigin-RevId: 962236543
2026-08-10 10:35:55 -07:00
Shangjie Chen 8c4173ee5c fix(ci): Restrict GitHub Actions to main/v1 branches and main repository
Update workflows to ensure they only run on the main repository (google/adk-python)
and target main or v1 branches where applicable. This prevents workflows from
running on forks and restricts merge blocking to main branch.

Co-authored-by: Shangjie Chen <deanchen@google.com>
PiperOrigin-RevId: 940031708
2026-06-29 14:27:43 -07:00
Wei (Jack) Sun f4743cdda2 ci: Disable GitHub merge button (maintainers land changes via Copybara)
Merge https://github.com/google/adk-python/pull/6086

## Summary
- Adds `.github/workflows/block-merge.yml`, an always-failing check that keeps the GitHub merge button disabled on every PR.
- Maintainers land changes internally and Copybara syncs them back to this repo; PRs are not merged through the GitHub UI.
- The job runs standalone (no `needs:` dependents) so it does **not** block or cancel other CI checks — they still run and report normally.

On the PR page the check appears as:

> **Do Not Merge on GitHub / Do not merge — maintainers land changes via Copybara**

with the annotation:

> Do NOT merge this pull request on GitHub. A maintainer will land the change internally, and Copybara will sync it back to this repository automatically.

## Follow-up (manual, GitHub UI)
After this merges, create a branch ruleset to require the check:
1. Settings → Rules → Rulesets → **New branch ruleset**
2. Name: `Block GitHub Merge`, Enforcement: **Active**
3. Target branches → **Include default branch**
4. Rules → **Require status checks to pass** → add check **`Do not merge — maintainers land changes via Copybara`**
5. **Create**

The check name appears in the picker after this workflow runs once; otherwise type it manually.

## Test plan
- [ ] Confirm the merge-block check appears and fails on this PR
- [ ] Confirm other CI checks still run and report independently
- [ ] After ruleset is added, confirm the merge button is grayed out

Co-authored-by: Wei Sun (Jack) <weisun@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/6086 from google:ci/block-github-merge 587a03a5137c6255429dfa8be4e59abbb9dc258b
PiperOrigin-RevId: 930808152
2026-06-11 16:45:48 -07:00