ci: various improvements

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,4 @@
+---
+labels: needs-triage
+---
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+<!--
+
+Please add a reference to the issue that this PR addresses and indicate which
+files are most critical to review. If it fully addresses a particular issue,
+please include "Closes #XXX" (where "XXX" is the issue number).
+
+-->
+
+---
+
+#### PR checklist
+
+- [ ] Tests written/updated
+- [ ] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog)

.github/dependabot.yml

@@ -3,14 +3,23 @@ updates:
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
-      time: "11:00"
+      interval: weekly
+    target-branch: "main"
     open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - automerge
+
+  ###################################
+  ##
+  ## Update All Go Dependencies
+
   - package-ecosystem: gomod
     directory: "/"
     schedule:
-      interval: daily
-      time: "11:00"
+      interval: weekly
+    target-branch: "main"
     open-pull-requests-limit: 10
     labels:
       - dependencies
+      - automerge

.github/linters/yaml-lint.yml

@@ -0,0 +1,9 @@
+---
+# Default rules for YAML linting from super-linter.
+# See: See https://yamllint.readthedocs.io/en/stable/rules.html
+extends: default
+rules:
+  document-end: disable
+  document-start: disable
+  line-length: disable
+  truthy: disable

.github/mergify.yml

@@ -0,0 +1,25 @@
+pull_request_rules:
+  - name: automatic approval for Dependabot pull requests
+    conditions:
+      - author=dependabot[bot]
+    actions:
+      review:
+        type: APPROVE
+        message: Automatically approving dependabot
+
+  - name: automatically merge PR with automerge label
+    conditions:
+      - '-label=manual-backport'
+      - label=automerge
+    actions:
+      merge:
+        method: squash
+
+  - name: Make sure PR are up to date before merging
+    description: >-
+      This automatically updates PRs when they are out-of-date with the base
+      branch to avoid semantic conflicts (next step is using a merge queue).
+    conditions:
+      - '-draft'
+    actions:
+      update:

.github/workflows/ci-fast.yml

@@ -0,0 +1,37 @@
+name: Test fast (no changes to Dockerfile)
+
+on:
+  pull_request:
+    paths-ignore:
+      - "tools/**"
+  merge_group:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "tools/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  test-fast:
+    runs-on: ubuntu-latest
+    container: cometbft/cometbft-db-testing
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: test & coverage report creation
+        run: |
+          NON_INTERACTIVE=1 make test-all-with-coverage
+
+      - uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage.txt

.github/workflows/ci.yml

@@ -2,21 +2,23 @@
 #   make docker-test
 
 name: Test
+
 on:
+  pull_request:
+    paths:
+      - tools/Dockerfile
+  merge_group:
   push:
     branches:
       - main
-  merge_group:
-  pull_request:
-jobs:
-  cleanup-runs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: rokroskar/workflow-run-cleanup-action@master
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-    if: "!startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/heads/main'"
+    paths:
+      - tools/Dockerfile
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
   Test:
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql.yml

@@ -12,13 +12,16 @@
 name: "CodeQL"
 
 on:
-  workflow_dispatch:
+  workflow_dispatch:  # allow running workflow manually
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
-  merge_group:
+    branches: ["main"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   analyze:

.github/workflows/conventional-pr-title.yml

@@ -0,0 +1,65 @@
+name: "Conventional PR Title"
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions:
+  pull-requests: write
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        id: lint_pr_title
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+              feat
+              fix
+              build
+              chore
+              ci
+              docs
+              refactor
+              perf
+              test
+              revert
+              spec
+              merge
+
+      - uses: marocchino/sticky-pull-request-comment@v2
+        # When the previous steps fails, the workflow would stop. By adding this
+        # condition you can continue the execution with the populated error message.
+        if: always() && (steps.lint_pr_title.outputs.error_message != null)
+        with:
+          header: pr-title-lint-error
+          message: |
+            Hey there and thank you for opening this pull request! 👋🏼
+
+            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.
+
+            Details:
+
+            ```
+            ${{ steps.lint_pr_title.outputs.error_message }}
+            ```
+
+            General format: `type(scope): msg`
+            Breaking change: `type(scope)!: msg`
+            Multi-scope change: `type: msg`
+            Types:  `feat`, `fix`, `build`, `chore`, `ci`, `docs`, `refactor`, `perf`, `test`, `revert`, `spec`, `merge`.
+            Example: `fix(cmd/cometbft/commands/debug): execute p.Signal only when p is not nil`
+
+      # Delete a previous comment when the issue has been resolved
+      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: pr-title-lint-error
+          delete: true

.github/workflows/docker.yml

@@ -11,10 +11,8 @@
 
 name: Docker testing image
 on:
-  workflow_dispatch:
+  workflow_dispatch:  # allow running workflow manually
   push:
-    branches:
-      - main
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"               # Push events to matching v*, i.e. v1.0, v20.15.10
       - "v[0-9]+.[0-9]+.[0-9]+-alpha.[0-9]+"  # e.g. v0.37.0-alpha.1, v0.38.0-alpha.10
@@ -26,24 +24,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Prepare
-        id: prep
-        run: |
-          DOCKER_IMAGE=cometbft/cometbft-db-testing
-          VERSION=noop
-          if [[ $GITHUB_REF == refs/tags/* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/}
-          elif [[ $GITHUB_REF == refs/heads/* ]]; then
-            VERSION=$(echo ${GITHUB_REF#refs/heads/} | sed -r 's#/+#-#g')
-            if [ "${{ github.event.repository.default_branch }}" = "$VERSION" ]; then
-              VERSION=latest
-            fi
-          fi
-          TAGS="${DOCKER_IMAGE}:${VERSION}"
-          if [[ $VERSION =~ ^v[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
-            TAGS="$TAGS,${DOCKER_IMAGE}:${VERSION}"
-          fi
-          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Build
         uses: docker/[email protected]
@@ -60,5 +40,7 @@ jobs:
           context: ./tools
           file: ./tools/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.prep.outputs.tags }}
+          push: true
+          tags: |
+            cometbft/cometbft-db-testing:latest
+            cometbft/cometbft-db-testing:${{ github.ref_name }}

.github/workflows/govulncheck.yml

@@ -6,25 +6,25 @@ name: Check for Go vulnerabilities
 # Run `make vulncheck` from the root of the repo to run this workflow locally.
 on:
   pull_request:
+  merge_group:
   push:
     branches:
       - main
-      - release/**
-  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   govulncheck:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Load Go version
-        run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ env.GO_VERSION }}
-
       - uses: technote-space/get-diff-action@v6
         with:
           PATTERNS: |

.github/workflows/lint.yml

@@ -1,10 +1,15 @@
 name: Lint
+
 on:
+  pull_request:
+  merge_group:
   push:
     branches:
       - main
-  pull_request:
-  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   golangci:
@@ -15,8 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Load Go version
-        run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/markdown-linter.yml

@@ -0,0 +1,36 @@
+name: Markdown Linter
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.md"
+      - "**.yml"
+      - "**.yaml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.md"
+      - "**.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  build:
+    name: Super linter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+      - name: Lint Code Base
+        uses: docker://github/super-linter:v4
+        env:
+          VALIDATE_ALL_CODEBASE: true
+          DEFAULT_BRANCH: main
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_MD: true
+          VALIDATE_OPENAPI: true
+          VALIDATE_YAML: true
+          YAML_CONFIG_FILE: yaml-lint.yml

.github/workflows/stale.yml

@@ -17,4 +17,4 @@ jobs:
           days-before-close: -1
           days-before-pr-stale: 10
           days-before-pr-close: 4
-          exempt-pr-labels: "pinned, security, proposal, blocked, wip"
+          exempt-pr-labels: "wip"