* ci: use GitHub API to produce verified commits in socket-fix workflow
Replace git commit/push with the GitHub Git Data API (blobs, trees,
commits) so the resulting PR commit is signed and verified by GitHub,
matching the approach used in update-dep.yml.
* ci: disable socket fix CI mode to prevent auto-PR creation
* ci: address code review feedback on open-pr step
- Add set -eEo pipefail / shopt -s inherit_errexit
- Use git status --porcelain to catch new and deleted files
- Read file mode from git index instead of hardcoding 100644
- Use base64 -w 0 to avoid line-wrap corruption
- Handle existing branch on workflow rerun
- Handle existing PR on workflow rerun
- Support comma-separated issue_link for multiple GHSAs
- Include WDP/Leo PR links in body when refs are provided
* ci: address second round of code review feedback
- Fetch HEAD_SHA from master ref via API to guard against workflow
dispatch on a non-master ref
- Switch to git status --porcelain=v1 -z (NUL-delimited) to handle
filenames with spaces and rename/copy entries correctly
- Use @<(...) process substitution for blob content to avoid hitting
shell argument length limits on large files like package-lock.json
* ci: fix gh pr create missing --head and rename tree deletion
- Add --head "$BRANCH" to gh pr create so the PR is opened from the
API-created branch rather than the currently checked-out branch
- Emit a null-sha tree entry for the source path of rename operations
so the old path is removed from the resulting commit
* Introduce a script which can be used to help triage brave browser repos.
Two current modes:
- team report (--team <comma separated list of GitHub IDs>: list count issues and pull requests assigned
- stale issue automation (--stale): ID and close issues based on configurable criteria.
Lots of configuration parameters available, including a --dry-run which
is read only.
Requires a GitHub API token to be created.
Change made to script/lib/github.py allows us to inspect response
headers for the purpose of paging results.
Extends the brave-core socket-fix workflow to accept optional commit
hashes for web-discovery-project (DEPS) and @brave/leo (package.json).
When provided, the workflow updates these references before running
socket fix, enabling a single PR for both upstream hash bumps and
direct transitive dependency fixes. Also makes issue_link required
so brave-core PRs always close the tracking issue.
* ci: add Socket Fix workflow
Adds a workflow_dispatch CI workflow to apply socket fix for a given
set of GHSA IDs and open a pull request with the changes.
* ci: pin node to v24 major and add CI/skip label to generated PRs
* ci: use brave-builds user for consistency with other workflows
* ci: add security label and issue_link input to socket-fix workflow
Relocate the WASM workspace from ui/webui/resources/wasm/ to
third_party/wasm/, following the convention of third_party/rust/.
This is a plain move with path updates — no structural changes to
the workspace, crate locations within it, or build targets.
Other DEPS files are covered by netzenbot's automated checks
and gn check. Root DEPS is a code execution channel on checkout
and chromium_src DEPS can't be validated by gn check, so those
still need manual review.
Remove land-grab CODEOWNERS rules for Brave Account
The *brave_account* and *BraveAccount* wildcard rules match any file
path containing those strings, which is overly broad and triggers
unnecessary reviews. This is a "land-grab" pattern that taxes
productivity for developers who trigger those reviews.
Remove dead CODEOWNERS rules for deleted files
- script/build-bisect.py: file was removed
- browser/ui/webui/brave_web_uicontroller_factory.cc: file was removed
- browser/ui/webui/brave_rewards_page_ui.{cc,h}: files were removed
- browser/ui/webui/brave_rewards_ui.{cc,h}: files were removed
- third_party/boost: directory was removed
- brave/components/l10n/: wrong path prefix (brave/) so it never
matched anything, and the component is deprecated anyway
Mihai PLESA