[miroslavpojer]

Overview

Converges living-doc-toolkit's CI onto the canonical Phase 0 shell established in
living-doc-collector-gh (P0-A7), without flattening the per-package job strategy —
each matrix leg still runs make qa, which fans out to make qa-<alias> per package as
P0-TK-3 established.

• .github/workflows/test.yml — rebuilt with workflow-level permissions: { contents: read },
  a concurrency group (cancel-in-progress), a detect job that path-filters
  **/*.py / **/pyproject.toml / **/requirements*.txt via gh api (PR) / git diff (push),
  a noop job for docs-only changes, and a Python 3.10 → 3.14 matrix. The 3.10 leg is
  continue-on-error until living-doc-utilities publishes a Requires-Python >= 3.10
  release. The QA step now calls make qa (was the deprecated make py-qa) and installs via
  make install.
• .github/workflows/aquasec-night-scan.yml — added, byte-identical to collector-gh's
  (nightly AbsaOSS/organizational-workflows reusable AquaSec scan).
• .github/workflows/link-check.yml — added, byte-identical to collector-gh's
  (detect on **/*.md → lycheeverse/lychee-action, with a noop leg).
• .github/dependabot.yml — converged to repo-conventions.md §10.1 with the monorepo
  adaptation: one github-actions block at / plus one grouped pip block per package
  directory (/packages/core, /packages/datasets_pdf, /packages/adapters/collector_gh,
  /packages/services/normalize_issues, /packages/services/coverage_matrix, /apps/cli),
  each with the canonical auto update / infrastructure / no RN label scheme,
  commit-message.prefix: "chore", and dependency-type: "direct". Previously
  github-actions-only.
• .github/workflows/dependabot.yml (auto-merge) — aligned to collector-gh's reference;
  the github.repository == 'AbsaOSS/living-doc-toolkit' guard is the only line that differs.
  This drops the temporary # INFO: deactivated … till … Renovate guard and the commented-out
  name: / repository_dispatch trigger, so the workflow is now active (as in every other
  Phase 0 repo).
• .github/workflows/integration.yml — added permissions: { contents: read } +
  concurrency; golden-fixture / verify_golden.py / verify_compatibility.py jobs
  unchanged.
• .github/workflows/release_draft.yml — re-pinned AbsaOSS/generate-release-notes and
  softprops/action-gh-release to the repo-conventions.md §9.1 SHA set.

Release Notes

• Toolkit CI now runs a nightly AquaSec security scan and a Markdown link check, skips the
  Python QA matrix on docs-only PRs, and tests against Python 3.10–3.14; Dependabot now
  tracks pip dependencies for every package in the monorepo.

Related

Closes #54

Summary by CodeRabbit

• Chores
  • Added scheduled security scanning and automated documentation link checks.
  • Improved automated validation for Python-related changes, including broader version coverage and manual or push-based runs.
  • Updated workflow permissions and concurrency handling to improve reliability and reduce redundant runs.
  • Reactivated pull-request validation workflows.
  • Streamlined automated update handling by grouping related update requests.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: bb0cfaa4-7829-4c66-8e0b-b4cef160014d

📥 Commits

Reviewing files that changed from the base of the PR and between b95c917 and 7ec7488.

📒 Files selected for processing (7)

• .github/dependabot.yml
• .github/workflows/aquasec-night-scan.yml
• .github/workflows/dependabot.yml
• .github/workflows/integration.yml
• .github/workflows/link-check.yml
• .github/workflows/release_draft.yml
• .github/workflows/test.yml

---

Walkthrough

The pull request updates Dependabot grouping, adds package-specific pip updates, introduces conditional test and link-check workflows, adds a scheduled Aquasec scan, and aligns existing workflow triggers, permissions, concurrency, and action pins.

Changes

CI automation

Layer / File(s)	Summary
Dependency update automation .github/dependabot.yml, .github/workflows/dependabot.yml	Dependabot groups GitHub Actions and package updates. The auto-merge workflow now handles opened and synchronized pull requests.
Conditional static analysis and test workflow .github/workflows/test.yml	The workflow detects Python changes, runs a Python 3.10–3.14 matrix, uses make install and make qa, and reports when validation is skipped.
Documentation link validation .github/workflows/link-check.yml	The new workflow detects Markdown changes and runs lychee only when documentation changes.
Workflow scanning and execution controls .github/workflows/aquasec-night-scan.yml, .github/workflows/integration.yml, .github/workflows/release_draft.yml	The changes add a scheduled Aquasec scan, restrict integration permissions, cancel duplicate runs, and update pinned action commits.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Detect
  participant LinkCheck
  participant Lychee
  GitHubActions->>Detect: inspect changed Markdown files
  Detect->>LinkCheck: provide docs_changed output
  LinkCheck->>Lychee: check Markdown links and fragments

Loading

Poem

A rabbit watched the workflows run
Dependencies grouped, one by one
Python checks hopped through every lane
Links were checked through sun and rain
Aqua scanned beneath the moon

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/54-toolkit-ci-convergence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}