♻️ci: refactor workflows (#538)

* ♻️ci: refactor workflows

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

.gitattributes

@@ -10,6 +10,7 @@
 *.md text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.mjs text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 *.mts text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
+*.txt text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 .dockerignore text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 .editorconfig text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
 .gitattributes text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2

.github/labeler.yml

@@ -1,6 +1,6 @@
 🍱asset:
 - changed-files:
-  - any-glob-to-any-file: 'public/**'
+  - any-glob-to-any-file: ['app/favicon.ico', 'public/**', 'app/**/*.png', 'app/**/*.svg']
 ♻️ci:
 - changed-files:
   - any-glob-to-any-file: '.github/**/*.yml'
@@ -15,7 +15,7 @@ docker:
   - any-glob-to-any-file: ['.dockerignore', 'Dockerfile']
 📝documentation:
 - changed-files:
-  - any-glob-to-any-file: '**/*.md'
+  - any-glob-to-any-file: ['**/*.md', '**/*.txt']
 🚀enhancement:
 - head-branch: ['^feature', 'feature', '^enhancement', 'enhancement']
 ✨feature:

.github/workflows/auto-assign.yml

@@ -10,6 +10,10 @@ on:
       - opened
       - reopened
 
+permissions:
+  issues: write
+  pull-requests: write
+
 env:
   GH_TOKEN: ${{ github.token }}
 

.github/workflows/autofix.yml

@@ -5,10 +5,14 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  push:
   pull_request:
+  push:
+    branches: main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   quality:
     runs-on: ubuntu-24.04

.github/workflows/bun-test.yml

@@ -5,18 +5,22 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  push:
+  pull_request:
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
+      - "Dockerfile"
       - "package.json"
       - "*config.*"
-  pull_request:
+  push:
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
+      - "Dockerfile"
       - "package.json"
       - "*config.*"
   workflow_dispatch:
@@ -31,6 +35,8 @@ jobs:
 
       - name: Install bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: canary
 
       - name: Install dependencies
         run: bun i

.github/workflows/cleanup-cashes.yml

@@ -5,7 +5,9 @@ on:
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
+      - "Dockerfile"
       - "package.json"
       - "*config.*"
     types:
@@ -32,6 +34,6 @@ jobs:
           done
           echo "Done"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/docker.yml

@@ -5,18 +5,23 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  push:
+  pull_request_target:
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
+      - "Dockerfile"
       - "package.json"
       - "*config.*"
-  pull_request_target:
+  push:
+    branches: main
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
+      - "Dockerfile"
       - "package.json"
       - "*config.*"
   workflow_dispatch:
@@ -27,23 +32,24 @@ on:
         default: false
         type: boolean
 
+permissions:
+  attestations: write
+  contents: read
+  id-token: write
+  packages: write
+  pull-requests: write
+
 env:
-  REPOSITORY_OWNER: openup-labtakizawa
   REPOSITORY: marukome0743/homepage
   GHCR_REGISTRY: ghcr.io
   GHCR_REPOSITORY: openup-labtakizawa/homepage
   SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
-  IS_PUSH: ${{ github.ref_type == 'tag' || inputs.push || github.event_name == 'push' && github.repository_owner == 'openup-labtakizawa' && github.ref_name == 'main' }}
+  IS_PUSH: ${{ github.event_name == 'push' || github.ref_type == 'tag' || inputs.push }}
 
 jobs:
   build:
     runs-on: ubuntu-24.04
-    permissions:
-      attestations: write
-      contents: read
-      id-token: write
-      packages: write
-      pull-requests: write
+    if: github.repository_owner == 'openup-labtakizawa'
 
     steps:
       - name: Checkout
@@ -58,7 +64,6 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        if: github.repository_owner == env.REPOSITORY_OWNER
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
@@ -111,7 +116,7 @@ jobs:
           subject-digest: ${{ steps.push.outputs.digest }}
 
       - name: Docker Scout
-        if: github.repository_owner == env.REPOSITORY_OWNER && github.event_name == 'pull_request_target'
+        if: github.event_name == 'pull_request_target'
         uses: docker/scout-action@v1
         with:
           command: compare,cves,recommendations

.github/workflows/lambda.yml

@@ -10,6 +10,7 @@ on:
     paths:
       - "app/**"
       - "public/**"
+      - ".dockerignore"
       - "bun.lockb"
       - "package.json"
       - "*config.*"