Add Build-Gate environment and checkout fix

.github/workflows/analysis.yml

@@ -6,6 +6,7 @@ on:
     tags-ignore:
       - '**'
   pull_request:
+    types: [opened, synchronize, reopened]
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }}
   cancel-in-progress: true
@@ -19,7 +20,7 @@ jobs:
     runs-on: ${{ matrix.os }}-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -35,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Go with cache
         uses: jfrog/.github/actions/install-go-with-cache@main
@@ -55,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Go with cache
         uses: jfrog/.github/actions/install-go-with-cache@main
@@ -69,7 +70,7 @@ jobs:
     name: Spell Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Check spelling
         uses: crate-ci/typos@master

.github/workflows/build-gate.yml

@@ -0,0 +1,52 @@
+name: Build Gate
+# Single approval gate for fork/PR runs: a maintainer approves the `build-gate`
+# environment deployment once, releasing frogbot and the test suite.
+# Replaces the per-workflow 'safe to test' label mechanism.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: [dev]
+  push:
+    branches: [dev, main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  pull-requests: write
+  contents: read
+
+jobs:
+  # The single approval point. `build-gate` carries the Required-reviewers rule.
+  # Trusted push & manual dispatch skip approval (empty environment name = no gate).
+  gate:
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'pull_request_target' && 'build-gate' || '' }}
+    steps:
+      - run: echo "Approved — releasing frogbot and test suite."
+
+  tests:
+    needs: gate
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  # Single, stable required status check. Point branch protection at
+  # "Build Gate / build-gate-success" instead of the matrix-expanded suite checks.
+  build-gate-success:
+    name: build-gate-success
+    if: always()
+    needs:
+      - gate
+      - tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify no suite failed or was cancelled
+        run: |
+          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
+            echo "::error::One or more suites failed or were cancelled."
+            exit 1
+          fi
+          echo "All suites succeeded (skipped suites are allowed)."

.github/workflows/embedded-jar-test.yml

@@ -13,7 +13,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Download JARs
         run: buildscripts/download-jars.sh

.github/workflows/frogbot-scan.yml

@@ -0,0 +1,54 @@
+name: "Frogbot Scan"
+on:
+  pull_request_target:
+    types: [ opened, synchronize ]
+    branches: [ dev, main ]
+  push:
+    branches: [ dev, main ]
+  workflow_dispatch:
+  schedule:
+    # The repository will be scanned once a day at 00:00 GMT.
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  frogbot-scan:
+    runs-on: ubuntu-latest
+    # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the
+    # "frogbot" GitHub environment can approve the pull request to be scanned.
+    environment: ${{ github.event_name == 'pull_request_target' && 'frogbot' || '' }}
+    strategy:
+      matrix:
+        # Repository scans cover these branches; job `if` collapses push/PR to a single arm.
+        branch: [ dev, main ]
+    # schedule / dispatch → both arms; push → matching branch only; PR → base branch only (one PR scan).
+    if: |
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && matrix.branch == github.ref_name) ||
+      (github.event_name == 'pull_request_target' && matrix.branch == github.event.pull_request.base.ref)
+    steps:
+      # No checkout: Frogbot checks out the right refs itself. Avoids checking out untrusted PR
+      # heads under pull_request_target (secrets available).
+      - uses: jfrog/frogbot@v3
+        env:
+          JFROG_CLI_LOG_LEVEL: "DEBUG"
+          # [Mandatory]
+          # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
+          JF_URL: ${{ secrets.FROGBOT_URL }}
+
+          # [Mandatory if JF_USER and JF_PASSWORD are not provided]
+          # JFrog access token with 'read' permissions on Xray service
+          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
+
+          # [Mandatory]
+          # The GitHub token is automatically generated for the job
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # [Mandatory for repository scan]
+          # The name of the branch on which Frogbot will perform the scan
+          JF_GIT_BASE_BRANCH: ${{ github.event_name != 'pull_request_target' && matrix.branch || '' }}

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           echo "CI=true" >> $GITHUB_ENV
 
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # fetch all branches so we can checkout main and merge dev
           token: ${{ secrets.RELEASE_GIT_TOKEN }}