mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-08-28 05:25:25 +00:00
51095c19f8
Some checks are pending
Gitleaks / gitleaks (push) Waiting to run
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](ece7cb06ca...5fda3b95a4)
---
updated-dependencies:
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
85 lines
2.7 KiB
YAML
85 lines
2.7 KiB
YAML
name: Workflow Lint
|
|
|
|
# Lints .github/workflows/** for both:
|
|
# - actionlint: YAML syntax, expression typing, shellcheck inside `run:`
|
|
# blocks, unknown contexts, deprecated runner labels.
|
|
# - zizmor: security misconfigurations — unpinned actions, dangerous
|
|
# `${{ }}` interpolation, missing per-job permissions, etc.
|
|
#
|
|
# Scoped to PRs that touch .github/** only — keeps off the typical PR
|
|
# critical path.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
actionlint:
|
|
name: actionlint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Pinned to v2.1.2. Verify SHA via:
|
|
# gh api repos/raven-actions/actionlint/git/refs/tags/v2.1.2
|
|
# The action wraps the upstream `rhysd/actionlint` binary and emits
|
|
# GitHub-annotation-formatted findings on PRs.
|
|
- name: Run actionlint
|
|
uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
|
|
with:
|
|
fail-on-error: true
|
|
|
|
zizmor:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install zizmor
|
|
# Pinned — resolves to whatever's latest on PyPI otherwise.
|
|
# Bump via Dependabot pip ecosystem (see .github/dependabot.yml).
|
|
run: pipx install zizmor==1.24.1
|
|
|
|
# Initial threshold: medium. High+ findings fail the job; medium findings
|
|
# appear in the Security tab without blocking. Tune after first run.
|
|
# Per-rule exemptions for pre-existing intentional patterns live in
|
|
# .github/zizmor.yml (each carries a documented mitigation).
|
|
- name: Run zizmor
|
|
run: zizmor --config .github/zizmor.yml --format sarif --min-severity medium . > zizmor.sarif
|
|
continue-on-error: true
|
|
|
|
- name: Upload SARIF
|
|
uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
|
|
with:
|
|
sarif_file: zizmor.sarif
|
|
category: zizmor
|
|
|
|
- name: Fail on high+ findings
|
|
run: zizmor --config .github/zizmor.yml --min-severity high .
|