mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-23 00:41:36 +00:00
1150eea98f
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](de0fac2e45...df4cb1c069)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
85 lines
2.7 KiB
YAML
85 lines
2.7 KiB
YAML
name: Workflow Lint
|
|
|
|
# Lints .github/workflows/** for both:
|
|
# - actionlint: YAML syntax, expression typing, shellcheck inside `run:`
|
|
# blocks, unknown contexts, deprecated runner labels.
|
|
# - zizmor: security misconfigurations — unpinned actions, dangerous
|
|
# `${{ }}` interpolation, missing per-job permissions, etc.
|
|
#
|
|
# Scoped to PRs that touch .github/** only — keeps off the typical PR
|
|
# critical path.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
actionlint:
|
|
name: actionlint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Pinned to v2.1.2. Verify SHA via:
|
|
# gh api repos/raven-actions/actionlint/git/refs/tags/v2.1.2
|
|
# The action wraps the upstream `rhysd/actionlint` binary and emits
|
|
# GitHub-annotation-formatted findings on PRs.
|
|
- name: Run actionlint
|
|
uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
|
|
with:
|
|
fail-on-error: true
|
|
|
|
zizmor:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install zizmor
|
|
# Pinned — resolves to whatever's latest on PyPI otherwise.
|
|
# Bump via Dependabot pip ecosystem (see .github/dependabot.yml).
|
|
run: pipx install zizmor==1.24.1
|
|
|
|
# Initial threshold: medium. High+ findings fail the job; medium findings
|
|
# appear in the Security tab without blocking. Tune after first run.
|
|
# Per-rule exemptions for pre-existing intentional patterns live in
|
|
# .github/zizmor.yml (each carries a documented mitigation).
|
|
- name: Run zizmor
|
|
run: zizmor --config .github/zizmor.yml --format sarif --min-severity medium . > zizmor.sarif
|
|
continue-on-error: true
|
|
|
|
- name: Upload SARIF
|
|
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
|
|
with:
|
|
sarif_file: zizmor.sarif
|
|
category: zizmor
|
|
|
|
- name: Fail on high+ findings
|
|
run: zizmor --config .github/zizmor.yml --min-severity high .
|