mirror of
https://github.com/usestrix/strix.git
synced 2026-10-13 03:57:59 +00:00
a6aa4033ae
Add uv lock --check, a wheel install smoke test, a PyInstaller dry run, actionlint and zizmor on the workflows, CodeQL, and Dependabot for action pins, uv, Go and npm dependencies. Release caches are disabled so zizmor's cache-poisoning audit passes.
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
name: Workflows
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
actionlint:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
ACTIONLINT_VERSION: 1.7.12
|
|
ACTIONLINT_SCRIPT_REF: 914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install actionlint
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/actionlint"
|
|
curl -fsSL --retry 5 -o "$RUNNER_TEMP/actionlint/download.bash" \
|
|
"https://raw.githubusercontent.com/rhysd/actionlint/$ACTIONLINT_SCRIPT_REF/scripts/download-actionlint.bash"
|
|
bash "$RUNNER_TEMP/actionlint/download.bash" "$ACTIONLINT_VERSION" "$RUNNER_TEMP/actionlint"
|
|
- run: |
|
|
"$RUNNER_TEMP/actionlint/actionlint" -color
|
|
|
|
zizmor:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
|
with:
|
|
advanced-security: false
|
|
version: 1.22.0
|