twokey.yml

# .github/workflows/twokey.yml
#
# Runs twokey when a PR opens or its commits change. All code here
# comes from the BASE branch (pull_request_target), so a PR can't
# change how it's checked. The PR is only ever read as git data.
#
# Setup (see README "GitHub setup"):
#  1. Copy integrations/github/run.sh to .github/twokey/run.sh.
#  2. Optional: create a GitHub App (Commit statuses: write), store its Client ID in the
#     TWOKEY_APP_CLIENT_ID variable and key in the TWOKEY_APP_KEY secret of an
#     environment named "twokey" limited to your protected branches.
#  3. Branch ruleset: require status check "twokey/policy" (or
#     "twokey/policy (<branch>)" for other bases listed in TWOKEY_BASES), with
#     the expected source set to your App. Without an App, a workflow added by a
#     PR could post a fake status under the same name, so the App is what makes
#     this binding.
#
# Keep third-party actions pinned to commit SHAs when updating your copy.
#
# Do NOT add steps that build, test or otherwise execute PR code here.
name: twokey

on:
  pull_request_target:
    # `edited` re-runs the check when the PR is retargeted to another base.
    types: [opened, synchronize, reopened, ready_for_review, edited]

permissions:
  contents: read
  pull-requests: write # sticky summary comment
  statuses: write # fallback status when no App is configured

jobs:
  twokey:
    runs-on: ubuntu-latest
    environment: twokey
    concurrency:
      # Serialize checks for the same head commit.
      group: twokey-${{ github.event.pull_request.head.sha }}
      cancel-in-progress: true
    steps:
      - name: Check out trusted base (scripts and policy come from here)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: App token
        id: app
        if: ${{ vars.TWOKEY_APP_CLIENT_ID != '' }}
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ vars.TWOKEY_APP_CLIENT_ID }}
          private-key: ${{ secrets.TWOKEY_APP_KEY }}
          owner: ${{ github.repository_owner }}

      - name: Install twokey (pinned release, checksum verified)
        # Pin the action to a commit SHA, and the archive to its sha256 (from the
        # release's SHA256SUMS), so a replaced release can't run here.
        uses: Azazel-Labs/twokey@COMMIT_SHA
        with:
          version: "<release-tag>"
          sha256: "<sha256 of the release x86_64-unknown-linux-musl archive>"

      - name: twokey
        env:
          GH_TOKEN: ${{ github.token }}
          APP_TOKEN: ${{ steps.app.outputs.token }}
          DRY_RUN: ${{ vars.TWOKEY_DRY_RUN }} # set to "true" while tuning the policy
          PR_NUMBER: ${{ github.event.pull_request.number }}
          # TWOKEY_BASES: main,release  # bases this check may vouch for (default: default branch)
        run: |
          bash .github/twokey/run.sh "$PR_NUMBER"