Repository navigation
Fix findings of the workflow linters #151
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Configuration from: | |
| # https://github.com/johnbillion/plugin-infrastructure/blob/571cba96190304963285181e2b928d941b9ec7c4/.github/workflows/reusable-workflow-lint.yml | |
| name: Lint GitHub Actions workflows | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - "2.4.x" | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} | |
| cancel-in-progress: true | |
| jobs: | |
| actionlint: | |
| name: Actionlint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check workflow files | |
| run: | | |
| echo "::add-matcher::.github/actionlint-matcher.json" | |
| curl -fsSL -o "$RUNNER_TEMP/actionlint.tar.gz" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" | |
| echo "${ACTIONLINT_SHA256} $RUNNER_TEMP/actionlint.tar.gz" | sha256sum --check --strict | |
| tar -xzf "$RUNNER_TEMP/actionlint.tar.gz" -C "$RUNNER_TEMP" actionlint | |
| "$RUNNER_TEMP/actionlint" -color | |
| shell: bash | |
| env: | |
| ACTIONLINT_VERSION: "1.7.12" | |
| # From actionlint_1.7.12_checksums.txt of the release | |
| ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8" | |
| octoscan: | |
| name: Octoscan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for codeql-action/upload-sarif to upload SARIF files. | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run octoscan | |
| id: octoscan | |
| uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0 | |
| with: | |
| filter_triggers: '' | |
| # octoscan treats every ref that is not made of letters and dashes only as custom, | |
| # and our checkouts only use fixed branches and commits of trusted repositories | |
| # (2.3.x, 2.x, a commit SHA, the matrix of our own branches). It cannot ignore | |
| # findings per file, so this message is ignored everywhere. zizmor and poutine | |
| # still check for checkouts of untrusted code. | |
| ignore: "Use of 'actions/checkout' with a custom ref" | |
| - name: Upload SARIF file to GitHub | |
| uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 | |
| with: | |
| sarif_file: "${{steps.octoscan.outputs.sarif_output}}" | |
| category: octoscan | |
| wait-for-processing: false | |
| poutine: | |
| name: Poutine | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for codeql-action/upload-sarif to upload SARIF files. | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run Poutine | |
| uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4 | |
| - name: Upload poutine SARIF file | |
| uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 | |
| with: | |
| sarif_file: results.sarif | |
| category: poutine | |
| wait-for-processing: false | |
| zizmor: | |
| name: Zizmor | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for codeql-action/upload-sarif to upload SARIF files. | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the latest version of uv | |
| uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 | |
| with: | |
| enable-cache: false | |
| - name: Run zizmor | |
| run: uvx zizmor@1.31.1 --persona=auditor --format=sarif --strict-collection . > results.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 | |
| with: | |
| sarif_file: results.sarif | |
| category: zizmor | |
| wait-for-processing: false |