José Almeida
85 lines
3.1 KiB
YAML
85 lines
3.1 KiB
YAML
name: Lint Action Pinning
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
- ".github/scripts/claude-code-review-workflow-contract_test.py"
|
|
- ".github/scripts/collect-macos-desktop-diagnostics.sh"
|
|
- ".github/scripts/release-workflow-contract_test.py"
|
|
- ".github/release-signing-key.asc"
|
|
- "docs/public/release-process.md"
|
|
- "scripts/release/npm-packages.sh"
|
|
- "scripts/release/nightly-version.mjs"
|
|
- "scripts/release/nightly-version.test.mjs"
|
|
- "scripts/release/nightly-release.sh"
|
|
- "scripts/release/nightly-release.test.mjs"
|
|
- "scripts/release/npm-view-version.sh"
|
|
- "scripts/release/npm-view-version.test.mjs"
|
|
- "scripts/release/package-npm-runtime.sh"
|
|
- "scripts/release/publish-npm.sh"
|
|
- "scripts/release/publish-npm.test.mjs"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
- ".github/scripts/claude-code-review-workflow-contract_test.py"
|
|
- ".github/scripts/collect-macos-desktop-diagnostics.sh"
|
|
- ".github/scripts/release-workflow-contract_test.py"
|
|
- ".github/release-signing-key.asc"
|
|
- "docs/public/release-process.md"
|
|
- "scripts/release/npm-packages.sh"
|
|
- "scripts/release/nightly-version.mjs"
|
|
- "scripts/release/nightly-version.test.mjs"
|
|
- "scripts/release/nightly-release.sh"
|
|
- "scripts/release/nightly-release.test.mjs"
|
|
- "scripts/release/npm-view-version.sh"
|
|
- "scripts/release/npm-view-version.test.mjs"
|
|
- "scripts/release/package-npm-runtime.sh"
|
|
- "scripts/release/publish-npm.sh"
|
|
- "scripts/release/publish-npm.test.mjs"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Least-privilege: only reads source.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: All action refs are SHA-pinned
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Test action-pinning lint
|
|
run: python3 .github/scripts/lint-action-pinning_test.py
|
|
|
|
- name: Test Claude Code review workflow contract
|
|
run: python3 .github/scripts/claude-code-review-workflow-contract_test.py
|
|
|
|
- name: Test release workflow contract
|
|
run: python3 .github/scripts/release-workflow-contract_test.py
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: "24"
|
|
|
|
- name: Test npm release helpers
|
|
run: node --test scripts/release/nightly-version.test.mjs scripts/release/nightly-release.test.mjs scripts/release/npm-view-version.test.mjs scripts/release/publish-npm.test.mjs
|
|
|
|
- name: Verify action refs
|
|
run: python3 .github/scripts/lint-action-pinning.py
|