Carlos Florêncio
ec942540bc
* ci: harden action pinning lint * refactor: extract dockview review dialog slot * test: cover action pinning edge cases * fix: reject dynamic workflow action sources * fix: normalize quoted workflow action refs * test: cover quoted unpinned action refs --------- Co-authored-by: root <root@kandev.ts.net>
41 lines
997 B
YAML
41 lines
997 B
YAML
name: Lint Action Pinning
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Least-privilege: only reads source.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: All action refs are SHA-pinned
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Test action-pinning lint
|
|
run: python3 .github/scripts/lint-action-pinning_test.py
|
|
|
|
- name: Verify action refs
|
|
run: python3 .github/scripts/lint-action-pinning.py
|