Skip to content

Commit bf1ecec

Browse files
ondrejmirtesondrejmirtes
committed
Lint workflows
1 parent fa93f1c commit bf1ecec

File tree

4 files changed

+153
-1
lines changed

4 files changed

+153
-1
lines changed

‎.github/actionlint-matcher.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}

‎.github/actionlint.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
self-hosted-runner:
2+
# Labels of self-hosted runner in array of strings.
3+
labels: []
4+
5+
# Configuration variables in array of strings defined in your repository or
6+
# organization. `null` means disabling configuration variables check.
7+
# Empty array means no configuration variable is allowed.
8+
config-variables: null
9+
10+
# Configuration for file paths. The keys are glob patterns to match to file
11+
# paths relative to the repository root. The values are the configurations for
12+
# the file paths. Note that the path separator is always '/'.
13+
# The following configurations are available.
14+
#
15+
# "ignore" is an array of regular expression patterns. Matched error messages
16+
# are ignored. This is similar to the "-ignore" command line option.
17+
paths:
18+
.github/workflows/**/*.{yml,yaml}:
19+
# List of regular expressions to filter errors by the error messages.
20+
ignore:
21+
# Ignore the specific error from shellcheck
22+
- 'shellcheck reported issue in this script: SC2129:.+'

‎.github/workflows/backward-compatibility.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,4 @@ jobs:
4242
run: "composer global require --dev roave/backward-compatibility-check"
4343

4444
- name: "Check"
45-
run: "$(composer global config bin-dir --absolute)/roave-backward-compatibility-check"
45+
run: '"$(composer global config bin-dir --absolute)/roave-backward-compatibility-check"'

‎.github/workflows/lint-workflows.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# Configuration from:
2+
# https://github.com/johnbillion/plugin-infrastructure/blob/571cba96190304963285181e2b928d941b9ec7c4/.github/workflows/reusable-workflow-lint.yml
3+
4+
name: Lint GitHub Actions workflows
5+
on:
6+
pull_request:
7+
push:
8+
branches:
9+
- "2.3.x"
10+
11+
permissions: {}
12+
13+
jobs:
14+
actionlint:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Harden the runner (Audit all outbound calls)
18+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
19+
with:
20+
egress-policy: audit
21+
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
- name: Check workflow files
24+
run: |
25+
echo "::add-matcher::.github/actionlint-matcher.json"
26+
bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
27+
./actionlint -color
28+
shell: bash
29+
30+
octoscan:
31+
name: Octoscan
32+
runs-on: ubuntu-latest
33+
permissions:
34+
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
35+
timeout-minutes: 10
36+
steps:
37+
- name: Harden the runner (Audit all outbound calls)
38+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
39+
with:
40+
egress-policy: audit
41+
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
43+
- name: Run octoscan
44+
id: octoscan
45+
uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
46+
with:
47+
filter_triggers: ''
48+
49+
- name: Upload SARIF file to GitHub
50+
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
51+
with:
52+
sarif_file: "${{steps.octoscan.outputs.sarif_output}}"
53+
category: octoscan
54+
wait-for-processing: false
55+
56+
poutine:
57+
name: Poutine
58+
runs-on: ubuntu-latest
59+
permissions:
60+
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
61+
steps:
62+
- name: Harden the runner (Audit all outbound calls)
63+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
64+
with:
65+
egress-policy: audit
66+
67+
- name: Checkout repository
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
69+
with:
70+
persist-credentials: false
71+
72+
- name: Run Poutine
73+
uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2
74+
75+
- name: Upload poutine SARIF file
76+
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
77+
with:
78+
sarif_file: results.sarif
79+
category: poutine
80+
wait-for-processing: false
81+
82+
zizmor:
83+
name: Zizmor
84+
runs-on: ubuntu-latest
85+
permissions:
86+
security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
87+
steps:
88+
- name: Harden the runner (Audit all outbound calls)
89+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
90+
with:
91+
egress-policy: audit
92+
93+
- name: Checkout repository
94+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
95+
with:
96+
persist-credentials: false
97+
98+
- name: Install the latest version of uv
99+
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
100+
with:
101+
enable-cache: false
102+
103+
- name: Run zizmor
104+
run: uvx zizmor@1.20.0 --persona=auditor --format=sarif --strict-collection . > results.sarif
105+
env:
106+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
107+
108+
- name: Upload SARIF file
109+
uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
110+
with:
111+
sarif_file: results.sarif
112+
category: zizmor
113+
wait-for-processing: false

0 commit comments

Comments
 (0)