qwqcode
76066bbdc0
Pin every third-party action to an immutable commit, enforce least-privilege tokens, avoid persisted checkout credentials, and validate all user-controlled values before they reach scripts.\n\nKeep dry-run GoReleaser jobs tokenless, publish npm provenance, generate tags through authenticated GitHub API calls, disable shared caches for release artifacts, and continuously audit workflow syntax and security policy.
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
name: Test Workflows
|
|
|
|
on:
|
|
push:
|
|
paths: [".github/**"]
|
|
branches-ignore: ["release/*", "nightly"]
|
|
tags-ignore: ["v*"]
|
|
pull_request:
|
|
paths: [".github/**"]
|
|
branches-ignore: ["release/*", "nightly"]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: test-workflows-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: Validate Actions and security policy
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Validate workflow syntax
|
|
run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color
|
|
|
|
- name: Install zizmor
|
|
run: |
|
|
python3 -m venv "$RUNNER_TEMP/zizmor"
|
|
"$RUNNER_TEMP/zizmor/bin/pip" install --disable-pip-version-check zizmor==1.28.0
|
|
|
|
- name: Audit workflow security
|
|
run: |
|
|
"$RUNNER_TEMP/zizmor/bin/zizmor" --format github .github
|