mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov Daniil
76ad921fdd
Raise the OpenSSF Scorecard Token-Permissions and Pinned-Dependencies checks (both currently 0/10) ahead of CNCF Incubation due diligence: - Declare a top-level read-only default (permissions: contents: read) in every workflow, plus an explicit per-job permissions: block that grants only the writes that job actually needs. Workflows that previously held write scopes at the workflow level (backport, pr-labeler, pr-size, stale) now hold them at job level instead. - Pin every GitHub-owned and third-party action to a full commit SHA with a version comment. scorecard.yml was already pinned in #2721. No triggers, job graph, or step logic change; only token scopes and action refs. Self-hosted release jobs keep the exact write scopes they already declared. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
96 lines
3.8 KiB
YAML
96 lines
3.8 KiB
YAML
name: PR size label
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
# Top-level token defaults to read-only; jobs request the minimum extra scopes.
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: pr-size-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
size:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
pull-requests: write
|
|
steps:
|
|
- uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
script: |
|
|
const pr = context.payload.pull_request;
|
|
|
|
// Skip files that should not count as "real diff" — they are produced by tools,
|
|
// not authored by humans, and including them lies to reviewers about review effort:
|
|
// - vendored Go deps,
|
|
// - kubebuilder/openapi inline generated files (zz_generated.{deepcopy,conversion,defaults,openapi}.go),
|
|
// - whole code-generated trees from client-gen / lister-gen / applyconfiguration-gen
|
|
// and protobuf (any path under a `generated/` directory or ending in `.pb.go`),
|
|
// - vendored Helm charts,
|
|
// - lockfiles.
|
|
const isIgnored = (path) =>
|
|
path.startsWith('vendor/') ||
|
|
/\bzz_generated\.[^/]*\.go$/.test(path) ||
|
|
/(^|\/)generated\//.test(path) ||
|
|
path.endsWith('.pb.go') ||
|
|
/^packages\/system\/[^/]+\/charts\//.test(path) ||
|
|
path === 'go.sum' || path.endsWith('/go.sum') ||
|
|
path.endsWith('.lock') || path.endsWith('.lockb');
|
|
|
|
const files = await github.paginate(github.rest.pulls.listFiles, {
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: pr.number,
|
|
});
|
|
const lines = files
|
|
.filter((f) => !isIgnored(f.filename))
|
|
.reduce((acc, f) => acc + (f.additions || 0) + (f.deletions || 0), 0);
|
|
|
|
// Thresholds match the descriptions of size/* labels in .github/labels.yml.
|
|
const bucket =
|
|
lines <= 9 ? 'XS' :
|
|
lines <= 29 ? 'S' :
|
|
lines <= 99 ? 'M' :
|
|
lines <= 499 ? 'L' :
|
|
lines <= 999 ? 'XL' : 'XXL';
|
|
const target = `size/${bucket}`;
|
|
|
|
// Match both legacy "size:" and canonical "size/" during the migration window.
|
|
const existing = (pr.labels || []).map((l) => l.name);
|
|
const oldSizes = existing.filter((n) => n.startsWith('size/') || n.startsWith('size:'));
|
|
const alreadyTarget = oldSizes.includes(target);
|
|
|
|
// Remove every size/* label that is not the target. Tolerate 404 — concurrent
|
|
// runs or manual edits between event payload and execution can race here.
|
|
for (const name of oldSizes) {
|
|
if (name === target) continue;
|
|
try {
|
|
await github.rest.issues.removeLabel({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: pr.number,
|
|
name,
|
|
});
|
|
} catch (e) {
|
|
if (e.status !== 404) throw e;
|
|
core.info(`label ${name} already gone (404)`);
|
|
}
|
|
}
|
|
|
|
if (alreadyTarget && oldSizes.length === 1) {
|
|
core.info(`PR #${pr.number}: ${lines} lines, label already ${target}`);
|
|
return;
|
|
}
|
|
if (!alreadyTarget) {
|
|
await github.rest.issues.addLabels({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: pr.number,
|
|
labels: [target],
|
|
});
|
|
}
|
|
core.info(`PR #${pr.number}: ${lines} lines -> ${target}`);
|