mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
Myasnikov Daniil
76ad921fdd
Raise the OpenSSF Scorecard Token-Permissions and Pinned-Dependencies checks (both currently 0/10) ahead of CNCF Incubation due diligence: - Declare a top-level read-only default (permissions: contents: read) in every workflow, plus an explicit per-job permissions: block that grants only the writes that job actually needs. Workflows that previously held write scopes at the workflow level (backport, pr-labeler, pr-size, stale) now hold them at job level instead. - Pin every GitHub-owned and third-party action to a full commit SHA with a version comment. scorecard.yml was already pinned in #2721. No triggers, job graph, or step logic change; only token scopes and action refs. Self-hosted release jobs keep the exact write scopes they already declared. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
name: Pre-Commit Checks
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
concurrency:
|
|
group: pre-commit-${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
# Top-level token defaults to read-only; jobs request the minimum extra scopes.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pre-commit:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install pre-commit
|
|
run: pip install pre-commit
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Pre-fetch k8s.io/code-generator module
|
|
# The repo-root pre-commit hook (run-make-generate-root) shells out to
|
|
# hack/update-codegen.sh, which sources kube_codegen.sh from the Go
|
|
# module cache. The module is not declared in go.mod, so fetch it
|
|
# explicitly at the version pinned in the script - mirrors the
|
|
# equivalent step in codegen-drift.yml.
|
|
run: |
|
|
version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
|
|
tmpdir=$(mktemp -d)
|
|
cd "$tmpdir"
|
|
go mod init codegen-fetch
|
|
go get "k8s.io/code-generator@${version}"
|
|
|
|
- name: Install generate
|
|
run: |
|
|
curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.6.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
|
|
|
|
- name: Run pre-commit hooks
|
|
run: |
|
|
git fetch origin main || git fetch origin master
|
|
base_commit=$(git rev-parse --verify origin/main || git rev-parse --verify origin/master || echo "")
|
|
|
|
if [ -z "$base_commit" ]; then
|
|
files=$(git ls-files '*.yaml' '*.md')
|
|
else
|
|
files=$(git diff --name-only "$base_commit" -- '*.yaml' '*.md')
|
|
fi
|
|
|
|
if [ -n "$files" ]; then
|
|
echo "$files" | xargs pre-commit run --files
|
|
else
|
|
echo "No YAML or Markdown files to lint"
|
|
fi
|