ci(sync): update GitHub Actions #158
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # | |
| # DO NOT EDIT!!! | |
| # Managed by GitHub Actions | |
| # | |
| name: SAST Linting | |
| on: # yamllint disable-line rule:truthy | |
| pull_request: | |
| branches: ["dev", "develop", "main", "master"] | |
| # "... reusing cache across feature branches is not allowed to provide cache isolation. | |
| # However, if both feature branches are from the default branch, a good way to achieve this is to ensure that the default branch has a cache. | |
| # This cache will then be consumable by both feature branches." | |
| # https://github.com/actions/cache/blob/main/tips-and-workarounds.md#use-cache-across-feature-branches | |
| push: | |
| branches: ["dev", "develop", "main", "master"] # not possible to reference $github.event.repository.default_branch directly | |
| schedule: | |
| # GitHub Actions does not support the non-standard syntax @monthly, @weekly, @daily, etc. | |
| - cron: "15 0 * * *" # daily at 00:15 UTC | |
| # | |
| # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions | |
| # "all of those that are not specified are set to none." | |
| permissions: | |
| contents: write # required for trivy to upload artifacts | |
| pull-requests: read # required for commitlint | |
| security-events: write # required for trivy to upload SARIF to GitHub Security tab (master only) | |
| actions: write # required for trivy to upload SBOM artifact (master only) | |
| # | |
| concurrency: | |
| group: pre-commit-${{ github.ref }} | |
| cancel-in-progress: true | |
| # | |
| jobs: | |
| commitlint: | |
| name: commitlint | |
| if: github.event_name == 'pull_request' # no need in cache on 'master' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: commitlint | |
| # uses: ./.github/actions/commitlint/action.yaml <-- requires code checkout before | |
| uses: indykite/.github/.github/actions/commitlint@master | |
| with: | |
| is_strict: "true" | |
| release_bot: "${{ vars.RELEASE_BOT }}" | |
| pre-commit: | |
| name: pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Mint ik-code-reader installation token | |
| id: code_reader_token | |
| if: ${{ github.event.pull_request.head.repo.fork != true }} # fork PRs cannot read the PEM | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - https://github.com/actions/create-github-app-token/releases | |
| with: | |
| client-id: ${{ vars.IK_CODE_READER_CLIENT_ID }} | |
| private-key: ${{ secrets.IK_CODE_READER_PEM }} | |
| owner: indykite | |
| - name: pre-commit | |
| # uses: ./.github/actions/pre-commit/action.yaml | |
| uses: indykite/.github/.github/actions/pre-commit@master | |
| with: | |
| # shared workflow; required to do ssh://git@github.com... from another repos | |
| github_token: ${{ steps.code_reader_token.outputs.token }} | |
| checkout_fetch_master: "${{ vars.GH_CHECKOUT_FETCH_MASTER }}" | |
| action_timeout: "${{ vars.PRE_COMMIT_ACTION_TIMEOUT != null && vars.PRE_COMMIT_ACTION_TIMEOUT || 10 }}" # in minutes | |
| # comma separated list of hook ids; exclude autoupdate and branch checks on scheduled runs for cache purposes | |
| pre_commit_skip: >- | |
| commitlint,trivy,trivy-conf,trivy-filesystem,checkov,checkov_diff,terraform_validate | |
| ${{ vars.PRE_COMMIT_SKIP != null && ',' || '' }}${{ vars.PRE_COMMIT_SKIP }} | |
| ${{ format('{0}', github.event_name != 'pull_request' && ',pre-commit-autoupdate,no-commit-to-branch' || '' ) }} | |
| - name: Write pre-commit summary | |
| if: ${{ always() && github.event_name == 'pull_request' && hashFiles('pre-commit-checks-summary.md') != '' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cat pre-commit-checks-summary.md >> "${GITHUB_STEP_SUMMARY}" | |
| # renovate-validate: | |
| # name: renovate-validate | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # - name: renovate-validate | |
| # uses: indykite/.github/.github/actions/renovate-validate@master | |
| trivy: | |
| name: trivy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: trivy | |
| uses: indykite/.github/.github/actions/trivy@master | |
| - name: Write trivy summary | |
| if: ${{ always() && hashFiles('trivy-table.txt') != '' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| { | |
| echo '```text' | |
| cat trivy-table.txt | |
| echo '```' | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| checkov: | |
| name: checkov | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: checkov | |
| uses: indykite/.github/.github/actions/checkov@master | |
| - name: Write checkov summary | |
| if: ${{ always() && hashFiles('checkov-summary.txt') != '' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| { | |
| echo '```text' | |
| cat checkov-summary.txt | |
| echo '```' | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| terraform-validate: | |
| name: terraform-validate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Mint ik-code-reader installation token | |
| id: code_reader_token | |
| if: ${{ github.event.pull_request.head.repo.fork != true }} # fork PRs cannot read the PEM | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - https://github.com/actions/create-github-app-token/releases | |
| with: | |
| client-id: ${{ vars.IK_CODE_READER_CLIENT_ID }} | |
| private-key: ${{ secrets.IK_CODE_READER_PEM }} | |
| owner: indykite | |
| - name: terraform-validate | |
| uses: indykite/.github/.github/actions/terraform-validate@master | |
| with: | |
| # changed files on PR (ruleset CI), full validation on cache-style non-PR runs | |
| changed_only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} | |
| exclude_dirs: docs,examples | |
| github_token: ${{ steps.code_reader_token.outputs.token }} |