9944a7ac8a
Some checks are pending
Security / Security check (push) Waiting to run
Runs `tools/security/check-staged.sh ci` on every push to main and every PR. Same script as the local pre-commit hook so the gate is identical whether or not a contributor activated the local hook via `bash tools/install-hooks.sh`. No Flutter / Dart toolchain needed in the runner — the check is plain bash + git. Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
security:
|
|
name: Security check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Same external-URL checkout dance the fai/platform CI uses —
|
|
# the runner's internal forgejo URL is not resolvable from
|
|
# inside the DinD job container. See `reference_forgejo_ci_setup`
|
|
# in the operator memory for the rationale.
|
|
- name: Checkout via external URL
|
|
run: |
|
|
set -eu
|
|
mkdir -p "$GITHUB_WORKSPACE"
|
|
cd "$GITHUB_WORKSPACE"
|
|
git init -q
|
|
git remote add origin \
|
|
"https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
|
|
# Fetch enough history that scanning back to the merge base
|
|
# / origin/main yields a non-empty diff. depth=50 covers any
|
|
# realistic PR; larger PRs still pass since the script
|
|
# falls back to the root commit on missing base.
|
|
git fetch --depth=50 origin "$GITHUB_SHA"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Security check (secrets, confidentiality, banned phrases)
|
|
# Same script `tools/security/check-staged.sh` the local
|
|
# pre-commit hook runs — defense in depth, so a contributor
|
|
# without `bash tools/install-hooks.sh` still cannot land
|
|
# secrets or banned phrases on main.
|
|
run: |
|
|
set -eu
|
|
BASE="origin/main"
|
|
if [ -n "${GITHUB_BASE_REF:-}" ]; then
|
|
git fetch --depth=50 origin "$GITHUB_BASE_REF"
|
|
BASE="origin/$GITHUB_BASE_REF"
|
|
fi
|
|
bash tools/security/check-staged.sh ci "$BASE"
|