fix: prevent GitHub Actions script injection #2219
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Continuous Integration | |
| on: | |
| - pull_request | |
| - push | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| # Enforce TPT-1234: prefix on PR titles, with the following exemptions: | |
| # - PRs labeled 'dependencies' (e.g. Dependabot PRs) | |
| # - PRs labeled 'hotfix' (urgent fixes that may not have a ticket) | |
| # - PRs labeled 'community-contribution' (external contributors without TPT tickets) | |
| # - PRs labeled 'ignore-for-release' (release PRs that don't need a ticket prefix) | |
| - name: Validate PR Title | |
| if: github.event_name == 'pull_request' | |
| uses: amannn/action-semantic-pull-request@v6 | |
| with: | |
| types: | | |
| TPT-\d+ | |
| requireScope: false | |
| # Override the default header pattern to allow hyphens and digits in the type | |
| # (e.g. "TPT-4298: Description"). The default pattern only matches word | |
| # characters (\w) which excludes hyphens. | |
| headerPattern: '^([\w-]+):\s?(.*)$' | |
| headerPatternCorrespondence: type, subject | |
| ignoreLabels: | | |
| dependencies | |
| hotfix | |
| community-contribution | |
| ignore-for-release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: 'stable' | |
| - name: Check docs | |
| run: make docs-check | |
| - name: Golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| - name: Tidy | |
| run: go mod tidy | |
| - run: make deps | |
| - name: tflint | |
| run: make tflint | |
| - name: Fail if changes | |
| run: git diff-index --exit-code HEAD | |
| tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: 'stable' | |
| - run: go version | |
| - name: Unit tests | |
| run: make test-unit | |
| gosec_scan: | |
| runs-on: ubuntu-latest | |
| env: | |
| GO111MODULE: on | |
| steps: | |
| - name: Checkout Source | |
| uses: actions/checkout@v7 | |
| - name: Run Gosec Security Scanner | |
| uses: securego/gosec@master | |
| with: | |
| args: -exclude=G104,G117 ./... |