build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11 #219
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ############################################################################### | |
| # _ _ _ _ _____ _ | |
| # | | | | | | | | | __ \(_) | |
| # | | ___ | |__ _ __ | |_| |__ ___ | |__) |_ _ __ _ __ ___ _ __ | |
| # _ | |/ _ \| '_ \| '_ \ | __| '_ \ / _ \ | _ /| | '_ \| '_ \ / _ \ '__| | |
| # | |__| | (_) | | | | | | | | |_| | | | __/ | | \ \| | |_) | |_) | __/ | | |
| # \____/ \___/|_| |_|_| |_| \__|_| |_|\___| |_| \_\_| .__/| .__/ \___|_| | |
| # | | | | | |
| # |_| |_| | |
| # | |
| # Copyright (c) 2024 Claudio André <[email protected]> | |
| # | |
| # This program comes with ABSOLUTELY NO WARRANTY; express or implied. | |
| # | |
| # This program is free software: you can redistribute it and/or modify | |
| # it under the terms of the GNU General Public License as published by | |
| # the Free Software Foundation, as expressed in version 2, seen at | |
| # http://www.gnu.org/licenses/gpl-2.0.html | |
| ############################################################################### | |
| # GitHub Action to check if the PR contains the same thing as the main branch | |
| # More info at https://github.com/openwall/john-packages | |
| --- | |
| name: Validate tree | |
| "on": | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| fork: | |
| runs-on: ubuntu-latest | |
| name: check-fork | |
| outputs: | |
| commit: ${{ steps.context.outputs.commit }} | |
| if: github.actor != 'dependabot[bot]' && github.actor != 'step-security-bot' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| if: ${{ github.event.pull_request.head.repo.full_name != 'openwall/john-packages' }} | |
| with: | |
| fetch-depth: 0 | |
| repository: "${{ github.event.pull_request.head.repo.full_name }}" | |
| - name: Get fork context | |
| id: context | |
| if: ${{ github.event.pull_request.head.repo.full_name != 'openwall/john-packages' }} | |
| run: | | |
| BASE_COMMIT=$(git merge-base --fork-point origin/main "${{ github.event.pull_request.head.sha }}" || true) | |
| echo "commit=$BASE_COMMIT" >> "$GITHUB_OUTPUT" | |
| validate: | |
| needs: [fork] | |
| runs-on: ubuntu-latest | |
| name: check-pr | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| github.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Branch updated | |
| run: | | |
| ANCESTOR=1 | |
| if [[ "${{ github.event.pull_request.head.repo.full_name }}" == 'openwall/john-packages' ]]; then | |
| BASE_COMMIT="${{ github.event.pull_request.head.sha }}" | |
| else | |
| BASE_COMMIT="${{ needs.fork.outputs.commit }}" | |
| fi | |
| echo "----------- The difference between working tree and index ------------" | |
| git diff-index origin/main | |
| echo "----------------------------------------------------------------------" | |
| echo "The downward commit is: '$BASE_COMMIT'" | |
| echo "----------------------------------------------------------------------" | |
| if [[ -n "$BASE_COMMIT" ]]; then | |
| ANCESTOR=$(git merge-base --is-ancestor origin/main "$BASE_COMMIT"; echo $?) | |
| fi | |
| if [[ "ANCESTOR" -ne 0 ]]; then | |
| echo "This branch is not up to date with main. Please, update!" | |
| exit 1 | |
| fi | |
| - name: If '(#999)' matches PR number | |
| run: | | |
| PR_NUMBER="${{ github.event.pull_request.number }}" | |
| COMMITS="$(git log --oneline origin/main..)" | |
| echo "HEAD: ${{ github.event.pull_request.head.sha }}" | |
| echo "$COMMITS" | while read -r COMMIT ; do | |
| MESSAGE_PR_NUMBER=$(echo "$COMMIT" | grep -oE "\(#[0-9]{3,4}\)$" | cut -d'#' -f 2 | cut -d')' -f 1) | |
| echo "Found: '$MESSAGE_PR_NUMBER'" | |
| if [[ "$MESSAGE_PR_NUMBER" != "$PR_NUMBER" ]]; then | |
| echo "Commit message should reference (#$PR_NUMBER)" | |
| exit 1 | |
| fi | |
| done | |
| - name: Check signoff | |
| run: | | |
| COMMITS="$(git log --pretty=format:%H origin/main..)" | |
| echo "$COMMITS" | while read -r COMMIT ; do | |
| COMMIT_MSG=$(git show -s --format=%B "$COMMIT") | |
| if ! echo "$COMMIT_MSG" | grep -q '^Signed-off-by:'; then | |
| echo "Commit message missing 'Signed-off-by' trailer" | |
| exit 1 | |
| fi | |
| done | |
| - name: Check checksums | |
| run: | | |
| cd scripts && sha256sum ./*.sh > ../requirements.hash && cd - | |
| cd patches && sha256sum ./* >> ../requirements.hash && cd - | |
| echo "You should keep checksums updated!" | |
| echo "**********************************************************************" | |
| git diff | |
| echo "**********************************************************************" | |
| git diff --quiet |