Nils Andreas Svee
614ad5b5cd
Suppress SC2086 and SC2129 linting errors for the generated release.yml to prevent build noise while maintaining checks for logic issues.
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
name: GitHub Actions Security
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
merge_group:
|
|
schedule:
|
|
- cron: "11 3 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
actionlint:
|
|
name: actionlint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run actionlint
|
|
uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.
|
|
with:
|
|
# release.yml is generated by dist. Keep linting it for real
|
|
# workflow issues, but ignore generated ShellCheck style/info noise.
|
|
flags: >-
|
|
-ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2086'
|
|
-ignore '\.github/workflows/release\.yml:[0-9]+:[0-9]+: shellcheck reported issue .*SC2129'
|
|
zizmor:
|
|
name: zizmor
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run zizmor
|
|
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
|
|
with:
|
|
persona: regular
|