Skip to content

Commit d764e4c

Browse files
FelixTJDietrichFelixTJDietrich
authored
Merge branch 'main' into 1569-security-alert-reconciliation
2 parents 83c6092 + c088409 commit d764e4c

9 files changed

Lines changed: 44 additions & 13 deletions

File tree

‎.github/actionlint.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
paths:
2+
".github/workflows/**/*.{yml,yaml}":
3+
ignore:
4+
- 'unexpected key "queue" for "concurrency" section'

‎.github/workflows/cd-docs-teardown.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ jobs:
3131
continue-on-error: true
3232

3333
- name: Update PR comment
34-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
34+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
3535
with:
3636
header: docs-preview
3737
message: |
3838
## 📚 Documentation Preview
3939
4040
~~Preview has been removed~~ (PR closed)
4141
- name: Update Storybook PR comment
42-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
42+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
4343
with:
4444
header: storybook-preview
4545
message: |

‎.github/workflows/cd-docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ jobs:
9494
- run: bun install --frozen-lockfile --ignore-scripts
9595
- name: Deploy to Surge.sh
9696
run: bun --bun surge ./docs-build ${{ env.PREVIEW_URL }} --token ${{ secrets.SURGE_TOKEN }}
97-
- uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
97+
- uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
9898
with:
9999
header: docs-preview
100100
message: |

‎.github/workflows/ci-security-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
- name: Trivy dependency scan
3333
id: dependencies
3434
continue-on-error: true
35-
uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
35+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
3636
with:
3737
scan-type: "fs"
3838
scan-ref: "."

‎.github/workflows/ci-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ jobs:
213213

214214
- name: Add Storybook preview to the pull request
215215
if: steps.storybook_preview.outcome == 'success'
216-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
216+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
217217
with:
218218
header: storybook-preview
219219
message: |

‎.github/workflows/cicd.yml‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ jobs:
146146
ci-config:
147147
- '.github/workflows/**'
148148
- '.github/actions/**'
149+
- '.github/actionlint.yaml'
149150
docker-config:
150151
- '.github/workflows/ci-docker-build.yml'
151152
- '.github/workflows/reusable-docker-build.yml'
@@ -166,6 +167,30 @@ jobs:
166167
- '!webapp/src/**/*.stories.*'
167168
- '!webapp/src/test/**'
168169
170+
workflow-lint:
171+
name: "Workflow syntax"
172+
runs-on: ubuntu-latest
173+
needs: [detect-changes]
174+
if: |
175+
needs.detect-changes.outputs.should_skip != 'true' && (
176+
needs.detect-changes.outputs.ci-config == 'true' ||
177+
github.event_name != 'pull_request'
178+
)
179+
permissions:
180+
checks: write
181+
contents: read
182+
steps:
183+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
184+
with:
185+
persist-credentials: false
186+
187+
- uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
188+
with:
189+
actionlint_flags: -shellcheck=
190+
fail_level: error
191+
filter_mode: nofilter
192+
reporter: github-check
193+
169194
Quality:
170195
uses: ./.github/workflows/ci-quality-gates.yml
171196
needs: [detect-changes]
@@ -263,7 +288,7 @@ jobs:
263288
permissions:
264289
actions: read
265290
statuses: write
266-
needs: [detect-changes, Quality, Security, Test, Changesets, Docker]
291+
needs: [detect-changes, workflow-lint, Quality, Security, Test, Changesets, Docker]
267292
if: always()
268293
steps:
269294
- name: Generate workflow timeline
@@ -314,6 +339,7 @@ jobs:
314339
id: evaluate
315340
run: |
316341
echo "detect-changes: ${{ needs.detect-changes.result }}"
342+
echo "workflow-lint: ${{ needs.workflow-lint.result }}"
317343
echo "Quality: ${{ needs.Quality.result }}"
318344
echo "Security: ${{ needs.Security.result }}"
319345
echo "Test: ${{ needs.Test.result }}"
@@ -362,6 +388,7 @@ jobs:
362388
esac
363389
}
364390
391+
echo "| Workflow syntax | $(result_to_emoji '${{ needs.workflow-lint.result }}') |" >> $GITHUB_STEP_SUMMARY
365392
echo "| Quality | $(result_to_emoji '${{ needs.Quality.result }}') |" >> $GITHUB_STEP_SUMMARY
366393
echo "| Test | $(result_to_emoji '${{ needs.Test.result }}') |" >> $GITHUB_STEP_SUMMARY
367394
echo "| Changesets | $(result_to_emoji '${{ needs.Changesets.result }}') |" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/cleanup-preview.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ jobs:
7474
# Always overwrites the sticky comment, closed pull requests included: a torn-down preview
7575
# must never leave a live-looking link behind.
7676
if: always() && steps.tombstone.outcome == 'success'
77-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
77+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
7878
with:
7979
header: app-preview
8080
number: ${{ github.event.pull_request.number }}

‎.github/workflows/deploy-preview.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ jobs:
6363
6464
- name: Explain why the preview did not deploy
6565
if: steps.context.outputs.announce == 'true'
66-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
66+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
6767
with:
6868
header: app-preview
6969
number: ${{ steps.context.outputs.pr_number }}
@@ -111,7 +111,7 @@ jobs:
111111
112112
- name: Announce the deployment
113113
if: steps.github_deployment.outputs.deployment_id != ''
114-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
114+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
115115
with:
116116
header: app-preview
117117
number: ${{ steps.context.outputs.pr_number }}
@@ -168,7 +168,7 @@ jobs:
168168
169169
- name: Publish the preview link
170170
if: steps.finalize.outputs.final_state == 'success'
171-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
171+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
172172
with:
173173
header: app-preview
174174
number: ${{ steps.context.outputs.pr_number }}
@@ -186,7 +186,7 @@ jobs:
186186
steps.context.outputs.eligible == 'true' &&
187187
steps.recheck.outputs.opted_out != 'true' &&
188188
steps.wait.outputs.state != 'success'
189-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
189+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
190190
with:
191191
header: app-preview
192192
number: ${{ steps.context.outputs.pr_number }}

‎.github/workflows/pull-request.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
continue-on-error: true
4646

4747
- name: "Comment on PR with validation error"
48-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
48+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
4949
if: steps.commitlint.outcome == 'failure'
5050
with:
5151
header: pr-title-lint-error
@@ -59,7 +59,7 @@ jobs:
5959
> 📖 See [CONTRIBUTING.md](https://github.com/ls1intum/Hephaestus/blob/main/CONTRIBUTING.md) for commit message guidelines.
6060
6161
- name: "Remove error comment on success"
62-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
62+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
6363
if: steps.commitlint.outcome == 'success'
6464
with:
6565
header: pr-title-lint-error

0 commit comments

Comments
 (0)