Merge pull request #11 from p80n-sec/add-openclaw-ai-sast-findings #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build inventory | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'findings/**' | |
| - 'duplicates/**' | |
| - 'talks/**' | |
| - 'links.yml' | |
| - 'tools/**' | |
| - 'requirements.txt' | |
| - 'pytest.ini' | |
| - '.github/workflows/build.yml' | |
| workflow_dispatch: | |
| # README.md is deliberately absent above: the site never reads it, and excluding | |
| # it means this workflow's own README commit cannot retrigger the workflow. | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: main # explicit branch, so the commit step is not on detached HEAD | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.13' | |
| cache: pip | |
| - run: pip install -r requirements.txt | |
| - name: Test | |
| run: python -m pytest -q | |
| - name: File duplicates | |
| run: | | |
| for dir in findings/*/; do | |
| [ -f "$dir/finding.md" ] || continue | |
| if awk '/^---$/{n++} n==1' "$dir/finding.md" | grep -qE '^status:[[:space:]]*duplicate$'; then | |
| name="$(basename "$dir")" | |
| mkdir -p duplicates | |
| # git mv onto an existing destination is fatal, and under bash -e | |
| # that aborts the whole job: no regeneration, no deploy. Skip the | |
| # record instead; the key collision is reported by Generate. | |
| if [ -e "duplicates/$name" ]; then | |
| echo "duplicates/$name already exists; leaving $dir in place" | |
| continue | |
| fi | |
| git mv "$dir" "duplicates/$name" || echo "could not file $dir; skipping" | |
| fi | |
| done | |
| - name: Generate | |
| run: python -m tools.generate --out _site | |
| - name: Commit regenerated README and filed duplicates | |
| run: | | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| git add -A README.md findings | |
| if [ -d duplicates ]; then | |
| git add -A duplicates | |
| fi | |
| if git diff --cached --quiet; then | |
| echo "nothing to commit" | |
| else | |
| git commit -m "Regenerate inventory [skip ci]" | |
| git push | |
| fi | |
| - uses: actions/configure-pages@v5 | |
| - uses: actions/upload-pages-artifact@v3 | |
| with: | |
| path: _site | |
| deploy: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - id: deployment | |
| uses: actions/deploy-pages@v4 |