chore(deps): update pinned GitHub Actions #96
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security scans | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "17 4 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| # actions/checkout v7.0.1 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Run Gitleaks | |
| run: | | |
| set -euo pipefail | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/repo" \ | |
| -w /repo \ | |
| ghcr.io/gitleaks/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854 \ | |
| detect --source=/repo --config=/repo/.gitleaks.toml --redact --verbose | |
| actionlint: | |
| name: actionlint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| # actions/checkout v7.0.1 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| - name: Run actionlint | |
| run: | | |
| set -euo pipefail | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/repo" \ | |
| -w /repo \ | |
| docker.io/rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9 \ | |
| -color | |
| python-security: | |
| name: Python static/security checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| # actions/checkout v7.0.1 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| # actions/setup-python v7.0.0 | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install scanners | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install semgrep==1.168.0 zizmor==1.26.1 pip-audit==2.10.1 | |
| - name: Run Semgrep | |
| run: semgrep scan --config p/ci --config p/secrets --error --metrics=off . | |
| - name: Run zizmor | |
| run: zizmor .github/workflows | |
| - name: Detect Python dependencies | |
| id: python-deps | |
| run: | | |
| python - <<'PY' >> "$GITHUB_OUTPUT" | |
| import glob | |
| import os | |
| import tomllib | |
| from pathlib import Path | |
| requirements_present = bool(glob.glob("requirements*.txt")) | |
| dependencies = [] | |
| pyproject = Path("pyproject.toml") | |
| if pyproject.exists(): | |
| data = tomllib.loads(pyproject.read_text(encoding="utf-8")) | |
| project = data.get("project", {}) | |
| dependencies.extend(project.get("dependencies", [])) | |
| for group in project.get("optional-dependencies", {}).values(): | |
| dependencies.extend(group) | |
| dependency_file = Path(os.environ["RUNNER_TEMP"]) / "project-dependencies.txt" | |
| dependency_file.write_text("\n".join(dependencies), encoding="utf-8") | |
| present = requirements_present or bool(dependencies) | |
| print(f"present={str(present).lower()}") | |
| PY | |
| - name: Run pip-audit | |
| if: steps.python-deps.outputs.present == 'true' | |
| run: | | |
| set -euo pipefail | |
| # Audit project manifests explicitly. The ambient environment also | |
| # contains the security scanners and is not the project's dependency set. | |
| if compgen -G 'requirements*.txt' > /dev/null; then | |
| for requirements_file in requirements*.txt; do | |
| pip-audit --progress-spinner off -r "${requirements_file}" | |
| done | |
| fi | |
| if [[ -s "${RUNNER_TEMP}/project-dependencies.txt" ]]; then | |
| pip-audit --progress-spinner off -r "${RUNNER_TEMP}/project-dependencies.txt" | |
| fi | |
| shellcheck: | |
| name: ShellCheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| # actions/checkout v7.0.1 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| - name: Run ShellCheck when shell scripts exist | |
| run: | | |
| set -euo pipefail | |
| mapfile -t scripts < <(git ls-files '*.sh' '*.bash') | |
| if [ "${#scripts[@]}" -eq 0 ]; then | |
| echo "No tracked shell scripts found; skipping ShellCheck." | |
| exit 0 | |
| fi | |
| docker run --rm \ | |
| -v "${GITHUB_WORKSPACE}:/mnt" \ | |
| -w /mnt \ | |
| docker.io/koalaman/shellcheck@sha256:bb596a0d169b85ddd81d8b6d3a2ff6d5baf5fca10b97f575ebc647c3dff62b3d \ | |
| -x "${scripts[@]}" |