fix: fail closed on interactive Keychain use in darwin workers #96
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Policy | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [opened, synchronize, reopened, edited, ready_for_review] | |
| merge_group: | |
| branches: [main] | |
| types: [checks_requested] | |
| permissions: | |
| contents: read | |
| jobs: | |
| semantic: | |
| name: semantic | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout candidate | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Validate pull request body and squash commit | |
| if: ${{ github.event_name == 'pull_request' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| umask 077 | |
| message_file="$(mktemp)" | |
| trap 'rm -f "$message_file"' EXIT | |
| jq -er ' | |
| .pull_request as $pull_request | |
| | ($pull_request.title // "") as $title | |
| | ($pull_request.body // "") as $body | |
| | if ($body | test("\\S")) | |
| then "\($title)\n\n\($body)" | |
| else error("pull request body must not be blank") | |
| end | |
| ' "$GITHUB_EVENT_PATH" > "$message_file" | |
| npm exec -- commitlint --edit "$message_file" --verbose | |
| - name: Validate every candidate commit | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| MERGE_BASE_SHA: ${{ github.event.merge_group.base_sha }} | |
| MERGE_HEAD_SHA: ${{ github.event.merge_group.head_sha }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "$EVENT_NAME" == "pull_request" ]]; then | |
| base_sha="$PR_BASE_SHA" | |
| head_sha="$PR_HEAD_SHA" | |
| elif [[ "$EVENT_NAME" == "merge_group" ]]; then | |
| base_sha="$MERGE_BASE_SHA" | |
| head_sha="$MERGE_HEAD_SHA" | |
| else | |
| echo "::error::Unsupported event $EVENT_NAME" | |
| exit 1 | |
| fi | |
| git cat-file -e "${base_sha}^{commit}" | |
| git cat-file -e "${head_sha}^{commit}" | |
| mapfile -t commits < <(git rev-list --reverse --no-merges "${base_sha}..${head_sha}") | |
| if (( ${#commits[@]} == 0 )); then | |
| echo "No real, non-merge commits to validate." | |
| exit 0 | |
| fi | |
| for commit in "${commits[@]}"; do | |
| echo "Validating commit ${commit}" | |
| git show --no-patch --format=%B "$commit" | npm exec -- commitlint --verbose | |
| done |