chore(ci): regenerate workflows at velnor 1279c4f9 #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Generated by velnor-workflow. Regenerate; do not hand-edit. | |
| name: Velnor workflow policy | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| workflow_dispatch: | |
| concurrency: | |
| group: policy-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| policy: | |
| name: Policy | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| # Trust invariant: this job runs the base branch's validator against the | |
| # audited tree under pull_request_target. It holds `contents: read` only, | |
| # references no secrets, and its checkout persists no credentials, so | |
| # building and running the tree's declared generator here is no more | |
| # privileged than the pull_request lanes that already build the tree. | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository history | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| path: policy-checkout | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Check out audited head | |
| working-directory: policy-checkout | |
| env: | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | |
| run: | | |
| set -euo pipefail | |
| if ! git cat-file -e "$HEAD_SHA^{commit}" 2>/dev/null; then | |
| git fetch --no-tags "$GITHUB_SERVER_URL/$HEAD_REPOSITORY" "$HEAD_SHA" | |
| fi | |
| git checkout --quiet --detach "$HEAD_SHA" | |
| - name: Bound the Mr. Boxington store | |
| shell: bash | |
| run: echo "MBX_GC_MAX_SIZE=12GiB" >> "$GITHUB_ENV" | |
| - name: Set up Mr. Boxington | |
| uses: jdx/mr-boxington-action@7234d3dd1a6ca8f6c381eea8e4dfb03f18fcf777 # v1.3.0 | |
| with: | |
| backend: github | |
| version: 1.11.1 | |
| cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-1279c4f92c97b75dc4cc627f122e119f8a5eae16 | |
| restore-keys: | | |
| velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}- | |
| - name: Install pinned Velnor workflow runtime | |
| env: | |
| CARGO_HOME: ${{ runner.temp }}/velnor-workflow-cargo-home | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/velnor-workflow-cargo-target | |
| VELNOR_WORKFLOW_INSTALL_DIR: ${{ runner.temp }}/velnor-workflow-install | |
| VELNOR_WORKFLOW_ROOT: ${{ runner.temp }}/velnor-workflow | |
| run: | | |
| set -euo pipefail | |
| install -d -m 700 \ | |
| "$CARGO_HOME" \ | |
| "$CARGO_TARGET_DIR" \ | |
| "$VELNOR_WORKFLOW_INSTALL_DIR" | |
| cd "$VELNOR_WORKFLOW_INSTALL_DIR" | |
| env -u RUSTC_WRAPPER -u SCCACHE_GHA_ENABLED -u CARGO_INCREMENTAL -u RUSTFLAGS -u CARGO_ENCODED_RUSTFLAGS \ | |
| cargo install \ | |
| --locked \ | |
| --git https://github.com/tailrocks/velnor \ | |
| --rev 1279c4f92c97b75dc4cc627f122e119f8a5eae16 \ | |
| --root "$VELNOR_WORKFLOW_ROOT" \ | |
| velnor-workflow \ | |
| --bin velnor-workflow | |
| echo "$VELNOR_WORKFLOW_ROOT/bin" >> "$GITHUB_PATH" | |
| - name: Resolve required status checks | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| DEFAULT_BRANCH: main | |
| run: | | |
| set -euo pipefail | |
| contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \ | |
| | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \ | |
| | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \ | |
| | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \ | |
| | sort -u | paste -sd, -)" | |
| echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV" | |
| - name: Enforce workflow policy | |
| env: | |
| WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }} | |
| VELNOR_WORKFLOW_POLICY_REVISION: 1279c4f92c97b75dc4cc627f122e119f8a5eae16 | |
| run: | | |
| set -euo pipefail | |
| velnor-workflow policy \ | |
| --workflow-root "$WORKFLOW_ROOT" \ | |
| --head-sha "$HEAD_SHA" \ | |
| --base-sha "$BASE_SHA" \ | |
| --ruleset-contexts "$RULESET_CONTEXTS" | |
| - name: Set up actionlint | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| with: | |
| install_args: actionlint@1.7.12 | |
| cache: false | |
| - name: Lint caller workflows | |
| working-directory: policy-checkout | |
| run: mise exec actionlint@1.7.12 -- actionlint |