chore: sync velnor-workflow to 541d8926737213542156ee32e420010817f8a323 #19
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Generated by velnor-workflow. Regenerate; do not hand-edit. | |
| name: Velnor workflow policy | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| workflow_dispatch: | |
| concurrency: | |
| group: policy-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| policy: | |
| name: Policy | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| # Trust invariant: this job runs the base branch's validator against the | |
| # audited tree under pull_request_target. It holds `contents: read` only, | |
| # references no secrets, and its checkout persists no credentials, so | |
| # building and running the tree's declared generator here is no more | |
| # privileged than the pull_request lanes that already build the tree. | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository history | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| path: policy-checkout | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Check out audited head | |
| working-directory: policy-checkout | |
| env: | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | |
| run: | | |
| set -euo pipefail | |
| if ! git cat-file -e "$HEAD_SHA^{commit}" 2>/dev/null; then | |
| git fetch --no-tags "$GITHUB_SERVER_URL/$HEAD_REPOSITORY" "$HEAD_SHA" | |
| fi | |
| git checkout --quiet --detach "$HEAD_SHA" | |
| - name: Bound the Mr. Boxington store | |
| shell: bash | |
| run: echo "MBX_GC_MAX_SIZE=12GiB" >> "$GITHUB_ENV" | |
| - name: Set up Mr. Boxington | |
| uses: jdx/mr-boxington-action@7234d3dd1a6ca8f6c381eea8e4dfb03f18fcf777 # v1.3.0 | |
| with: | |
| backend: github | |
| version: 1.11.1 | |
| cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-541d8926737213542156ee32e420010817f8a323 | |
| restore-keys: | | |
| velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}- | |
| - name: Install pinned Velnor workflow runtime | |
| env: | |
| CARGO_HOME: ${{ runner.temp }}/velnor-workflow-cargo-home | |
| CARGO_TARGET_DIR: ${{ runner.temp }}/velnor-workflow-cargo-target | |
| VELNOR_WORKFLOW_INSTALL_DIR: ${{ runner.temp }}/velnor-workflow-install | |
| VELNOR_WORKFLOW_ROOT: ${{ runner.temp }}/velnor-workflow | |
| run: | | |
| set -euo pipefail | |
| install -d -m 700 \ | |
| "$CARGO_HOME" \ | |
| "$CARGO_TARGET_DIR" \ | |
| "$VELNOR_WORKFLOW_INSTALL_DIR" | |
| cd "$VELNOR_WORKFLOW_INSTALL_DIR" | |
| env -u RUSTC_WRAPPER -u SCCACHE_GHA_ENABLED -u CARGO_INCREMENTAL -u RUSTFLAGS -u CARGO_ENCODED_RUSTFLAGS \ | |
| cargo install \ | |
| --locked \ | |
| --git https://github.com/tailrocks/velnor \ | |
| --rev 541d8926737213542156ee32e420010817f8a323 \ | |
| --root "$VELNOR_WORKFLOW_ROOT" \ | |
| velnor-workflow \ | |
| --bin velnor-workflow | |
| echo "$VELNOR_WORKFLOW_ROOT/bin" >> "$GITHUB_PATH" | |
| - name: Resolve required status checks | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| DEFAULT_BRANCH: main | |
| run: | | |
| set -euo pipefail | |
| contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \ | |
| | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \ | |
| | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \ | |
| | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \ | |
| | sort -u | paste -sd, -)" | |
| echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV" | |
| - name: Enforce workflow policy | |
| env: | |
| WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }} | |
| VELNOR_WORKFLOW_POLICY_REVISION: 541d8926737213542156ee32e420010817f8a323 | |
| run: | | |
| set -euo pipefail | |
| velnor-workflow policy \ | |
| --workflow-root "$WORKFLOW_ROOT" \ | |
| --head-sha "$HEAD_SHA" \ | |
| --base-sha "$BASE_SHA" \ | |
| --ruleset-contexts "$RULESET_CONTEXTS" | |
| - name: Set up actionlint | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| with: | |
| install_args: actionlint@1.7.12 | |
| cache: false | |
| - name: Lint caller workflows | |
| working-directory: policy-checkout | |
| run: mise exec actionlint@1.7.12 -- actionlint |