c6d068a371
* fix(workflows): standardize runner configuration for security jobs * ci(actionlint): add Blacksmith runner label to config Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config to suppress "unknown label" warnings during workflow linting. This label is used across all workflows after the Blacksmith migration. * fix(actionlint): adjust indentation for self-hosted runner labels * feat(security): enhance security workflow with CodeQL analysis steps * fix(security): update CodeQL action to version 4 for improved analysis * fix(security): remove duplicate permissions in security workflow * fix(security): revert CodeQL action to v3 for stability The v4 version was causing workflow file validation failures. Reverting to proven v3 version that is working on main branch. * fix(security): remove duplicate permissions causing workflow validation failure The permissions block had duplicate security-events and actions keys, which caused YAML validation errors and prevented workflow execution. Fixes: workflow file validation failures on main branch * fix(security): remove pull_request trigger to reduce costs * fix(security): restore PR trigger but skip codeql on PRs * fix(security): resolve YAML syntax error in security workflow * refactor(security): split CodeQL into dedicated scheduled workflow * fix(security): update workflow name to Rust Package Security Audit * fix(codeql): remove push trigger, keep schedule and on-demand only * feat(codeql): add CodeQL configuration file to ignore specific paths * Potential fix for code scanning alert no. 39: Hard-coded cryptographic value Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(ci): resolve auto-response workflow merge markers * fix(build): restore ChannelMessage reply_target usage * ci(workflows): run workflow sanity on workflow pushes for all branches * ci(workflows): rename auto-response workflow to PR Auto Responder * ci(workflows): require owner approval for workflow file changes * ci: add lint-first PR feedback gate * ci(workflows): split label policy checks from workflow sanity --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
name: Workflow Sanity
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/*.yml"
|
|
- ".github/*.yaml"
|
|
push:
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/*.yml"
|
|
- ".github/*.yaml"
|
|
|
|
concurrency:
|
|
group: workflow-sanity-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
no-tabs:
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Fail on tabs in workflow files
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
python - <<'PY'
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import sys
|
|
|
|
root = pathlib.Path(".github/workflows")
|
|
bad: list[str] = []
|
|
for path in sorted(root.rglob("*.yml")):
|
|
if b"\t" in path.read_bytes():
|
|
bad.append(str(path))
|
|
for path in sorted(root.rglob("*.yaml")):
|
|
if b"\t" in path.read_bytes():
|
|
bad.append(str(path))
|
|
|
|
if bad:
|
|
print("Tabs found in workflow file(s):")
|
|
for path in bad:
|
|
print(f"- {path}")
|
|
sys.exit(1)
|
|
PY
|
|
|
|
actionlint:
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Lint GitHub workflows
|
|
uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
|