actions/install-action
1
0
Fork 0
mirror of https://github.com/taiki-e/install-action.git synced 2026-05-07 05:20:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

tidy: Check GitHub workflow permissions

Browse Source
This commit is contained in:
Taiki Endo
2023-03-09 23:12:12 +09:00
parent 0c2d9a651a
commit 0ffbddd290
3 changed files with 30 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/ci.yml vendored
View File

@@ -160,7 +160,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 60 timeout-minutes: 60
permissions: permissions:
contents: write # TODO test contents: write
pull-requests: write pull-requests: write
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3

5
.github/workflows/release.yml vendored
View File

@@ -1,8 +1,7 @@
name: Release name: Release
permissions: permissions:
# TODO: once `releases: write` is supported, use it instead. contents: read
contents: write
on: on:
push: push:
@@ -18,6 +17,8 @@ jobs:
if: github.repository_owner == 'taiki-e' if: github.repository_owner == 'taiki-e'
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 60 timeout-minutes: 60
permissions:
contents: write
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
with: with:

27
tools/tidy.sh
View File

@@ -14,7 +14,7 @@ trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}
# - shfmt # - shfmt
# - shellcheck # - shellcheck
# - npm # - npm
# - jq and yq (if this repository uses bors) # - jq and yq
# - rustup (if Rust code exists) # - rustup (if Rust code exists)
# - clang-format (if C/C++ code exists) # - clang-format (if C/C++ code exists)
# #
@@ -95,19 +95,32 @@ if [[ -n "$(git ls-files '*.yml')$(git ls-files '*.js')$(git ls-files '*.json')"
else else
warn "'npm' is not installed" warn "'npm' is not installed"
fi fi
if [[ -e .github/workflows/ci.yml ]] && grep -q '# tidy:needs' .github/workflows/ci.yml && ! grep -Eq '# *needs: \[' .github/workflows/ci.yml; then # Check GitHub workflows.
if [[ -d .github/workflows ]]; then
if type -P jq &>/dev/null && type -P yq &>/dev/null; then if type -P jq &>/dev/null && type -P yq &>/dev/null; then
for workflow in .github/workflows/*.yml; do
# The top-level permissions must be weak as they are referenced by all jobs.
permissions=$(yq '.permissions' "${workflow}" | jq -c)
case "${permissions}" in
'{"contents":"read"}' | '{"contents":"none"}' | '{}') ;;
null) warn "${workflow}: top level permissions not found; it must be 'contents: read' or weaker permissions" ;;
*) warn "${workflow}: only 'contents: read' and weaker permissions are allowed at top level; if you want to use stronger permissions, please set job-level permissions" ;;
esac
# Make sure the 'needs' section is not out of date.
if grep -q '# tidy:needs' "${workflow}" && ! grep -Eq '# *needs: \[' "${workflow}"; then
# shellcheck disable=SC2207 # shellcheck disable=SC2207
jobs_actual=($(yq '.jobs' .github/workflows/ci.yml | jq -r 'keys_unsorted[]')) jobs_actual=($(yq '.jobs' "${workflow}" | jq -r 'keys_unsorted[]'))
unset 'jobs_actual[${#jobs_actual[@]}-1]' unset 'jobs_actual[${#jobs_actual[@]}-1]'
# shellcheck disable=SC2207 # shellcheck disable=SC2207
jobs_expected=($(yq -r '.jobs."ci-success".needs[]' .github/workflows/ci.yml)) jobs_expected=($(yq -r '.jobs."ci-success".needs[]' "${workflow}"))
if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then
printf -v jobs '%s, ' "${jobs_actual[@]}" printf -v jobs '%s, ' "${jobs_actual[@]}"
sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" .github/workflows/ci.yml sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" "${workflow}"
check_diff .github/workflows/ci.yml check_diff "${workflow}"
warn "please update 'needs' section in 'ci-success' job" warn "${workflow}: please update 'needs' section in 'ci-success' job"
fi fi
fi
done
else else
warn "'jq' or 'yq' is not installed" warn "'jq' or 'yq' is not installed"
fi fi