modavd.github.io/.github/workflows/check.yml at main · ModAVD/modavd.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Check

on:
  pull_request:
  push:
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Checkout without persistent credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
      - name: Install locked dependencies without install scripts
        run: npm ci --ignore-scripts
      - name: Build the site (fails on dead links)
        run: npm run build
      - name: Check that Chinese and English pages match
        run: python3 scripts/i18n.py
      - name: Warn when a page changed in one language only
        if: github.event_name == 'pull_request'
        env:
          BASE_REF: ${{ github.base_ref }}
        run: python3 scripts/i18n.py --base "origin/$BASE_REF"
      - name: Scan tracked files for private identity and paths
        run: python3 scripts/privacy.py .
      - name: Checkout ModAVD for the shared privacy scanner
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ModAVD/ModAVD
          ref: main
          path: .modavd
          persist-credentials: false
          sparse-checkout: scripts/privacy.py
          sparse-checkout-cone-mode: false
      - name: scripts/privacy.py is ModAVD's
        shell: bash
        run: |
          set -euo pipefail
          if ! cmp -s scripts/privacy.py .modavd/scripts/privacy.py; then
            echo "::error file=scripts/privacy.py::scripts/privacy.py differs from ModAVD/ModAVD main. The scanner is changed in ModAVD first; copy its scripts/privacy.py here byte for byte (only privacy-allowlist.json is this repository's own)."
            exit 1
          fi
          echo "scripts/privacy.py is the same as ModAVD/ModAVD main $(git -C .modavd rev-parse --short HEAD)"

  zizmor:
    name: Workflow security (zizmor)
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout without persistent credentials
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install zizmor 1.32.0 (version and wheel hash pinned)
        shell: bash
        run: |
          set -euo pipefail
          python3 -m venv "$RUNNER_TEMP/zizmor"
          printf '%s\n' 'zizmor==1.32.0 --hash=sha256:84a6acb975accc13408786a2bd274b572537ca19c933ebbc13e78f3988562071' > "$RUNNER_TEMP/zizmor-requirements.txt"
          "$RUNNER_TEMP/zizmor/bin/pip" install --quiet --disable-pip-version-check --no-deps --only-binary=:all: \
            --require-hashes -r "$RUNNER_TEMP/zizmor-requirements.txt"
      - name: Audit workflows and Dependabot config
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: '"$RUNNER_TEMP/zizmor/bin/zizmor" --format=github --no-progress .'