Repository navigation
feat(desk): serve switch targets from account options #386
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Engineering governance | |
| on: | |
| pull_request: | |
| push: | |
| branches: ["main"] | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: Gitleaks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install verified Gitleaks CLI | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/gitleaks.tar.gz" | |
| curl --fail --silent --show-error --location --retry 2 \ | |
| https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \ | |
| --output "$archive" | |
| echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb $archive" | sha256sum --check --status | |
| mkdir -p "$RUNNER_TEMP/gitleaks-bin" | |
| tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks-bin" gitleaks | |
| - name: Scan added commits with redacted findings | |
| shell: bash | |
| env: | |
| PR_BASE: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BASE: ${{ github.event.before }} | |
| PUSH_HEAD: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| base="${PR_BASE:-$PUSH_BASE}" | |
| head="${PR_HEAD:-$PUSH_HEAD}" | |
| if [[ -z "$base" || "$base" =~ ^0+$ ]]; then | |
| echo "No base commit is available for this event" >&2 | |
| exit 1 | |
| fi | |
| "$RUNNER_TEMP/gitleaks-bin/gitleaks" git . --redact --no-banner --log-opts="$base..$head" | |
| commitlint: | |
| name: Commit message convention | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Validate pull request commit messages | |
| if: github.event_name == 'pull_request' | |
| shell: bash | |
| env: | |
| PR_BASE: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| tool="$RUNNER_TEMP/governance-commitlint" | |
| npm install --prefix "$tool" --ignore-scripts --no-audit --no-fund \ | |
| @commitlint/cli@21.2.4 @commitlint/config-conventional@21.2.4 | |
| printf '%s\n' "module.exports = {extends: [require.resolve('@commitlint/config-conventional')], defaultIgnores: true, ignores: [(message) => /^Merge /.test(message)], rules: {'subject-case': [0], 'header-max-length': [2, 'always', 72], 'type-enum': [2, 'always', ['feat', 'fix', 'docs', 'refactor', 'test', 'chore', 'perf', 'ci']]}};" > "$tool/commitlint.config.cjs" | |
| node "$tool/node_modules/@commitlint/cli/cli.js" \ | |
| --config "$tool/commitlint.config.cjs" --from "$PR_BASE" --to "$PR_HEAD" --verbose |