Tirsvad
a8c46ecdbe
TirSystem/git-workflows: Publish wiki / publish-wiki (push) Skipped
Validate workflows / validate (pull_request) Successful in 58s
TirSystem/git-workflows: OpenGrep / opengrep (pull_request) Failing after 6s
TirSystem/git-workflows: Validate / validate (pull_request) Failing after 6s
The scoped workflows fetched their scripts at v2 (v1 for the metadata sync), which has none of the new scripts; the next release is 3.0.0, so they fetch v3. Shorten the run block of publish-wiki-pages.yml to five lines (WF-20) and silence the six OpenGrep ERROR findings that are list-form subprocess calls and the parse of the project's own coverage report, each with its reason. Task: MIL-016#4 Task: MIL-017#4 Task: MIL-018#4 Task: MIL-019#3
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
name: OpenGrep
|
|
|
|
# Scoped workflow: it runs in every repository of an organization, so there is
|
|
# no caller and no input. It scans the repository with OpenGrep (a pinned,
|
|
# checksum-verified binary) and the rules of a pinned checkout of
|
|
# opengrep/opengrep-rules, without a login and without a registry (ADR-0015).
|
|
# A finding of severity ERROR fails the run; the others are listed. A
|
|
# repository where OpenGrep scans no file is skipped. The script is a file of
|
|
# TirSystem/git-workflows (tools/opengrep_scan.py), fetched at v3.
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [ main ]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
opengrep:
|
|
permissions:
|
|
contents: read
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@v4.2.2
|
|
|
|
- name: Fetch the shared script
|
|
uses: actions/checkout@v4.2.2
|
|
with:
|
|
repository: TirSystem/git-workflows
|
|
ref: v3
|
|
path: shared-scripts
|
|
|
|
- name: Install OpenGrep and its rules
|
|
run: python3 shared-scripts/tools/opengrep_scan.py install
|
|
|
|
- name: Scan the repository
|
|
run: python3 shared-scripts/tools/opengrep_scan.py run
|