Skip to content

Commit cd5649c

Browse files
vavkamilvavkamil
authored
Merge pull request vavkamil#58 from vavkamil/vavkamil/test-ci
chore(ci): Update Stargazers check
2 parents 1872a2f + ecaece9 commit cd5649c

File tree

6 files changed

+177
-11
lines changed

6 files changed

+177
-11
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Description
2+
3+
Please explain the changes you made here:
4+
5+
- foo
6+
7+
## Notes
8+
9+
Please add screenshots or some additional context if you believe it is needed.
10+
11+
## Checklist
12+
13+
- [ ] Only GitHub links to open-source repos are added
14+
- [ ] No duplicate links are added
15+
- [ ] All repos exist and are public
16+
- [ ] All repos have at least 50 stars

‎.github/dependabot.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
2+
3+
version: 2
4+
updates:
5+
- package-ecosystem: "pip"
6+
directory: "/"
7+
schedule:
8+
interval: "monthly"
9+
time: "09:00"
10+
timezone: "Europe/Prague"
11+
assignees:
12+
- "vavkamil"
13+
cooldown:
14+
default-days: 7
15+
16+
- package-ecosystem: "github-actions"
17+
directory: "/"
18+
schedule:
19+
interval: "monthly"
20+
time: "09:00"
21+
timezone: "Europe/Prague"
22+
assignees:
23+
- "vavkamil"
24+
cooldown:
25+
default-days: 7

‎.github/workflows/security-zizmor.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# https://github.com/woodruffw/zizmor
2+
3+
name: Security
4+
5+
on:
6+
push:
7+
branches:
8+
- main
9+
pull_request:
10+
paths:
11+
- '.github/workflows/**'
12+
13+
permissions: {}
14+
15+
jobs:
16+
zizmor:
17+
# name: zizmor via PyPI
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/[email protected]
25+
with:
26+
persist-credentials: false
27+
28+
- name: Set up Python
29+
uses: actions/setup-python@v6
30+
with:
31+
python-version: '3.10.4'
32+
33+
- name: Install Zizmor
34+
run: |
35+
python -m pip install --upgrade pip
36+
pip install $(grep '^zizmor==' requirements.txt)
37+
38+
- name: Run Zizmor
39+
run: zizmor .github/workflows

‎.github/workflows/stargazers.yml‎

Lines changed: 94 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,37 +17,120 @@ jobs:
1717
- name: Checkout repository
1818
uses: actions/[email protected]
1919
with:
20-
fetch-depth: 0 # we need history for diff
20+
fetch-depth: 0
21+
persist-credentials: false
2122

2223
- name: Fetch base branch
2324
run: |
24-
git fetch origin ${{ github.base_ref }} --depth=1
25+
git fetch origin main --depth=1
2526
26-
- name: Extract newly added GitHub repo links
27+
- name: Extract newly added URLs and GitHub repo links
2728
run: |
2829
# Show diff between base branch and PR HEAD, only for README
29-
git diff --unified=0 origin/${{ github.base_ref }}...HEAD -- README.md > diff.txt
30+
git diff --unified=0 origin/main...HEAD -- README.md > diff.txt
3031
31-
# Extract only added (+) lines that contain github.com, strip the leading '+'
32-
# Then use a simple regex-ish sed to grab the URL
33-
sed -n 's/^+.*\(https:\/\/github.com\/[^ )]*\).*/\1/p' diff.txt \
34-
| sort -u > new_links.txt
32+
# Extract ALL added https:// URLs from added (+) lines
33+
sed -n 's/^+.*\(https:\/\/[^ )]*\).*/\1/p' diff.txt \
34+
| sort -u > added_urls.txt || true
35+
touch added_urls.txt
3536
36-
echo "New links found:"
37+
# Extract only GitHub URLs from the added URLs
38+
grep '^https://github\.com/' added_urls.txt > new_links.txt || true
39+
touch new_links.txt
40+
41+
echo "All added URLs:"
42+
cat added_urls.txt || echo "None"
43+
44+
echo "New GitHub links:"
3745
cat new_links.txt || echo "None"
3846
39-
- name: Check stars for new links (unauthenticated)
47+
# Extract ALL GitHub URLs from the current README (after PR changes)
48+
grep -o 'https://github.com/[^ )]*' README.md > all_github_urls.txt || true
49+
touch all_github_urls.txt
50+
51+
# Normalize all GitHub URLs in README to owner/repo
52+
sed -E 's#https://github.com/([^/]+/[^/]+).*#\1#' all_github_urls.txt \
53+
| sed '/^$/d' \
54+
| sort > all_repos.txt || true
55+
touch all_repos.txt
56+
57+
# Normalize only newly added GitHub URLs to owner/repo
58+
sed -E 's#https://github.com/([^/]+/[^/]+).*#\1#' new_links.txt \
59+
| sed '/^$/d' \
60+
| sort -u > new_repos.txt || true
61+
touch new_repos.txt
62+
63+
echo "All GitHub repositories in README (normalized):"
64+
cat all_repos.txt || echo "None"
65+
66+
echo "New GitHub repositories (normalized):"
67+
cat new_repos.txt || echo "None"
68+
69+
- name: Warn on non-GitHub links
70+
run: |
71+
# Any URLs not starting with https://github.com/
72+
grep -v '^https://github\.com/' added_urls.txt > non_github.txt || true
73+
touch non_github.txt
74+
75+
if [ -s non_github.txt ]; then
76+
echo "::warning ::Detected added URLs that are NOT GitHub repository links:"
77+
cat non_github.txt
78+
else
79+
echo "No non-GitHub URLs detected."
80+
fi
81+
82+
- name: Detect duplicate GitHub repositories
83+
run: |
84+
# Prepare file for duplicate repos
85+
: > duplicates.txt
86+
87+
# For each newly added repo, check how many times it appears in all_repos.txt
88+
while read -r repo; do
89+
[ -z "$repo" ] && continue
90+
count=$(grep -c "^$repo$" all_repos.txt || true)
91+
if [ "$count" -gt 1 ]; then
92+
echo "$repo" >> duplicates.txt
93+
fi
94+
done < new_repos.txt
95+
96+
if [ -s duplicates.txt ]; then
97+
echo "::warning ::The following GitHub repositories are duplicated in README.md:"
98+
sort -u duplicates.txt
99+
else
100+
echo "No duplicate GitHub repositories detected."
101+
fi
102+
103+
- name: Check stars for new GitHub links (unauthenticated)
40104
run: |
41105
set -euo pipefail
42106
107+
exit_code=0
108+
109+
# If there were any non-GitHub URLs, treat that as an error condition
110+
if [ -s non_github.txt ]; then
111+
echo "::error ::Non-GitHub URLs were added in README.md; only GitHub repositories are allowed."
112+
cat non_github.txt
113+
exit_code=1
114+
fi
115+
116+
# If there were duplicate GitHub repos, treat that as an error condition
117+
if [ -s duplicates.txt ]; then
118+
echo "::error ::Duplicate GitHub repositories detected in README.md:"
119+
sort -u duplicates.txt
120+
exit_code=1
121+
fi
122+
123+
# Now check each new GitHub repository link
43124
while read -r url; do
44125
[ -z "$url" ] && continue
45126
127+
# Normalize to owner/repo from the URL
46128
repo="$(printf '%s\n' "$url" | sed -E 's#https://github.com/([^/]+/[^/]+).*#\1#')"
47129
[ -z "$repo" ] && continue
48130
49131
echo "Checking $repo"
50132
133+
# Unauthenticated GitHub API call
51134
resp=$(curl -s "https://api.github.com/repos/$repo")
52135
msg=$(echo "$resp" | jq -r '.message // empty')
53136
@@ -66,4 +149,4 @@ jobs:
66149
fi
67150
done < new_links.txt
68151
69-
exit ${exit_code:-0}
152+
exit "$exit_code"

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@
418418
- [cariddi](https://github.com/edoardottt/cariddi) - Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more...
419419
- [SecretFinder](https://github.com/m4ll0k/SecretFinder) - A python script for finding sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files.
420420
- [js-snitch](https://github.com/vavkamil/js-snitch) - Scans remote JavaScript files with Trufflehog + Semgrep to detect leaked secrets.
421+
- [keyhacks](https://github.com/streaak/keyhacks) - KeyHacks shows methods to validate different API keys found on a Bug Bounty Program or a pentest.
421422

422423

423424
### Git
@@ -428,6 +429,7 @@
428429
- [GitHunter](https://github.com/digininja/GitHunter) - A tool for searching a Git repository for interesting content
429430
- [dvcs-ripper](https://github.com/kost/dvcs-ripper) - Rip web accessible (distributed) version control systems: SVN/GIT/HG...
430431
- [Gato (Github Attack TOolkit)](https://github.com/praetorian-inc/gato) - GitHub Self-Hosted Runner Enumeration and Attack Tool
432+
- [zizmor](https://github.com/zizmorcore/zizmor) - Static analysis tool for GitHub Actions
431433

432434
### Buckets
433435

‎requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
zizmor==1.16.1

0 commit comments

Comments
 (0)