feat(gateway): Test for blocked subactions (#279)

Composite Actions can have sub-actions that also need to satisfy our allow list but we currently don't have a way to check this. #276 #135

This 'runs' the dummy job but doesn't run any of the actions, this means the runner will download all actions and in that process any new/changed sub-actions would trigger the allow list.

Author: assignUser

gateway/gateway.py

@@ -131,10 +131,17 @@ def generate_workflow(actions: ActionsYAML) -> str:
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/dummy.yml
+  push:
+    paths:
+      - .github/workflows/dummy.yml
+
+permissions: {}
 
 jobs:
   dummy:
-    if: false
     runs-on: ubuntu-latest
     steps:
 """
@@ -154,8 +161,9 @@ def is_updatable(ref):
             ref = ref_to_update[0]
             details = refs[ref]
             steps.append(f"      - uses: {name}@{ref}" + (f"  # {details['tag']}" if 'tag' in details else ''))
+            steps.append( "        if: false")
 
-    return header + "\n".join(steps) + "\n"
+    return header + "\n".join(steps) + "\n" + "      - run: echo Success!\n"
 
 
 def update_refs(
@@ -172,7 +180,12 @@ def update_refs(
         ActionsYAML: Updated action references
     """
     for step in dummy_steps:
-        name, new_ref = step["uses"].split("@")
+        uses = step.get("uses", None)
+        if uses is None:
+            # The last step is - run:
+            continue
+
+        name, new_ref = uses.split("@")
         new_tag = None
         if hasattr(step, 'ca') and 'uses' in step.ca.items:
             new_tag = step.ca.items['uses'][2].value[1:].strip()

gateway/test_dummy.yml

@@ -9,124 +9,247 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: 1Password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0
+      if: false
     - uses: ana06/get-changed-files@v2.3.0
+      if: false
     - uses: DavidAnson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8   # v16
+      if: false
     - uses: JamesIves/github-pages-deploy-action@881db5376404c5c8d621010bcbec0310b58d5e29   # v4.6.8
+      if: false
     - uses: JustinBeckwith/linkinator-action@3d5ba091319fa7b0ac14703761eebb7d100e6f6d
+      if: false
     - uses: JustinBeckwith/linkinator-action@v1.11.0
+      if: false
     - uses: Kesin11/actions-timeline@427ee2cf860166e404d0d69b4f2b24012bb7af4f
+      if: false
     - uses: Madrapps/jacoco-report@fd4800e8a81e21bdf373438e5918b975df041d15
+      if: false
     - uses: VirtusLab/scala-cli-setup@ca54569bf13a29cd648721038a89c47c7921c060
+      if: false
     - uses: VirtusLab/scala-cli-setup@6fc878be89f1990f6599f4f6a2e52a252e54d9f9
+      if: false
     - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+      if: false
     - uses: actions/setup-go@v5
+      if: false
     - uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185
+      if: false
     - uses: addnab/docker-run-action@v3
+      if: false
     - uses: amondnet/vercel-action@225d234cfe5340ca1f9a6cd158338126b5b6845f
+      if: false
     - uses: amondnet/vercel-action@v25.1.1
+      if: false
     - uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
+      if: false
     - uses: aws-actions/configure-aws-credentials@v4.1.0
+      if: false
     - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78
+      if: false
     - uses: azure/setup-helm@v3
+      if: false
     - uses: betahuhn/repo-file-sync-action@8b92be3375cf1d1b0cd579af488a9255572e4619
+      if: false
     - uses: betahuhn/repo-file-sync-action@v1
+      if: false
     - uses: bnjbvr/cargo-machete@5eaad10acf89fb0c6a31d9b197a2d48ba762d28e
+      if: false
     - uses: bnjbvr/cargo-machete@v0.7.0
+      if: false
     - uses: browser-actions/setup-firefox@5b19b18df8c293aae9e77f0a936e9fdc358f543a
+      if: false
     - uses: browser-actions/setup-firefox@v1
+      if: false
     - uses: browser-actions/setup-geckodriver@5ef1526ed36211ab6cb531ec1cfb11f924ca2dee
+      if: false
     - uses: burnett01/rsync-deployments@0dc935cdecc5f5e571865e60d2a6cdc673704823
+      if: false
     - uses: burnett01/rsync-deployments@5.2
+      if: false
     - uses: carloscastrojumo/github-cherry-pick-action@a145da1b8142e752d3cbc11aaaa46a535690f0c5
+      if: false
     - uses: carloscastrojumo/github-cherry-pick-action@v1.0.9
+      if: false
     - uses: carloscastrojumo/github-cherry-pick-action@503773289f4a459069c832dc628826685b75b4b3
+      if: false
     - uses: carloscastrojumo/github-cherry-pick-action@v1.0.10
+      if: false
     - uses: commit-check/commit-check-action@8d507e12899a9feb405c3ed546252ff9508724e0
+      if: false
     - uses: coursier/cache-action@4e2615869d13561d626ed48655e1a39e5b192b3c
+      if: false
     - uses: coursier/setup-action@039f736548afa5411c1382f40a5bd9c2d30e0383
+      if: false
     - uses: cpp-linter/cpp-linter-action@e3fcb174b19d50de4eae1b46896698a1dd48b094
+      if: false
     - uses: cpp-linter/cpp-linter-action@v2.13.3
+      if: false
     - uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549
+      if: false
     - uses: crazy-max/ghaction-setup-docker@b60f85385d03ac8acfca6d9996982511d8620a19
+      if: false
     - uses: crazy-max/ghaction-setup-docker@v4
+      if: false
     - uses: damccorm/tag-ur-it@6fa72bbf1a2ea157b533d7e7abeafdb5855dbea5
+      if: false
     - uses: dawidd6/action-send-mail@4226df7daafa6fc901a43789c49bf7ab309066e7
+      if: false
     - uses: dawidd6/action-send-mail@v3
+      if: false
     - uses: docker://jekyll/jekyll@sha256:400b8d1569f118bca8a3a09a25f32803b00a55d1ea241feaf5f904d66ca9c625
+      if: false
     - uses: docker://jekyll/jekyll@*
+      if: false
     - uses: dominikh/staticcheck-action@4ec9a0dff54be2642bc76581598ba433fd8d4967
+      if: false
     - uses: dominikh/staticcheck-action@v1.1.0
+      if: false
     - uses: dorny/paths-filter@v3.0.2
+      if: false
     - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a
+      if: false
     - uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab
+      if: false
     - uses: graalvm/setup-graalvm@v1
+      if: false
     - uses: gradle/wrapper-validation-action@v3.5.0
+      if: false
     - uses: hadolint/hadolint-action@f988afea3da57ee48710a9795b6bb677cc901183
+      if: false
     - uses: hadolint/hadolint-action@v2.1.0
+      if: false
     - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+      if: false
     - uses: hashicorp/setup-terraform@v3
+      if: false
     - uses: helm/chart-releaser-action@fc23f249f75decd5edf254c6b4401532cef093c3
+      if: false
     - uses: helm/chart-releaser-action@v1.4.0
+      if: false
     - uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992
+      if: false
     - uses: helm/chart-testing-action@v2.6.1
+      if: false
     - uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
+      if: false
     - uses: helm/chart-testing-action@v2.7.0
+      if: false
     - uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde
+      if: false
     - uses: helm/kind-action@v1.10.0
+      if: false
     - uses: ilammy/setup-nasm@e77cc62a22a374a4d0668286007cc3e3b4c17760
+      if: false
     - uses: ilammy/setup-nasm@v1
+      if: false
     - uses: jasonetco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5
+      if: false
     - uses: jasonetco/create-an-issue@v2
+      if: false
     - uses: jrouly/scalafmt-native-action@14620cde093e5ff6bfbbecd4f638370024287b9d
+      if: false
     - uses: jwgmeligmeyling/pmd-github-action@322e346bd76a0757c4d54ff9209e245965aa066d
+      if: false
     - uses: korandoru/setup-zig@92b649f4723a14798d8b3cf3b6168edb65d5b04e
+      if: false
     - uses: korandoru/setup-zig@v1
+      if: false
     - uses: leafo/gh-actions-luarocks@e65774a6386cb4f24e293dca7fc4ff89165b64c5
+      if: false
     - uses: ludeeus/action-shellcheck@1.1.0
+      if: false
     - uses: ludeeus/action-shellcheck@94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
+      if: false
     - uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d
+      if: false
     - uses: mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd
+      if: false
     - uses: mozilla-actions/sccache-action@v0.0.4
+      if: false
     - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad
+      if: false
     - uses: mozilla-actions/sccache-action@v0.0.9
+      if: false
     - uses: mukunku/tag-exists-action@bdad1eaa119ce71b150b952c97351c75025c06a9
+      if: false
     - uses: mukunku/tag-exists-action@v1.6.0
+      if: false
     - uses: ncipollo/release-action@1e3e9c6637e5566e185b7ab66f187539c5a76da7
+      if: false
     - uses: neofinancial/ticket-check-action@609d901d5130a4bbd7d9f62931082ed67f855891
+      if: false
     - uses: neofinancial/ticket-check-action@v2.0.0
+      if: false
     - uses: nwtgck/actions-netlify@ac1cb16858bada08a9c71a81240a85cfc3f72913
+      if: false
     - uses: nwtgck/actions-netlify@v1.2
+      if: false
     - uses: opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716
+      if: false
     - uses: opentofu/setup-opentofu@v1
+      if: false
     - uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7
+      if: false
     - uses: orhun/git-cliff-action@v4
+      if: false
     - uses: packetcoders/action-setup-cache-python-poetry@a3f2e6ed12462e038bc14270d139e373bf5ac564
+      if: false
     - uses: packetcoders/action-setup-cache-python-poetry@v1.1.0
+      if: false
     - uses: pdm-project/setup-pdm@483717a073bdef51804a58dac17d043a4183c384
+      if: false
     - uses: pdm-project/setup-pdm@v4
+      if: false
     - uses: peter-evans/close-issue@1373cadf1f0c96c1420bc000cfba2273ea307fd1
+      if: false
     - uses: peter-evans/close-issue@v2
+      if: false
     - uses: peter-evans/create-or-update-comment@c9fcb64660bc90ec1cc535646af190c992007c32
+      if: false
     - uses: phoenix-actions/test-reporting@f957cd93fc2d848d556fa0d03c57bc79127b6b5e
+      if: false
     - uses: phoenix-actions/test-reporting@v15
+      if: false
     - uses: pmd/pmd-github-action@967a81f8b657c87f7c3e96b62301cb1a48efef29
+      if: false
     - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
+      if: false
     - uses: pre-commit/action@v3.0.1
+      if: false
     - uses: pypa/cibuildwheel@0f04e96e2f58e63b8b03886c1db16a507f2199bf
+      if: false
     - uses: pypa/cibuildwheel@v2.12.0
+      if: false
     - uses: sbt/setup-sbt@26ab4b0fa1c47fa62fc1f6e51823a658fb6c760c
+      if: false
     - uses: scacap/action-surefire-report@1a128e49c0585bc0b8e38e541ac3b6e35a5bc727
+      if: false
     - uses: scala-steward-org/scala-steward-action@5021652c555c5724af574758b78ea5be49640007
+      if: false
     - uses: scalacenter/sbt-dependency-submission@64084844d2b0a9b6c3765f33acde2fbe3f5ae7d3
+      if: false
     - uses: seanmiddleditch/gha-setup-ninja@8b297075da4cd2a5f1fd21fe011b499edf06e9d2
+      if: false
     - uses: seanmiddleditch/gha-setup-ninja@v4
+      if: false
     - uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a
+      if: false
     - uses: snok/install-poetry@v1
+      if: false
     - uses: untitaker/hyperlink@0.1.21
+      if: false
     - uses: untitaker/hyperlink@d277930ba480c61cd3dd1a0caf0d18acfed294a6
+      if: false
     - uses: uraimo/run-on-arch-action@ac33288c3728ca72563c97b8b88dda5a65a84448
+      if: false
     - uses: uraimo/run-on-arch-action@v2
+      if: false
     - uses: vimtor/action-zip@5f1c4aa587ea41db1110df6a99981dbe19cee310
+      if: false
     - uses: vimtor/action-zip@v1
+      if: false
     - uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d
+      if: false
     - uses: slackapi/slack-github-action@v2.0.0
+      if: false
+    - run: Success!