Bump step-security/harden-runner from 2.20.1 to 2.21.1 (#148) #1051
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: brew test-bot | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: {} | |
| jobs: | |
| test-bot: | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - run: echo "/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin" >> "$GITHUB_PATH" | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| - name: Set up Homebrew | |
| id: set-up-homebrew | |
| uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # master | |
| - name: Cache Homebrew Bundler RubyGems | |
| id: cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ${{ steps.set-up-homebrew.outputs.gems-path }} | |
| key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }} | |
| restore-keys: ${{ runner.os }}-rubygems- | |
| - name: Install Homebrew Bundler RubyGems | |
| if: steps.cache.outputs.cache-hit != 'true' | |
| run: brew install-bundler-gems | |
| - run: brew test-bot --only-cleanup-before | |
| - run: brew test-bot --only-setup | |
| # TODO: re-enable, or figure out how to bypass the style error: | |
| # C: [Correctable] Style/SoleNestedConditional: Consider merging nested conditions into outer if conditions. | |
| # however this syntax is generated by goreleaser itself | |
| # - run: brew test-bot --only-tap-syntax | |
| - run: brew test-bot --only-formulae | |
| if: github.event_name == 'pull_request' | |
| - name: Upload bottles as artifact | |
| if: always() && github.event_name == 'pull_request' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bottles | |
| path: '*.bottle.*' |