docs(cketh): specify ETH deposits on the shared address and sweeper delegate rotation #16883
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Checks | |
| on: | |
| pull_request_target: | |
| permissions: | |
| contents: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| env: | |
| # Intentional no-op: no step reads this. Added by #8729 ("Adds CTF | |
| # variable, it does not adjust the workflow functionality") and kept on | |
| # purpose, understood to be a capture-the-flag marker that a researcher | |
| # who exfiltrates it can present as proof of an exploit against this | |
| # pull_request_target workflow. Check with @dfinity/infra before removing | |
| # it as unused config. | |
| CTF_PROOF: ${{ secrets.CTF_PROOF }} | |
| steps: | |
| - name: Checkout base | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: 'master' | |
| path: "base" | |
| # This job parses a file taken verbatim from the (untrusted) fork, so | |
| # no write-capable token may be left readable on disk. The only step | |
| # that needs the token gets it from the environment instead. | |
| persist-credentials: false | |
| - name: Checkout PR | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| path: "pr" | |
| persist-credentials: false | |
| sparse-checkout: | | |
| Cargo.Bazel.toml.lock | |
| sparse-checkout-cone-mode: false | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| working-directory: "./base" | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Run Bazel Dependency Submission | |
| working-directory: "./base" | |
| env: | |
| SHELL_WRAPPER: "/usr/bin/time" | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_PR_DIR: ${{ github.workspace }}/pr | |
| GITHUB_PR_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| export PYTHONPATH=$PWD/ci/src:$PWD/ci/src/dependencies | |
| $SHELL_WRAPPER python3 ci/src/dependencies/job/bazel_rust_gh_submission_job.py | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: moderate | |
| # The base commit's dependency snapshot is submitted by a separate | |
| # workflow run, so it can still be missing when this check compares | |
| # the base against the PR head. Without a retry the comparison sees | |
| # zero base dependencies, reports the entire tree as newly added and | |
| # fails on pre-existing advisories. | |
| retry-on-snapshot-warnings: true |