Skip to content

Commit 410531a

Browse files
withinfocuswithinfocus
authored
Modernize workflows (#251)
* Modernize workflows * Fix security issues * Skip one Checkov false positive
1 parent 81e888f commit 410531a

File tree

6 files changed

+234
-170
lines changed

6 files changed

+234
-170
lines changed

‎.github/workflows/build.yml‎

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [develop]
6+
workflow_dispatch:
7+
8+
permissions: {}
9+
10+
concurrency:
11+
group: ${{ github.ref }}-${{ github.workflow }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
deploy:
16+
name: Deploy
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: write
20+
pages: write
21+
22+
steps:
23+
- name: Check out repository
24+
uses: actions/checkout@v6
25+
26+
- name: Set up .NET SDK
27+
uses: actions/setup-dotnet@v5
28+
29+
- name: Deploy
30+
run: dotnet run -- deploy
31+
env:
32+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
34+
scan:
35+
name: Scan
36+
runs-on: ubuntu-latest
37+
permissions:
38+
security-events: write
39+
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
language: ["csharp"]
44+
45+
steps:
46+
- name: Check out repository
47+
uses: actions/checkout@v6
48+
49+
- name: Initialize CodeQL
50+
uses: github/codeql-action/init@v4
51+
with:
52+
languages: ${{ matrix.language }}
53+
54+
- name: Set up .NET SDK
55+
uses: actions/setup-dotnet@v5
56+
57+
- name: Autobuild
58+
uses: github/codeql-action/autobuild@v4
59+
60+
- name: Analyze
61+
uses: github/codeql-action/analyze@v4

‎.github/workflows/deploy.yml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.github/workflows/lint.yml‎

Lines changed: 0 additions & 72 deletions
This file was deleted.

‎.github/workflows/pr.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
name: PR Validation
2+
3+
on:
4+
pull_request:
5+
branches: [develop]
6+
workflow_dispatch: # checkov:skip=CKV_GHA_7:Input only used to select PR for validation, does not affect build output
7+
inputs:
8+
pull_request_number:
9+
description: "Pull Request Number"
10+
required: true
11+
type: number
12+
13+
permissions: {}
14+
15+
concurrency:
16+
group: ${{ github.ref }}-${{ github.workflow }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
lint:
21+
name: Lint
22+
runs-on: ubuntu-latest
23+
permissions:
24+
checks: write
25+
contents: write
26+
pull-requests: write
27+
28+
steps:
29+
- name: Get PR details
30+
id: pr-details
31+
run: |
32+
if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
33+
echo "Fetching details for PR #$PR_NUMBER"
34+
35+
PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName,headRepository,author)
36+
HEAD_REF=$(echo "$PR_DATA" | jq -r '.headRefName')
37+
AUTHOR_LOGIN=$(echo "$PR_DATA" | jq -r '.author.login')
38+
HEAD_REPO=$(echo "$PR_DATA" | jq -r '.headRepository.nameWithOwner')
39+
40+
{
41+
echo "head_ref=$HEAD_REF"
42+
echo "author_login=$AUTHOR_LOGIN"
43+
echo "head_repo=$HEAD_REPO"
44+
} >> "$GITHUB_OUTPUT"
45+
else
46+
{
47+
echo "head_ref=$PR_HEAD_REF"
48+
echo "author_login=$PR_AUTHOR_LOGIN"
49+
echo "head_repo=$PR_HEAD_REPO"
50+
} >> "$GITHUB_OUTPUT"
51+
fi
52+
env:
53+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
EVENT_NAME: ${{ github.event_name }}
55+
PR_NUMBER: ${{ inputs.pull_request_number }}
56+
REPO: ${{ github.repository }}
57+
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
58+
PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
59+
PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
60+
61+
- name: Check out repository
62+
uses: actions/checkout@v6
63+
with:
64+
ref: ${{ steps.pr-details.outputs.head_ref }}
65+
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
66+
fetch-depth: 0
67+
68+
- name: Run MegaLinter
69+
id: ml
70+
uses: oxsecurity/megalinter/flavors/dotnetweb@v9
71+
env:
72+
VALIDATE_ALL_CODEBASE: false
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
LLM_ADVISOR_ENABLED: >-
75+
${{
76+
steps.pr-details.outputs.author_login != 'dependabot[bot]' &&
77+
steps.pr-details.outputs.author_login != 'github-actions[bot]' &&
78+
!startsWith(steps.pr-details.outputs.author_login, 'dependabot')
79+
}}
80+
81+
- name: Upload lint reports
82+
if: always()
83+
uses: actions/upload-artifact@v5
84+
with:
85+
name: Lint Report
86+
path: |
87+
megalinter-reports
88+
mega-linter.log
89+
90+
- name: Prepare git directory
91+
if: >-
92+
steps.ml.outputs.has_updated_sources == 1 &&
93+
steps.pr-details.outputs.head_repo == github.repository
94+
run: sudo chown -Rc $UID .git/
95+
96+
- name: Commit and push MegaLinter fixes
97+
if: >-
98+
steps.ml.outputs.has_updated_sources == 1 &&
99+
steps.pr-details.outputs.head_repo == github.repository
100+
run: |
101+
git config user.name "megalinter-bot"
102+
git config user.email "[email protected]"
103+
104+
if [[ -n $(git status -s) ]]; then
105+
git add .
106+
git commit -m "Apply lint fixes"
107+
108+
for i in {1..4}; do
109+
if git push; then
110+
echo "✅ MegaLinter fixes pushed successfully"
111+
break
112+
else
113+
if [[ "$i" -lt 4 ]]; then
114+
WAIT_TIME=$((2 ** i))
115+
echo "⚠️ Push failed, retrying in ${WAIT_TIME}s..."
116+
sleep "$WAIT_TIME"
117+
else
118+
echo "❌ Push failed after 4 attempts"
119+
exit 1
120+
fi
121+
fi
122+
done
123+
else
124+
echo "ℹ️ No MegaLinter changes to commit"
125+
fi
126+
127+
build:
128+
name: Build
129+
runs-on: ubuntu-latest
130+
permissions:
131+
checks: write
132+
contents: write
133+
pull-requests: write
134+
135+
steps:
136+
- name: Get PR details
137+
id: pr-details
138+
run: |
139+
if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
140+
echo "Fetching details for PR #$PR_NUMBER"
141+
142+
PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName)
143+
HEAD_REF=$(echo "$PR_DATA" | jq -r '.headRefName')
144+
145+
echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
146+
else
147+
echo "head_ref=$PR_HEAD_REF" >> "$GITHUB_OUTPUT"
148+
fi
149+
env:
150+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
151+
EVENT_NAME: ${{ github.event_name }}
152+
PR_NUMBER: ${{ inputs.pull_request_number }}
153+
REPO: ${{ github.repository }}
154+
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
155+
156+
- name: Check out repository
157+
uses: actions/checkout@v6
158+
with:
159+
ref: ${{ steps.pr-details.outputs.head_ref }}
160+
161+
- name: Set up .NET SDK
162+
uses: actions/setup-dotnet@v5
163+
164+
- name: Run build
165+
run: dotnet run
166+
167+
- name: Upload output
168+
uses: actions/upload-artifact@v5
169+
with:
170+
name: Generated Site
171+
path: output/
172+
env:
173+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)