filter to cdylib crates and expand permissions comment

Author: leighmcculloch

.github/workflows/test-with-openzeppelin-stellar-contracts.yml

@@ -9,7 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}-{{ github.event_name }}
   cancel-in-progress: true
 
-permissions: {} # No permissions
+# No permissions. This workflow downloads code from outside this repository and
+# compiles it. No permissions ensures that any exploit in an external
+# repository does not gain access to anything in this repo.
+permissions: {}
 
 jobs:
   collect-contracts:
@@ -21,7 +24,8 @@ jobs:
         ref: main
     - id: dirs
       run: |
-        dirs=$(find . -name 'Cargo.toml' -mindepth 2 | xargs dirname | sed 's|^\./||' | jq -Rnc '[inputs | "\(.)"]')
+        # Find Cargo.toml files that build to crate-type cdylib.
+        dirs=$(find . -name 'Cargo.toml' -mindepth 2 | xargs -I {} sh -c 'if grep -q "cdylib" "{}"; then dirname "{}"; fi' | sed 's|^\./||' | jq -Rnc '[inputs | "\(.)"]')
         echo "dirs=$dirs" >> $GITHUB_OUTPUT
     outputs:
       dirs: ${{ steps.dirs.outputs.dirs }}