bitwarden_workflow_linter 0.0.3__tar.gz → 0.0.5__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (74) hide show
  1. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/CODEOWNERS +1 -1
  2. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/renovate.json +1 -0
  3. bitwarden_workflow_linter-0.0.5/.github/workflows/_version_type.yml +57 -0
  4. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/cd.yml +32 -45
  5. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/ci.yml +2 -2
  6. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/enforce-labels.yml +1 -2
  7. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/scan.yml +5 -5
  8. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.gitignore +5 -0
  9. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/PKG-INFO +5 -1
  10. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/README.md +4 -0
  11. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/package-lock.json +8 -8
  12. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/package.json +2 -2
  13. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/settings.yaml +1 -0
  14. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/__about__.py +1 -1
  15. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/actions.py +0 -2
  16. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/cli.py +0 -3
  17. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/default_settings.yaml +1 -0
  18. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/lint.py +0 -1
  19. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/load.py +0 -5
  20. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/job.py +2 -0
  21. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rule.py +0 -2
  22. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/job_environment_prefix.py +0 -1
  23. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/name_capitalized.py +0 -1
  24. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/name_exists.py +0 -1
  25. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/pinned_job_runner.py +0 -1
  26. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/step_approved.py +0 -1
  27. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/step_pinned.py +0 -1
  28. bitwarden_workflow_linter-0.0.5/src/bitwarden_workflow_linter/rules/underscore_outputs.py +110 -0
  29. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/utils.py +0 -9
  30. bitwarden_workflow_linter-0.0.5/tests/fixtures/test-outputs-incorrect.yml +45 -0
  31. bitwarden_workflow_linter-0.0.5/tests/rules/test_underscore_output.py +259 -0
  32. bitwarden_workflow_linter-0.0.3/.github/workflows/_version_type.yml +0 -60
  33. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.editorconfig +0 -0
  34. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.gitattributes +0 -0
  35. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/ISSUE_TEMPLATE/config.yml +0 -0
  36. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/PULL_REQUEST_TEMPLATE.md +0 -0
  37. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.husky/pre-commit +0 -0
  38. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.python-version +0 -0
  39. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/CONTRIBUTING.md +0 -0
  40. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/LICENSE.txt +0 -0
  41. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Pipfile +0 -0
  42. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Pipfile.lock +0 -0
  43. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/SECURITY.md +0 -0
  44. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Taskfile.yml +0 -0
  45. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pylintrc +0 -0
  46. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pyproject.toml +0 -0
  47. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pyproject.toml.tpl +0 -0
  48. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/__init__.py +0 -0
  49. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/default_actions.json +0 -0
  50. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/__init__.py +0 -0
  51. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/step.py +0 -0
  52. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/workflow.py +0 -0
  53. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/__init__.py +0 -0
  54. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/__init__.py +0 -0
  55. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/conftest.py +0 -0
  56. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-alt.yml +0 -0
  57. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-min-incorrect.yaml +0 -0
  58. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-min.yaml +0 -0
  59. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test.yml +0 -0
  60. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test_a.yaml +0 -0
  61. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/__init__.py +0 -0
  62. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_job_environment_prefix.py +0 -0
  63. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_name_capitalized.py +0 -0
  64. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_name_exists.py +0 -0
  65. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_pinned_job_runner.py +0 -0
  66. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_step_approved.py +0 -0
  67. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_step_pinned.py +0 -0
  68. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_job.py +0 -0
  69. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_lint.py +0 -0
  70. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_load.py +0 -0
  71. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_rule.py +0 -0
  72. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_step.py +0 -0
  73. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_utils.py +0 -0
  74. {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_workflow.py +0 -0
@@ -5,4 +5,4 @@
5
5
  # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
6
6
 
7
7
  # Default file owners
8
- * @bitwarden/dept-devops
8
+ * @bitwarden/dept-bre
@@ -2,6 +2,7 @@
2
2
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
3
3
  "extends": ["github>bitwarden/renovate-config"],
4
4
  "enabledManagers": ["github-actions", "npm", "pipenv"],
5
+ "labels": ["version:patch"],
5
6
  "packageRules": [
6
7
  {
7
8
  "groupName": "gh minor",
@@ -0,0 +1,57 @@
1
+ name: _version_type
2
+ run-name: Get version type
3
+
4
+ on:
5
+ workflow_call:
6
+ outputs:
7
+ version_bump_type:
8
+ description: "version to be built"
9
+ value: ${{ jobs.version.outputs.bump_type }}
10
+
11
+ jobs:
12
+ version:
13
+ name: Calculate Version
14
+ runs-on: ubuntu-22.04
15
+ outputs:
16
+ bump_type: ${{ steps.bump-type.outputs.type }}
17
+ steps:
18
+ - name: Get PR ID
19
+ id: pr
20
+ env:
21
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
22
+ run: |
23
+ commit_message=$(
24
+ curl -s -L \
25
+ -H "Accept: application/vnd.github+json" \
26
+ -H "Authorization: Bearer $GH_TOKEN" \
27
+ -H "X-GitHub-Api-Version: 2022-11-28" \
28
+ https://api.github.com/repos/${{ github.repository }}/commits/${{ github.sha }} | \
29
+ jq -r ".commit.message"
30
+ )
31
+ ID=$(echo "$commit_message" | head -1 | grep -o "(#.*)" | grep -o "[0-9]*")
32
+ echo "id=$ID" >> $GITHUB_OUTPUT
33
+
34
+ - name: Get version bump type
35
+ id: bump-type
36
+ env:
37
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38
+ PR_NUMBER: ${{ steps.pr.outputs.id }}
39
+ run: |
40
+ version_tag=$(
41
+ curl -s -L \
42
+ -H "Accept: application/vnd.github+json" \
43
+ -H "Authorization: Bearer $GH_TOKEN" \
44
+ -H "X-GitHub-Api-Version: 2022-11-28" \
45
+ https://api.github.com/repos/${{ github.repository }}/issues/$PR_NUMBER/labels | \
46
+ jq -r ".[].name" | grep "version"
47
+ )
48
+
49
+ # Single Version label Enforcement (should go in CI...)
50
+ if [[ $(echo $version_tag | wc -w) -gt 1 ]]; then
51
+ echo "[!] multiple version labels found!"
52
+ exit 1
53
+ fi
54
+
55
+ version_type=$(echo $version_tag | cut -d ":" -f 2)
56
+ echo "Version Bump Type: $version_type"
57
+ echo "type=$version_type" >> $GITHUB_OUTPUT
@@ -1,6 +1,4 @@
1
- ---
2
1
  name: CD
3
- run-name: CD ${{ inputs.release_type }}
4
2
 
5
3
  on:
6
4
  push:
@@ -9,32 +7,44 @@ on:
9
7
  paths:
10
8
  - "src/**"
11
9
  workflow_dispatch:
12
- inputs:
13
- release_type:
14
- description: 'Release type'
15
- required: true
16
- type: choice
17
- default: 'Dry Run'
18
- options:
19
- - 'Dry Run'
20
- - 'Release'
10
+
21
11
 
22
12
  jobs:
23
13
  version-type:
14
+ name: Get version type
15
+ if: github.actor != 'bitwarden-devops-bot'
24
16
  uses: ./.github/workflows/_version_type.yml
25
17
 
26
18
  version-bump:
27
19
  name: Version bump
20
+ if: github.actor != 'bitwarden-devops-bot'
28
21
  runs-on: ubuntu-22.04
29
22
  needs: version-type
30
23
  outputs:
31
24
  version: ${{ steps.get-version.outputs.version }}
32
25
  steps:
26
+ - name: Login to Azure - CI Subscription
27
+ uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
28
+ with:
29
+ creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
30
+
31
+ - name: Retrieve secrets
32
+ id: retrieve-secrets
33
+ uses: bitwarden/gh-actions/get-keyvault-secrets@main
34
+ with:
35
+ keyvault: "bitwarden-ci"
36
+ secrets: "github-gpg-private-key,
37
+ github-gpg-private-key-passphrase,
38
+ github-pat-bitwarden-devops-bot-repo-scope"
39
+
33
40
  - name: Check out repo
34
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
41
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
42
+ with:
43
+ fetch-depth: 0
44
+ token: ${{ steps.retrieve-secrets.outputs.github-pat-bitwarden-devops-bot-repo-scope }}
35
45
 
36
46
  - name: Set up Python
37
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
47
+ uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
38
48
  with:
39
49
  python-version-file: ".python-version"
40
50
 
@@ -53,22 +63,8 @@ jobs:
53
63
  VERSION=$(hatch version)
54
64
  echo "version=$VERSION" >> $GITHUB_OUTPUT
55
65
 
56
- - name: Login to Azure - CI Subscription
57
- uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
58
- with:
59
- creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
60
-
61
- - name: Retrieve secrets
62
- id: retrieve-secrets
63
- uses: bitwarden/gh-actions/get-keyvault-secrets@main
64
- with:
65
- keyvault: "bitwarden-ci"
66
- secrets: "github-gpg-private-key,
67
- github-gpg-private-key-passphrase,
68
- github-pat-bitwarden-devops-bot-repo-scope"
69
-
70
66
  - name: Import GPG key
71
- uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
67
+ uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
72
68
  with:
73
69
  gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
74
70
  passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
@@ -84,41 +80,41 @@ jobs:
84
80
  env:
85
81
  OLD_VERSION: ${{ env.OLD_VERSION }}
86
82
  VERSION: ${{ steps.get-version.outputs.version }}
87
- if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
88
83
  run: |
89
84
  git commit -am "Bump version from $OLD_VERSION to $VERSION"
90
- git tag $VERSION
85
+ git tag v$VERSION
91
86
  git push
92
87
  git push --tags
93
88
 
94
89
  release:
95
90
  name: GitHub release
91
+ if: github.actor != 'bitwarden-devops-bot'
96
92
  runs-on: ubuntu-22.04
97
93
  needs: version-bump
98
- if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
99
94
  steps:
100
95
  - name: Check out repo
101
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
96
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
102
97
 
103
98
  - name: Create GitHub release
104
99
  uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
105
100
  with:
106
101
  commit: ${{ github.sha }}
107
102
  tag: v${{ steps.version-bump.outputs.version }}
108
- name: Version version-bump
103
+ name: v${{ steps.version-bump.outputs.version }}
109
104
  token: ${{ secrets.GITHUB_TOKEN }}
110
105
  draft: false
111
106
 
112
107
  deploy:
113
108
  name: Deploy workflow-linter (v2)
109
+ if: github.actor != 'bitwarden-devops-bot'
114
110
  runs-on: ubuntu-22.04
115
111
  needs: version-bump
116
112
  steps:
117
113
  - name: Check out repo
118
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
114
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
119
115
 
120
116
  - name: Set up Python
121
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
117
+ uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
122
118
  with:
123
119
  python-version-file: ".python-version"
124
120
 
@@ -135,22 +131,13 @@ jobs:
135
131
  uses: bitwarden/gh-actions/get-keyvault-secrets@main
136
132
  with:
137
133
  keyvault: "bitwarden-ci"
138
- secrets: "pypi-api-token,
139
- pypi-test-api-token"
134
+ secrets: "pypi-api-token"
140
135
 
141
136
  - name: Build
142
137
  run: hatch build
143
138
 
144
139
  - name: Publish
145
- if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
146
140
  env:
147
141
  HATCH_INDEX_USER: __token__
148
142
  HATCH_INDEX_AUTH: ${{ steps.retrieve-secret.outputs.pypi-api-token }}
149
143
  run: hatch publish
150
-
151
- - name: Dry Run - Publish
152
- if: ${{ github.event_name == 'workflow_dispatch' }} && ${{ inputs.release_type == 'Dry Run' }}
153
- env:
154
- HATCH_INDEX_USER: __token__
155
- HATCH_INDEX_AUTH: ${{ steps.retrieve-secret.outputs.pypi-test-api-token }}
156
- run: hatch publish -r test
@@ -13,10 +13,10 @@ jobs:
13
13
  runs-on: ubuntu-22.04
14
14
  steps:
15
15
  - name: Check out repo
16
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
16
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17
17
 
18
18
  - name: Set up Python
19
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
19
+ uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
20
20
  with:
21
21
  python-version-file: ".python-version"
22
22
 
@@ -1,4 +1,3 @@
1
- ---
2
1
  name: Enforce PR labels
3
2
 
4
3
  on:
@@ -9,7 +8,7 @@ jobs:
9
8
  uses: bitwarden/gh-actions/.github/workflows/_enforce-labels.yml@main
10
9
 
11
10
  enforce-version-label:
12
- if: ${{ !contains(github.event.*.labels.*.name, 'version') }}
11
+ if: "!(contains(github.event.pull_request.labels.*.name, 'version:major') || contains(github.event.pull_request.labels.*.name, 'version:minor') || contains(github.event.pull_request.labels.*.name, 'version:patch'))"
13
12
  name: Enforce version label
14
13
  runs-on: ubuntu-22.04
15
14
 
@@ -26,12 +26,12 @@ jobs:
26
26
 
27
27
  steps:
28
28
  - name: Check out repo
29
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
29
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30
30
  with:
31
31
  ref: ${{ github.event.pull_request.head.sha }}
32
32
 
33
33
  - name: Scan with Checkmarx
34
- uses: checkmarx/ast-github-action@831a8d51a8a0535c0399f9c12728d8d3cc22d850 # 2.0.28
34
+ uses: checkmarx/ast-github-action@f0869bd1a37fddc06499a096101e6c900e815d81 # 2.0.36
35
35
  env:
36
36
  INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
37
37
  with:
@@ -46,7 +46,7 @@ jobs:
46
46
  --output-path . ${{ env.INCREMENTAL }}
47
47
 
48
48
  - name: Upload Checkmarx results to GitHub
49
- uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
49
+ uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
50
50
  with:
51
51
  sarif_file: cx_result.sarif
52
52
 
@@ -60,13 +60,13 @@ jobs:
60
60
 
61
61
  steps:
62
62
  - name: Check out repo
63
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
63
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
64
64
  with:
65
65
  fetch-depth: 0
66
66
  ref: ${{ github.event.pull_request.head.sha }}
67
67
 
68
68
  - name: Scan with SonarCloud
69
- uses: sonarsource/sonarcloud-github-action@4006f663ecaf1f8093e8e4abb9227f6041f52216 # v2.2.0
69
+ uses: sonarsource/sonarcloud-github-action@383f7e52eae3ab0510c3cb0e7d9d150bbaeab838 # v3.1.0
70
70
  env:
71
71
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
72
72
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -30,3 +30,8 @@ dist
30
30
  ## Dev Environments
31
31
  Session.vim
32
32
  flake.*
33
+
34
+
35
+ # Python
36
+ **/__pycache__/**
37
+ *.pyc
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.3
2
2
  Name: bitwarden_workflow_linter
3
- Version: 0.0.3
3
+ Version: 0.0.5
4
4
  Summary: Custom GitHub Action Workflow Linter
5
5
  Project-URL: Homepage, https://github.com/bitwarden/workflow-linter
6
6
  Project-URL: Issues, https://github.com/bitwarden/workflow-linter/issues
@@ -66,6 +66,7 @@ enabled_rules:
66
66
  - bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
67
67
  - bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
68
68
  - bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
69
+ - bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
69
70
 
70
71
  approved_actions_path: default_actions.json
71
72
  ```
@@ -177,6 +178,9 @@ By default, a new Rule needs five things:
177
178
  not support Rules that check against multiple objects at a time OR file level formatting (one empty between each step or
178
179
  two empty lines between each job)
179
180
 
181
+ To activate a rule after implementing it, add it to `settings.yaml` in the project's base folder
182
+ and `src/bitwarden_workflow_linter/default_settings.yaml` to make the rule default
183
+
180
184
  ### ToDo
181
185
 
182
186
  - [ ] Add Rule to assert correct format for single line run
@@ -40,6 +40,7 @@ enabled_rules:
40
40
  - bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
41
41
  - bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
42
42
  - bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
43
+ - bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
43
44
 
44
45
  approved_actions_path: default_actions.json
45
46
  ```
@@ -151,6 +152,9 @@ By default, a new Rule needs five things:
151
152
  not support Rules that check against multiple objects at a time OR file level formatting (one empty between each step or
152
153
  two empty lines between each job)
153
154
 
155
+ To activate a rule after implementing it, add it to `settings.yaml` in the project's base folder
156
+ and `src/bitwarden_workflow_linter/default_settings.yaml` to make the rule default
157
+
154
158
  ### ToDo
155
159
 
156
160
  - [ ] Add Rule to assert correct format for single line run
@@ -10,8 +10,8 @@
10
10
  "license": "SEE LICENSE IN LICENSE.txt",
11
11
  "devDependencies": {
12
12
  "husky": "9.0.11",
13
- "lint-staged": "15.2.5",
14
- "prettier": "3.2.5"
13
+ "lint-staged": "15.2.7",
14
+ "prettier": "3.3.2"
15
15
  }
16
16
  },
17
17
  "node_modules/ansi-escapes": {
@@ -322,9 +322,9 @@
322
322
  }
323
323
  },
324
324
  "node_modules/lint-staged": {
325
- "version": "15.2.5",
326
- "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-15.2.5.tgz",
327
- "integrity": "sha512-j+DfX7W9YUvdzEZl3Rk47FhDF6xwDBV5wwsCPw6BwWZVPYJemusQmvb9bRsW23Sqsaa+vRloAWogbK4BUuU2zA==",
325
+ "version": "15.2.7",
326
+ "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-15.2.7.tgz",
327
+ "integrity": "sha512-+FdVbbCZ+yoh7E/RosSdqKJyUM2OEjTciH0TFNkawKgvFp1zbGlEC39RADg+xKBG1R4mhoH2j85myBQZ5wR+lw==",
328
328
  "dev": true,
329
329
  "license": "MIT",
330
330
  "dependencies": {
@@ -543,9 +543,9 @@
543
543
  }
544
544
  },
545
545
  "node_modules/prettier": {
546
- "version": "3.2.5",
547
- "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.5.tgz",
548
- "integrity": "sha512-3/GWa9aOC0YeD7LUfvOG2NiDyhOWRvt1k+rcKhOuYnMY24iiCphgneUfJDyFXd6rZCAnuLBv6UeAULtrhT/F4A==",
546
+ "version": "3.3.2",
547
+ "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.3.2.tgz",
548
+ "integrity": "sha512-rAVeHYMcv8ATV5d508CFdn+8/pHPpXeIid1DdrPwXnaAdH7cqjVbpJaT5eq4yRAFU/lsbwYwSF/n5iNrdJHPQA==",
549
549
  "dev": true,
550
550
  "license": "MIT",
551
551
  "bin": {
@@ -14,8 +14,8 @@
14
14
  "homepage": "https://bitwarden.com",
15
15
  "devDependencies": {
16
16
  "husky": "9.0.11",
17
- "lint-staged": "15.2.5",
18
- "prettier": "3.2.5"
17
+ "lint-staged": "15.2.7",
18
+ "prettier": "3.3.2"
19
19
  },
20
20
  "lint-staged": {
21
21
  "!(*.py)": "prettier --cache --write --ignore-unknown",
@@ -4,5 +4,6 @@ enabled_rules:
4
4
  - bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
5
5
  - bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
6
6
  - bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
7
+ - bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
7
8
 
8
9
  approved_actions_path: default_actions.json
@@ -1,3 +1,3 @@
1
1
  """Metadata for Workflow Linter."""
2
2
 
3
- __version__ = "0.0.3"
3
+ __version__ = "0.0.5"
@@ -11,13 +11,11 @@ from typing import Optional, Union
11
11
 
12
12
  from .utils import Colors, Settings, Action
13
13
 
14
-
15
14
  class GitHubApiSchemaError(Exception):
16
15
  """A generic Exception to catch redefinitions of GitHub Api Schema changes."""
17
16
 
18
17
  pass
19
18
 
20
-
21
19
  class ActionsCmd:
22
20
  """Command to manage the pre-approved list of Actions
23
21
 
@@ -9,10 +9,8 @@ from .actions import ActionsCmd
9
9
  from .lint import LinterCmd
10
10
  from .utils import Settings
11
11
 
12
-
13
12
  local_settings = Settings.factory()
14
13
 
15
-
16
14
  def main(input_args: Optional[List[str]] = None) -> int:
17
15
  """CLI utility to lint GitHub Action Workflows.
18
16
 
@@ -50,6 +48,5 @@ def main(input_args: Optional[List[str]] = None) -> int:
50
48
 
51
49
  return -1
52
50
 
53
-
54
51
  if __name__ == "__main__":
55
52
  sys.exit(main())
@@ -4,5 +4,6 @@ enabled_rules:
4
4
  - bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
5
5
  - bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
6
6
  - bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
7
+ - bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
7
8
 
8
9
  approved_actions_path: default_actions.json
@@ -10,7 +10,6 @@ from typing import Optional
10
10
  from .load import WorkflowBuilder, Rules
11
11
  from .utils import LintFinding, Settings
12
12
 
13
-
14
13
  class LinterCmd:
15
14
  """Command to lint GitHub Action Workflow files
16
15
 
@@ -13,16 +13,13 @@ from .models.workflow import Workflow
13
13
  from .rule import Rule
14
14
  from .utils import Settings
15
15
 
16
-
17
16
  yaml = YAML()
18
17
 
19
-
20
18
  class WorkflowBuilderError(Exception):
21
19
  """Exception to indicate an error with the WorkflowBuilder."""
22
20
 
23
21
  pass
24
22
 
25
-
26
23
  class WorkflowBuilder:
27
24
  """Collection of methods to build Workflow objects."""
28
25
 
@@ -85,13 +82,11 @@ class WorkflowBuilder:
85
82
  "The workflow must either be built from a file or from a CommentedMap"
86
83
  )
87
84
 
88
-
89
85
  class LoadRulesError(Exception):
90
86
  """Exception to indicate an error with loading rules."""
91
87
 
92
88
  pass
93
89
 
94
-
95
90
  class Rules:
96
91
  """A collection of all of the types of rules.
97
92
 
@@ -30,6 +30,7 @@ class Job:
30
30
  uses_with: Optional[CommentedMap] = field(
31
31
  metadata=config(field_name="with"), default=None
32
32
  )
33
+ outputs: Optional[CommentedMap] = None
33
34
 
34
35
  @classmethod
35
36
  def init(cls: Self, key: str, data: CommentedMap) -> Self:
@@ -39,6 +40,7 @@ class Job:
39
40
  "name": data["name"] if "name" in data else None,
40
41
  "runs-on": data["runs-on"] if "runs-on" in data else None,
41
42
  "env": data["env"] if "env" in data else None,
43
+ "outputs": data["outputs"] if "outputs" in data else None,
42
44
  }
43
45
 
44
46
  new_job = cls.from_dict(init_data)
@@ -7,13 +7,11 @@ from .models.job import Job
7
7
  from .models.step import Step
8
8
  from .utils import LintFinding, LintLevels, Settings
9
9
 
10
-
11
10
  class RuleExecutionException(Exception):
12
11
  """Exception for the Base Rule class."""
13
12
 
14
13
  pass
15
14
 
16
-
17
15
  class Rule:
18
16
  """Base class of a Rule to extend to create a linting Rule."""
19
17
 
@@ -6,7 +6,6 @@ from ..models.job import Job
6
6
  from ..rule import Rule
7
7
  from ..utils import LintLevels, Settings
8
8
 
9
-
10
9
  class RuleJobEnvironmentPrefix(Rule):
11
10
  """Rule to enforce specific prefixes for environment variables.
12
11
 
@@ -8,7 +8,6 @@ from ..models.workflow import Workflow
8
8
  from ..rule import Rule
9
9
  from ..utils import LintLevels, Settings
10
10
 
11
-
12
11
  class RuleNameCapitalized(Rule):
13
12
  """Rule to enforce all 'name' values start with a capital letter.
14
13
 
@@ -8,7 +8,6 @@ from ..models.step import Step
8
8
  from ..rule import Rule
9
9
  from ..utils import LintLevels, Settings
10
10
 
11
-
12
11
  class RuleNameExists(Rule):
13
12
  """Rule to enforce a 'name' key exists for every object in GitHub Actions.
14
13
 
@@ -6,7 +6,6 @@ from ..models.job import Job
6
6
  from ..rule import Rule
7
7
  from ..utils import LintLevels, Settings
8
8
 
9
-
10
9
  class RuleJobRunnerVersionPinned(Rule):
11
10
  """Rule to enforce pinned Runner OS versions.
12
11
 
@@ -6,7 +6,6 @@ from ..models.step import Step
6
6
  from ..rule import Rule
7
7
  from ..utils import LintLevels, Settings
8
8
 
9
-
10
9
  class RuleStepUsesApproved(Rule):
11
10
  """Rule to enforce that all Actions have been pre-approved.
12
11
 
@@ -6,7 +6,6 @@ from ..models.step import Step
6
6
  from ..rule import Rule
7
7
  from ..utils import LintLevels, Settings
8
8
 
9
-
10
9
  class RuleStepUsesPinned(Rule):
11
10
  """Rule to contain the enforcement logic for pinning Actions versions.
12
11