bitwarden_workflow_linter 0.0.3__tar.gz → 0.0.5__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/CODEOWNERS +1 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/renovate.json +1 -0
- bitwarden_workflow_linter-0.0.5/.github/workflows/_version_type.yml +57 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/cd.yml +32 -45
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/ci.yml +2 -2
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/enforce-labels.yml +1 -2
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/scan.yml +5 -5
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.gitignore +5 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/PKG-INFO +5 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/README.md +4 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/package-lock.json +8 -8
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/package.json +2 -2
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/settings.yaml +1 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/__about__.py +1 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/actions.py +0 -2
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/cli.py +0 -3
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/default_settings.yaml +1 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/lint.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/load.py +0 -5
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/job.py +2 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rule.py +0 -2
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/job_environment_prefix.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/name_capitalized.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/name_exists.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/pinned_job_runner.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/step_approved.py +0 -1
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/step_pinned.py +0 -1
- bitwarden_workflow_linter-0.0.5/src/bitwarden_workflow_linter/rules/underscore_outputs.py +110 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/utils.py +0 -9
- bitwarden_workflow_linter-0.0.5/tests/fixtures/test-outputs-incorrect.yml +45 -0
- bitwarden_workflow_linter-0.0.5/tests/rules/test_underscore_output.py +259 -0
- bitwarden_workflow_linter-0.0.3/.github/workflows/_version_type.yml +0 -60
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.editorconfig +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.gitattributes +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/ISSUE_TEMPLATE/config.yml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/PULL_REQUEST_TEMPLATE.md +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.husky/pre-commit +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.python-version +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/CONTRIBUTING.md +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/LICENSE.txt +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Pipfile +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Pipfile.lock +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/SECURITY.md +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/Taskfile.yml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pylintrc +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pyproject.toml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/pyproject.toml.tpl +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/__init__.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/default_actions.json +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/__init__.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/step.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/models/workflow.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/src/bitwarden_workflow_linter/rules/__init__.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/__init__.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/conftest.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-alt.yml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-min-incorrect.yaml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test-min.yaml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test.yml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/fixtures/test_a.yaml +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/__init__.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_job_environment_prefix.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_name_capitalized.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_name_exists.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_pinned_job_runner.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_step_approved.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/rules/test_step_pinned.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_job.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_lint.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_load.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_rule.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_step.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_utils.py +0 -0
- {bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/tests/test_workflow.py +0 -0
@@ -0,0 +1,57 @@
|
|
1
|
+
name: _version_type
|
2
|
+
run-name: Get version type
|
3
|
+
|
4
|
+
on:
|
5
|
+
workflow_call:
|
6
|
+
outputs:
|
7
|
+
version_bump_type:
|
8
|
+
description: "version to be built"
|
9
|
+
value: ${{ jobs.version.outputs.bump_type }}
|
10
|
+
|
11
|
+
jobs:
|
12
|
+
version:
|
13
|
+
name: Calculate Version
|
14
|
+
runs-on: ubuntu-22.04
|
15
|
+
outputs:
|
16
|
+
bump_type: ${{ steps.bump-type.outputs.type }}
|
17
|
+
steps:
|
18
|
+
- name: Get PR ID
|
19
|
+
id: pr
|
20
|
+
env:
|
21
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
22
|
+
run: |
|
23
|
+
commit_message=$(
|
24
|
+
curl -s -L \
|
25
|
+
-H "Accept: application/vnd.github+json" \
|
26
|
+
-H "Authorization: Bearer $GH_TOKEN" \
|
27
|
+
-H "X-GitHub-Api-Version: 2022-11-28" \
|
28
|
+
https://api.github.com/repos/${{ github.repository }}/commits/${{ github.sha }} | \
|
29
|
+
jq -r ".commit.message"
|
30
|
+
)
|
31
|
+
ID=$(echo "$commit_message" | head -1 | grep -o "(#.*)" | grep -o "[0-9]*")
|
32
|
+
echo "id=$ID" >> $GITHUB_OUTPUT
|
33
|
+
|
34
|
+
- name: Get version bump type
|
35
|
+
id: bump-type
|
36
|
+
env:
|
37
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
38
|
+
PR_NUMBER: ${{ steps.pr.outputs.id }}
|
39
|
+
run: |
|
40
|
+
version_tag=$(
|
41
|
+
curl -s -L \
|
42
|
+
-H "Accept: application/vnd.github+json" \
|
43
|
+
-H "Authorization: Bearer $GH_TOKEN" \
|
44
|
+
-H "X-GitHub-Api-Version: 2022-11-28" \
|
45
|
+
https://api.github.com/repos/${{ github.repository }}/issues/$PR_NUMBER/labels | \
|
46
|
+
jq -r ".[].name" | grep "version"
|
47
|
+
)
|
48
|
+
|
49
|
+
# Single Version label Enforcement (should go in CI...)
|
50
|
+
if [[ $(echo $version_tag | wc -w) -gt 1 ]]; then
|
51
|
+
echo "[!] multiple version labels found!"
|
52
|
+
exit 1
|
53
|
+
fi
|
54
|
+
|
55
|
+
version_type=$(echo $version_tag | cut -d ":" -f 2)
|
56
|
+
echo "Version Bump Type: $version_type"
|
57
|
+
echo "type=$version_type" >> $GITHUB_OUTPUT
|
{bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/cd.yml
RENAMED
@@ -1,6 +1,4 @@
|
|
1
|
-
---
|
2
1
|
name: CD
|
3
|
-
run-name: CD ${{ inputs.release_type }}
|
4
2
|
|
5
3
|
on:
|
6
4
|
push:
|
@@ -9,32 +7,44 @@ on:
|
|
9
7
|
paths:
|
10
8
|
- "src/**"
|
11
9
|
workflow_dispatch:
|
12
|
-
|
13
|
-
release_type:
|
14
|
-
description: 'Release type'
|
15
|
-
required: true
|
16
|
-
type: choice
|
17
|
-
default: 'Dry Run'
|
18
|
-
options:
|
19
|
-
- 'Dry Run'
|
20
|
-
- 'Release'
|
10
|
+
|
21
11
|
|
22
12
|
jobs:
|
23
13
|
version-type:
|
14
|
+
name: Get version type
|
15
|
+
if: github.actor != 'bitwarden-devops-bot'
|
24
16
|
uses: ./.github/workflows/_version_type.yml
|
25
17
|
|
26
18
|
version-bump:
|
27
19
|
name: Version bump
|
20
|
+
if: github.actor != 'bitwarden-devops-bot'
|
28
21
|
runs-on: ubuntu-22.04
|
29
22
|
needs: version-type
|
30
23
|
outputs:
|
31
24
|
version: ${{ steps.get-version.outputs.version }}
|
32
25
|
steps:
|
26
|
+
- name: Login to Azure - CI Subscription
|
27
|
+
uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
|
28
|
+
with:
|
29
|
+
creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
|
30
|
+
|
31
|
+
- name: Retrieve secrets
|
32
|
+
id: retrieve-secrets
|
33
|
+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
34
|
+
with:
|
35
|
+
keyvault: "bitwarden-ci"
|
36
|
+
secrets: "github-gpg-private-key,
|
37
|
+
github-gpg-private-key-passphrase,
|
38
|
+
github-pat-bitwarden-devops-bot-repo-scope"
|
39
|
+
|
33
40
|
- name: Check out repo
|
34
|
-
uses: actions/checkout@
|
41
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
42
|
+
with:
|
43
|
+
fetch-depth: 0
|
44
|
+
token: ${{ steps.retrieve-secrets.outputs.github-pat-bitwarden-devops-bot-repo-scope }}
|
35
45
|
|
36
46
|
- name: Set up Python
|
37
|
-
uses: actions/setup-python@
|
47
|
+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
38
48
|
with:
|
39
49
|
python-version-file: ".python-version"
|
40
50
|
|
@@ -53,22 +63,8 @@ jobs:
|
|
53
63
|
VERSION=$(hatch version)
|
54
64
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
55
65
|
|
56
|
-
- name: Login to Azure - CI Subscription
|
57
|
-
uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
|
58
|
-
with:
|
59
|
-
creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
|
60
|
-
|
61
|
-
- name: Retrieve secrets
|
62
|
-
id: retrieve-secrets
|
63
|
-
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
64
|
-
with:
|
65
|
-
keyvault: "bitwarden-ci"
|
66
|
-
secrets: "github-gpg-private-key,
|
67
|
-
github-gpg-private-key-passphrase,
|
68
|
-
github-pat-bitwarden-devops-bot-repo-scope"
|
69
|
-
|
70
66
|
- name: Import GPG key
|
71
|
-
uses: crazy-max/ghaction-import-gpg@
|
67
|
+
uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
|
72
68
|
with:
|
73
69
|
gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
|
74
70
|
passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
|
@@ -84,41 +80,41 @@ jobs:
|
|
84
80
|
env:
|
85
81
|
OLD_VERSION: ${{ env.OLD_VERSION }}
|
86
82
|
VERSION: ${{ steps.get-version.outputs.version }}
|
87
|
-
if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
|
88
83
|
run: |
|
89
84
|
git commit -am "Bump version from $OLD_VERSION to $VERSION"
|
90
|
-
git tag $VERSION
|
85
|
+
git tag v$VERSION
|
91
86
|
git push
|
92
87
|
git push --tags
|
93
88
|
|
94
89
|
release:
|
95
90
|
name: GitHub release
|
91
|
+
if: github.actor != 'bitwarden-devops-bot'
|
96
92
|
runs-on: ubuntu-22.04
|
97
93
|
needs: version-bump
|
98
|
-
if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
|
99
94
|
steps:
|
100
95
|
- name: Check out repo
|
101
|
-
uses: actions/checkout@
|
96
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
102
97
|
|
103
98
|
- name: Create GitHub release
|
104
99
|
uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
|
105
100
|
with:
|
106
101
|
commit: ${{ github.sha }}
|
107
102
|
tag: v${{ steps.version-bump.outputs.version }}
|
108
|
-
name:
|
103
|
+
name: v${{ steps.version-bump.outputs.version }}
|
109
104
|
token: ${{ secrets.GITHUB_TOKEN }}
|
110
105
|
draft: false
|
111
106
|
|
112
107
|
deploy:
|
113
108
|
name: Deploy workflow-linter (v2)
|
109
|
+
if: github.actor != 'bitwarden-devops-bot'
|
114
110
|
runs-on: ubuntu-22.04
|
115
111
|
needs: version-bump
|
116
112
|
steps:
|
117
113
|
- name: Check out repo
|
118
|
-
uses: actions/checkout@
|
114
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
119
115
|
|
120
116
|
- name: Set up Python
|
121
|
-
uses: actions/setup-python@
|
117
|
+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
122
118
|
with:
|
123
119
|
python-version-file: ".python-version"
|
124
120
|
|
@@ -135,22 +131,13 @@ jobs:
|
|
135
131
|
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
136
132
|
with:
|
137
133
|
keyvault: "bitwarden-ci"
|
138
|
-
secrets: "pypi-api-token
|
139
|
-
pypi-test-api-token"
|
134
|
+
secrets: "pypi-api-token"
|
140
135
|
|
141
136
|
- name: Build
|
142
137
|
run: hatch build
|
143
138
|
|
144
139
|
- name: Publish
|
145
|
-
if: ${{ github.event_name == 'push' }} || ${{ inputs.release_type != 'Dry Run' }}
|
146
140
|
env:
|
147
141
|
HATCH_INDEX_USER: __token__
|
148
142
|
HATCH_INDEX_AUTH: ${{ steps.retrieve-secret.outputs.pypi-api-token }}
|
149
143
|
run: hatch publish
|
150
|
-
|
151
|
-
- name: Dry Run - Publish
|
152
|
-
if: ${{ github.event_name == 'workflow_dispatch' }} && ${{ inputs.release_type == 'Dry Run' }}
|
153
|
-
env:
|
154
|
-
HATCH_INDEX_USER: __token__
|
155
|
-
HATCH_INDEX_AUTH: ${{ steps.retrieve-secret.outputs.pypi-test-api-token }}
|
156
|
-
run: hatch publish -r test
|
{bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/ci.yml
RENAMED
@@ -13,10 +13,10 @@ jobs:
|
|
13
13
|
runs-on: ubuntu-22.04
|
14
14
|
steps:
|
15
15
|
- name: Check out repo
|
16
|
-
uses: actions/checkout@
|
16
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
17
17
|
|
18
18
|
- name: Set up Python
|
19
|
-
uses: actions/setup-python@
|
19
|
+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
|
20
20
|
with:
|
21
21
|
python-version-file: ".python-version"
|
22
22
|
|
@@ -1,4 +1,3 @@
|
|
1
|
-
---
|
2
1
|
name: Enforce PR labels
|
3
2
|
|
4
3
|
on:
|
@@ -9,7 +8,7 @@ jobs:
|
|
9
8
|
uses: bitwarden/gh-actions/.github/workflows/_enforce-labels.yml@main
|
10
9
|
|
11
10
|
enforce-version-label:
|
12
|
-
if:
|
11
|
+
if: "!(contains(github.event.pull_request.labels.*.name, 'version:major') || contains(github.event.pull_request.labels.*.name, 'version:minor') || contains(github.event.pull_request.labels.*.name, 'version:patch'))"
|
13
12
|
name: Enforce version label
|
14
13
|
runs-on: ubuntu-22.04
|
15
14
|
|
{bitwarden_workflow_linter-0.0.3 → bitwarden_workflow_linter-0.0.5}/.github/workflows/scan.yml
RENAMED
@@ -26,12 +26,12 @@ jobs:
|
|
26
26
|
|
27
27
|
steps:
|
28
28
|
- name: Check out repo
|
29
|
-
uses: actions/checkout@
|
29
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
30
30
|
with:
|
31
31
|
ref: ${{ github.event.pull_request.head.sha }}
|
32
32
|
|
33
33
|
- name: Scan with Checkmarx
|
34
|
-
uses: checkmarx/ast-github-action@
|
34
|
+
uses: checkmarx/ast-github-action@f0869bd1a37fddc06499a096101e6c900e815d81 # 2.0.36
|
35
35
|
env:
|
36
36
|
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
|
37
37
|
with:
|
@@ -46,7 +46,7 @@ jobs:
|
|
46
46
|
--output-path . ${{ env.INCREMENTAL }}
|
47
47
|
|
48
48
|
- name: Upload Checkmarx results to GitHub
|
49
|
-
uses: github/codeql-action/upload-sarif@
|
49
|
+
uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
|
50
50
|
with:
|
51
51
|
sarif_file: cx_result.sarif
|
52
52
|
|
@@ -60,13 +60,13 @@ jobs:
|
|
60
60
|
|
61
61
|
steps:
|
62
62
|
- name: Check out repo
|
63
|
-
uses: actions/checkout@
|
63
|
+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
64
64
|
with:
|
65
65
|
fetch-depth: 0
|
66
66
|
ref: ${{ github.event.pull_request.head.sha }}
|
67
67
|
|
68
68
|
- name: Scan with SonarCloud
|
69
|
-
uses: sonarsource/sonarcloud-github-action@
|
69
|
+
uses: sonarsource/sonarcloud-github-action@383f7e52eae3ab0510c3cb0e7d9d150bbaeab838 # v3.1.0
|
70
70
|
env:
|
71
71
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
72
72
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Metadata-Version: 2.3
|
2
2
|
Name: bitwarden_workflow_linter
|
3
|
-
Version: 0.0.
|
3
|
+
Version: 0.0.5
|
4
4
|
Summary: Custom GitHub Action Workflow Linter
|
5
5
|
Project-URL: Homepage, https://github.com/bitwarden/workflow-linter
|
6
6
|
Project-URL: Issues, https://github.com/bitwarden/workflow-linter/issues
|
@@ -66,6 +66,7 @@ enabled_rules:
|
|
66
66
|
- bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
|
67
67
|
- bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
|
68
68
|
- bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
|
69
|
+
- bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
|
69
70
|
|
70
71
|
approved_actions_path: default_actions.json
|
71
72
|
```
|
@@ -177,6 +178,9 @@ By default, a new Rule needs five things:
|
|
177
178
|
not support Rules that check against multiple objects at a time OR file level formatting (one empty between each step or
|
178
179
|
two empty lines between each job)
|
179
180
|
|
181
|
+
To activate a rule after implementing it, add it to `settings.yaml` in the project's base folder
|
182
|
+
and `src/bitwarden_workflow_linter/default_settings.yaml` to make the rule default
|
183
|
+
|
180
184
|
### ToDo
|
181
185
|
|
182
186
|
- [ ] Add Rule to assert correct format for single line run
|
@@ -40,6 +40,7 @@ enabled_rules:
|
|
40
40
|
- bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
|
41
41
|
- bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
|
42
42
|
- bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
|
43
|
+
- bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
|
43
44
|
|
44
45
|
approved_actions_path: default_actions.json
|
45
46
|
```
|
@@ -151,6 +152,9 @@ By default, a new Rule needs five things:
|
|
151
152
|
not support Rules that check against multiple objects at a time OR file level formatting (one empty between each step or
|
152
153
|
two empty lines between each job)
|
153
154
|
|
155
|
+
To activate a rule after implementing it, add it to `settings.yaml` in the project's base folder
|
156
|
+
and `src/bitwarden_workflow_linter/default_settings.yaml` to make the rule default
|
157
|
+
|
154
158
|
### ToDo
|
155
159
|
|
156
160
|
- [ ] Add Rule to assert correct format for single line run
|
@@ -10,8 +10,8 @@
|
|
10
10
|
"license": "SEE LICENSE IN LICENSE.txt",
|
11
11
|
"devDependencies": {
|
12
12
|
"husky": "9.0.11",
|
13
|
-
"lint-staged": "15.2.
|
14
|
-
"prettier": "3.2
|
13
|
+
"lint-staged": "15.2.7",
|
14
|
+
"prettier": "3.3.2"
|
15
15
|
}
|
16
16
|
},
|
17
17
|
"node_modules/ansi-escapes": {
|
@@ -322,9 +322,9 @@
|
|
322
322
|
}
|
323
323
|
},
|
324
324
|
"node_modules/lint-staged": {
|
325
|
-
"version": "15.2.
|
326
|
-
"resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-15.2.
|
327
|
-
"integrity": "sha512
|
325
|
+
"version": "15.2.7",
|
326
|
+
"resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-15.2.7.tgz",
|
327
|
+
"integrity": "sha512-+FdVbbCZ+yoh7E/RosSdqKJyUM2OEjTciH0TFNkawKgvFp1zbGlEC39RADg+xKBG1R4mhoH2j85myBQZ5wR+lw==",
|
328
328
|
"dev": true,
|
329
329
|
"license": "MIT",
|
330
330
|
"dependencies": {
|
@@ -543,9 +543,9 @@
|
|
543
543
|
}
|
544
544
|
},
|
545
545
|
"node_modules/prettier": {
|
546
|
-
"version": "3.2
|
547
|
-
"resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.
|
548
|
-
"integrity": "sha512-
|
546
|
+
"version": "3.3.2",
|
547
|
+
"resolved": "https://registry.npmjs.org/prettier/-/prettier-3.3.2.tgz",
|
548
|
+
"integrity": "sha512-rAVeHYMcv8ATV5d508CFdn+8/pHPpXeIid1DdrPwXnaAdH7cqjVbpJaT5eq4yRAFU/lsbwYwSF/n5iNrdJHPQA==",
|
549
549
|
"dev": true,
|
550
550
|
"license": "MIT",
|
551
551
|
"bin": {
|
@@ -14,8 +14,8 @@
|
|
14
14
|
"homepage": "https://bitwarden.com",
|
15
15
|
"devDependencies": {
|
16
16
|
"husky": "9.0.11",
|
17
|
-
"lint-staged": "15.2.
|
18
|
-
"prettier": "3.2
|
17
|
+
"lint-staged": "15.2.7",
|
18
|
+
"prettier": "3.3.2"
|
19
19
|
},
|
20
20
|
"lint-staged": {
|
21
21
|
"!(*.py)": "prettier --cache --write --ignore-unknown",
|
@@ -4,5 +4,6 @@ enabled_rules:
|
|
4
4
|
- bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
|
5
5
|
- bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
|
6
6
|
- bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
|
7
|
+
- bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
|
7
8
|
|
8
9
|
approved_actions_path: default_actions.json
|
@@ -11,13 +11,11 @@ from typing import Optional, Union
|
|
11
11
|
|
12
12
|
from .utils import Colors, Settings, Action
|
13
13
|
|
14
|
-
|
15
14
|
class GitHubApiSchemaError(Exception):
|
16
15
|
"""A generic Exception to catch redefinitions of GitHub Api Schema changes."""
|
17
16
|
|
18
17
|
pass
|
19
18
|
|
20
|
-
|
21
19
|
class ActionsCmd:
|
22
20
|
"""Command to manage the pre-approved list of Actions
|
23
21
|
|
@@ -9,10 +9,8 @@ from .actions import ActionsCmd
|
|
9
9
|
from .lint import LinterCmd
|
10
10
|
from .utils import Settings
|
11
11
|
|
12
|
-
|
13
12
|
local_settings = Settings.factory()
|
14
13
|
|
15
|
-
|
16
14
|
def main(input_args: Optional[List[str]] = None) -> int:
|
17
15
|
"""CLI utility to lint GitHub Action Workflows.
|
18
16
|
|
@@ -50,6 +48,5 @@ def main(input_args: Optional[List[str]] = None) -> int:
|
|
50
48
|
|
51
49
|
return -1
|
52
50
|
|
53
|
-
|
54
51
|
if __name__ == "__main__":
|
55
52
|
sys.exit(main())
|
@@ -4,5 +4,6 @@ enabled_rules:
|
|
4
4
|
- bitwarden_workflow_linter.rules.pinned_job_runner.RuleJobRunnerVersionPinned
|
5
5
|
- bitwarden_workflow_linter.rules.job_environment_prefix.RuleJobEnvironmentPrefix
|
6
6
|
- bitwarden_workflow_linter.rules.step_pinned.RuleStepUsesPinned
|
7
|
+
- bitwarden_workflow_linter.rules.underscore_outputs.RuleUnderscoreOutputs
|
7
8
|
|
8
9
|
approved_actions_path: default_actions.json
|
@@ -13,16 +13,13 @@ from .models.workflow import Workflow
|
|
13
13
|
from .rule import Rule
|
14
14
|
from .utils import Settings
|
15
15
|
|
16
|
-
|
17
16
|
yaml = YAML()
|
18
17
|
|
19
|
-
|
20
18
|
class WorkflowBuilderError(Exception):
|
21
19
|
"""Exception to indicate an error with the WorkflowBuilder."""
|
22
20
|
|
23
21
|
pass
|
24
22
|
|
25
|
-
|
26
23
|
class WorkflowBuilder:
|
27
24
|
"""Collection of methods to build Workflow objects."""
|
28
25
|
|
@@ -85,13 +82,11 @@ class WorkflowBuilder:
|
|
85
82
|
"The workflow must either be built from a file or from a CommentedMap"
|
86
83
|
)
|
87
84
|
|
88
|
-
|
89
85
|
class LoadRulesError(Exception):
|
90
86
|
"""Exception to indicate an error with loading rules."""
|
91
87
|
|
92
88
|
pass
|
93
89
|
|
94
|
-
|
95
90
|
class Rules:
|
96
91
|
"""A collection of all of the types of rules.
|
97
92
|
|
@@ -30,6 +30,7 @@ class Job:
|
|
30
30
|
uses_with: Optional[CommentedMap] = field(
|
31
31
|
metadata=config(field_name="with"), default=None
|
32
32
|
)
|
33
|
+
outputs: Optional[CommentedMap] = None
|
33
34
|
|
34
35
|
@classmethod
|
35
36
|
def init(cls: Self, key: str, data: CommentedMap) -> Self:
|
@@ -39,6 +40,7 @@ class Job:
|
|
39
40
|
"name": data["name"] if "name" in data else None,
|
40
41
|
"runs-on": data["runs-on"] if "runs-on" in data else None,
|
41
42
|
"env": data["env"] if "env" in data else None,
|
43
|
+
"outputs": data["outputs"] if "outputs" in data else None,
|
42
44
|
}
|
43
45
|
|
44
46
|
new_job = cls.from_dict(init_data)
|
@@ -7,13 +7,11 @@ from .models.job import Job
|
|
7
7
|
from .models.step import Step
|
8
8
|
from .utils import LintFinding, LintLevels, Settings
|
9
9
|
|
10
|
-
|
11
10
|
class RuleExecutionException(Exception):
|
12
11
|
"""Exception for the Base Rule class."""
|
13
12
|
|
14
13
|
pass
|
15
14
|
|
16
|
-
|
17
15
|
class Rule:
|
18
16
|
"""Base class of a Rule to extend to create a linting Rule."""
|
19
17
|
|