bitwarden_workflow_linter 1.3.1__tar.gz → 1.3.3__tar.gz

{bitwarden_workflow_linter-1.3.1 → bitwarden_workflow_linter-1.3.3}/.github/workflows/bwwl_operations.yml

@@ -4,15 +4,19 @@ on:
   workflow_dispatch:
     inputs:
       operation:
-        description: 'Operation to perform. ex: update, add'
+        description: "Operation to perform. ex: update, add"
         required: true
         type: string
       action:
-        description: 'Single action to add. ex: actions/checkout'
+        description: "Single action to add. ex: actions/checkout"
+        required: false
+        type: string
+      artifact:
+        description: "Artifact reference (JIRA ticket, business reason, etc) for the new action."
         required: false
         type: string
   schedule:
-  - cron: '0 0 * * 1'
+    - cron: "0 0 * * 1"
 
 jobs:
   actions-operation:
@@ -24,10 +28,15 @@ jobs:
       pull-requests: write
     env:
       _ACTION: ${{ inputs.action }}
+      _ARTIFACT: ${{ inputs.artifact }}
     steps:
-      -  name: Check for action input
-         if: ${{ inputs.operation == 'add' && !env._ACTION }}
-         run: echo "Action input is required for operation 'add'" && exit 1
+      - name: Check for action input
+        if: ${{ inputs.operation == 'add' && !env._ACTION }}
+        run: echo "Action input is required for operation 'add'" && exit 1
+
+      - name: Check for artifact reference
+        if: ${{ inputs.operation == 'add' && !env._ARTIFACT }}
+        run: echo "Artifact reference is required for operation 'add'" && exit 1
 
       - name: Log in to Azure
         uses: bitwarden/gh-actions/azure-login@main
@@ -134,6 +143,7 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           TITLE: "Update/Add bwwl approved actions${{ inputs.operation == 'add' && env._ACTION != '' && format(' for {0}', env._ACTION) || '' }}"
+          ARTIFACT: "${{ inputs.operation == 'add' && format('\n    ## Artifact Reference\n    {0}\n', env._ARTIFACT) || '' }}"
         run: |
           PR_URL=$(gh pr create --title "$TITLE" \
             --base "main" \
@@ -148,6 +158,9 @@ jobs:
               - [ ] Build/deploy pipeline (DevOps)
               - [ ] Other
 
+              ## Initiated by
+              ${{ github.actor }}
+              $ARTIFACT
               ## Description
               - This PR updates the approved actions for the Bitwarden Workflow Linter.")
-          echo "pr_number=${PR_URL##*/}" >> $GITHUB_OUTPUT
+          echo "### PR created: $PR_URL" >> $GITHUB_STEP_SUMMARY

bitwarden_workflow_linter-1.3.3/.github/workflows/scan.yml

@@ -0,0 +1,56 @@
+name: Scan
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+      - "rc"
+      - "hotfix-rc"
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches-ignore:
+      - main
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - "main"
+
+permissions: {}
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions:
+      contents: read
+
+  sast:
+    name: Checkmarx
+    uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main
+    needs: check-run
+    secrets:
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    permissions:
+      contents: read
+      pull-requests: write
+      security-events: write
+      id-token: write
+
+  quality:
+    name: Sonar
+    uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main
+    needs: check-run
+    secrets:
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    with:
+      sonar-sources: "src/"
+      sonar-tests: "tests/"

{bitwarden_workflow_linter-1.3.1 → bitwarden_workflow_linter-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bitwarden_workflow_linter
-Version: 1.3.1
+Version: 1.3.3
 Summary: Custom GitHub Action Workflow Linter
 Project-URL: Homepage, https://github.com/bitwarden/workflow-linter
 Project-URL: Issues, https://github.com/bitwarden/workflow-linter/issues

{bitwarden_workflow_linter-1.3.1 → bitwarden_workflow_linter-1.3.3}/src/bitwarden_workflow_linter/__about__.py

@@ -1,3 +1,3 @@
 """Metadata for Workflow Linter."""
 
-__version__ = "1.3.1"
+__version__ = "1.3.3"

{bitwarden_workflow_linter-1.3.1 → bitwarden_workflow_linter-1.3.3}/src/bitwarden_workflow_linter/default_actions.json

@@ -379,6 +379,11 @@
     "sha": "276d7966e389d888f011539a86c8920025ea0626",
     "version": "v3.0.1"
   },
+  "peter-evans/repository-dispatch": {
+    "name": "peter-evans/repository-dispatch",
+    "sha": "ff45666b9427631e3450c54a1bcbee4d9ff4d7c0",
+    "version": "v3.0.0"
+  },
   "reactivecircus/android-emulator-runner": {
     "name": "reactivecircus/android-emulator-runner",
     "sha": "62dbb605bba737720e10b196cb4220d374026a6d",

bitwarden_workflow_linter-1.3.1/.github/workflows/scan.yml

@@ -1,126 +0,0 @@
-name: Scan
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "main"
-      - "rc"
-      - "hotfix-rc"
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches-ignore:
-      - main
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    branches:
-      - "main"
-
-permissions: {}
-
-jobs:
-  check-run:
-    name: Check PR run
-    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-    permissions:
-      contents: read
-
-  sast:
-    name: SAST scan
-    runs-on: ubuntu-22.04
-    needs: check-run
-    permissions:
-      contents: read
-      pull-requests: write
-      security-events: write
-      id-token: write
-
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{  github.event.pull_request.head.sha }}
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "CHECKMARX-TENANT,CHECKMARX-CLIENT-ID,CHECKMARX-SECRET"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Scan with Checkmarx
-        uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc # 2.3.19
-        env:
-          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
-        with:
-          project_name: ${{ github.repository }}
-          cx_tenant: ${{ steps.get-kv-secrets.outputs.CHECKMARX-TENANT }}
-          base_uri: https://ast.checkmarx.net/
-          cx_client_id: ${{ steps.get-kv-secrets.outputs.CHECKMARX-CLIENT-ID }}
-          cx_client_secret: ${{ steps.get-kv-secrets.outputs.CHECKMARX-SECRET }}
-          additional_params: |
-            --report-format sarif \
-            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
-            --output-path . ${{ env.INCREMENTAL }}
-
-      - name: Upload Checkmarx results to GitHub
-        uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
-        with:
-          sarif_file: cx_result.sarif
-          sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }}
-          ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
-
-  quality:
-    name: Quality scan
-    runs-on: ubuntu-22.04
-    needs: check-run
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: ${{  github.event.pull_request.head.sha }}
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "SONAR-TOKEN"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Scan with SonarCloud
-        uses: sonarsource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
-        env:
-          SONAR_TOKEN: ${{ steps.get-kv-secrets.outputs.SONAR-TOKEN }}
-        with:
-          args: >
-            -Dsonar.organization=${{ github.repository_owner }}
-            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
-            -Dsonar.sources=src/
-            -Dsonar.tests=tests/
-            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}