mirror of
https://github.com/lightpanda-io/browser.git
synced 2026-07-31 01:36:15 -04:00
1d553ff5ee
Runs on pushes to main and on pull requests. The config starts from the generated defaults and is scoped to this repo: the few controls that are off carry a note explaining why and what would let them come back on. Reports are uploaded to code scanning, except on PRs from forks where the token cannot write security events. Each run on main also publishes the score through OIDC, which feeds the live badge added to the README next to the existing ones.
33 lines
998 B
YAML
33 lines
998 B
YAML
name: plumber
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
plumber:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
# Lets the run publish the score for the README badge via OIDC,
|
|
# no secret involved.
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: getplumber/plumber@7970e5df1e7d217de41b2880832b63a6f2152b97 # v0.4.8
|
|
with:
|
|
# Code scanning upload needs security-events write, which PRs
|
|
# from forks do not get. The report stays available as a
|
|
# workflow artifact there.
|
|
upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
|
|
# Feeds the score badge in the README. The badge service only
|
|
# keeps the default branch score (verified from the OIDC
|
|
# token), and a failed push never fails the run.
|
|
score-push: true
|