File tree 6 files changed +49
-95
lines changed
6 files changed +49
-95
lines changed Original file line number Diff line number Diff line change @@ -7,25 +7,8 @@ on: # yamllint disable-line rule:truthy
77 - " v*.*.*"
88
99jobs :
10- create-release :
11- name : Create release
12- runs-on : ubuntu-latest
13- steps :
14- - uses : actions/checkout@v4
15- with :
16- fetch-depth : 0
17- - name : Get changelog
18- id : changelog
19- uses : simbo/changes-since-last-release-action@v1
20- - name : Create release
21- uses : softprops/action-gh-release@v2
22- with :
23- tag_name : ${{ github.ref }}
24- name : ${{ github.ref_name }}
25- token : ${{ secrets.GITHUB_TOKEN }}
26- body : |
27- # Changelog
28-
29- ${{ steps.changelog.outputs.log }}
30- draft : false
31- prerelease : false
10+ github :
11+ name : GitHub
12+ uses : fabasoad/reusable-workflows/.github/workflows/wf-github-release.yml@main
13+ with :
14+ bump-tags : false
Original file line number Diff line number Diff line change @@ -7,45 +7,10 @@ on: # yamllint disable-line rule:truthy
77 branches :
88 - main
99
10- defaults :
11- run :
12- shell : sh
13-
1410jobs :
15- code-scanning :
16- name : Code scanning
17- runs-on : ubuntu-latest
18- steps :
19- - name : Checkout ${{ github.repository }}
20- uses : actions/checkout@v4
21- - name : Initialize CodeQL
22- uses : github/codeql-action/init@v3
23- with :
24- languages : " javascript"
25- - name : Perform CodeQL Analysis
26- id : codeql-analysis
27- uses : github/codeql-action/analyze@v3
28- - name : Upload to GHAS
29- if : always()
30- uses : github/codeql-action/upload-sarif@v3
31- with :
32- category : " code-scanning"
33- sarif_file : " ${{ steps.codeql-analysis.outputs.sarif-output }}"
34- directory-scanning :
35- name : Directory scanning
36- runs-on : ubuntu-latest
37- steps :
38- - name : Checkout ${{ github.repository }}
39- uses : actions/checkout@v4
40- - name : Scan current project
41- id : scan-directory
42- uses : anchore/scan-action@v3
43- with :
44- by-cve : " true"
45- path : " ."
46- - name : Upload to GHAS
47- if : always()
48- uses : github/codeql-action/upload-sarif@v3
49- with :
50- category : " directory-scanning"
51- sarif_file : " ${{ steps.scan-directory.outputs.sarif }}"
11+ sast :
12+ name : SAST
13+ permissions :
14+ contents : read
15+ security-events : write
16+ uses : fabasoad/reusable-workflows/.github/workflows/wf-security-sast.yml@main
Original file line number Diff line number Diff line change 1+ ---
2+ name : Labels
3+
4+ on : # yamllint disable-line rule:truthy
5+ push :
6+ branches :
7+ - main
8+ workflow_dispatch : {}
9+
10+ jobs :
11+ maintenance :
12+ name : Maintenance
13+ uses : fabasoad/reusable-workflows/.github/workflows/wf-sync-labels.yml@main
Original file line number Diff line number Diff line change 11---
2- name : Update license
2+ name : License
33
44on : # yamllint disable-line rule:truthy
55 schedule :
66 - cron : " 0 5 1 1 *"
77
88jobs :
9- run :
10- runs-on : ubuntu-latest
11- steps :
12- - name : Checkout ${{ github.repository }}
13- uses : actions/checkout@v4
14- with :
15- fetch-depth : 0
16- - name : Update LICENSE file
17- uses : FantasticFiasco/action-update-license-year@v3
18- with :
19- token : ${{ secrets.GITHUB_TOKEN }}
20- assignees : ${{ github.repository_owner }}
21- labels : enhancement
22- prTitle : Update license copyright year to {{currentYear}}
23- prBody : |
24- ## Changelog
25-
26- - Update license copyright year to {{currentYear}}
27-
28- ---
29-
30- Powered by [FantasticFiasco/action-update-license-year](https://github.com/FantasticFiasco/action-update-license-year)
9+ maintenance :
10+ name : Maintenance
11+ uses : fabasoad/reusable-workflows/.github/workflows/wf-update-license.yml@main
Original file line number Diff line number Diff line change 99 hooks :
1010 - id : detect-secrets
1111 - repo : https://github.com/gitleaks/gitleaks
12- rev : v8.18.2
12+ rev : v8.18.4
1313 hooks :
1414 - id : gitleaks
15+ - repo : https://github.com/fabasoad/pre-commit-grype
16+ rev : v0.6.0
17+ hooks :
18+ - id : grype-dir
19+ args :
20+ - --grype-args=--by-cve --fail-on=low
21+ - --hook-args=--log-level debug
22+ stages : ["push"]
1523 # Markdown
1624 - repo : https://github.com/igorshubovych/markdownlint-cli
17- rev : v0.40 .0
25+ rev : v0.41 .0
1826 hooks :
1927 - id : markdownlint-fix
2028 stages : ["commit"]
2129 # Shell
22- - repo : https://github.com/shellcheck-py/shellcheck-py
23- rev : v0.10.0 .1
30+ - repo : https://github.com/openstack/bashate
31+ rev : 2.1 .1
2432 hooks :
25- - id : shellcheck
26- stages : ["push"]
33+ - id : bashate
34+ args : ["-i", "E003,E006"]
35+ stages : ["commit"]
2736 # Yaml
2837 - repo : https://github.com/adrienverge/yamllint
2938 rev : v1.35.1
@@ -32,10 +41,11 @@ repos:
3241 stages : ["push"]
3342 # GitHub Actions
3443 - repo : https://github.com/rhysd/actionlint
35- rev : v1.7.0
44+ rev : v1.7.1
3645 hooks :
3746 - id : actionlint
38- stages : ["push"]
47+ args : ["-pyflakes="]
48+ stages : ["commit"]
3949 # Other
4050 - repo : https://github.com/pre-commit/mirrors-prettier
4151 rev : v3.1.0
4656 rev : v4.6.0
4757 hooks :
4858 - id : check-executables-have-shebangs
59+ stages : ["commit"]
4960 - id : check-shebang-scripts-are-executable
61+ stages : ["commit"]
5062 - id : check-merge-conflict
5163 - id : check-json
5264 stages : ["push"]
Original file line number Diff line number Diff line change 5454 rev: <rev>
5555 hooks:
5656 - id: snyk-iac
57- args:["<folder >","--severity-threshold=<severity-level>"]
57+ args: ["<dir >", "--severity-threshold=<severity-level>"]
5858` ` `
5959
6060Where :
You can’t perform that action at this time.
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments