mirror of
https://github.com/bherbruck/solidcraft.git
synced 2026-11-08 13:01:52 +00:00
bherbruck
bca8e81f1b
release.yml holds CARGO_REGISTRY_TOKEN: drop Swatinem/rust-cache (a compromised tag or poisoned cache could tamper with the build before publish), pin actions/checkout to the v4.2.2 commit SHA, and do not persist git credentials. progress.yml (contents: write) also pins checkout. Flagged by an automated security review. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
name: Progress checklist
|
|
|
|
# Regenerates plan/PROGRESS.md from plan/modules.toml and open "port: <unit id>" PRs,
|
|
# and commits it to main when it changed. PRs never edit PROGRESS.md themselves.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths: [plan/modules.toml, harness/plan/progress.py]
|
|
pull_request_target:
|
|
types: [opened, reopened, closed, edited, ready_for_review, converted_to_draft]
|
|
schedule:
|
|
- cron: "17 * * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: progress
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
progress:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Always main: never check out or run PR code with a write token.
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (pinned: this job has contents: write)
|
|
with:
|
|
ref: main
|
|
- name: Regenerate
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: python3 harness/plan/progress.py --prs
|
|
- name: Commit if changed
|
|
run: |
|
|
if git diff --quiet -- plan/PROGRESS.md; then echo "unchanged"; exit 0; fi
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git add plan/PROGRESS.md
|
|
git commit -m "plan/PROGRESS.md: regenerate [skip ci]"
|
|
git pull --rebase origin main
|
|
git push origin HEAD:main
|