diff --git a/.github/workflows/claws.yaml b/.github/workflows/claws.yaml new file mode 100644 index 0000000..1abf010 --- /dev/null +++ b/.github/workflows/claws.yaml @@ -0,0 +1,53 @@ +name: Workflow Static Analyzer + +on: + workflow_dispatch: + pull_request: + branches: + - main + +jobs: + build: + name: Analyze Github Workflows + runs-on: ubuntu-latest + steps: + - name: Set Up Ruby + uses: ruby/setup-ruby@d8d83c3960843afb664e821fed6be52f37da5267 # v1.231.0 + with: + ruby-version: "3.0" + - name: Set Up Claws Config + run: | + echo ... > /tmp/claws-config.yml + - name: Set Up Shellcheck + run: | + sudo apt-get update + sudo apt-get install -y shellcheck + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + with: + fetch-depth: 0 + - name: Set Up Claws + run: | + gem install claws-scan -v 0.7.5 + - name: Analyze Workflows + run: | + #!/bin/bash + + # Collect all files in the .github/workflows directory + workflow_files=$(find .github/workflows -type f) + + # Exit early if there are no workflow files + if [[ -z "$workflow_files" ]]; then + echo "No workflow files found in .github/workflows" + exit 0 + fi + + flags=() + + # Iterate over each workflow file + while IFS= read -r file; do + echo "Processing $file" + flags+=("-t" "$file") + done <<< "$workflow_files" + + # Run the analyze command with all gathered flags + analyze -f github -c /tmp/claws-config.yml "${flags[@]}"