actions-permissions/.github/workflows/test.yml at main · GitHubSecurityLab/actions-permissions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
on:
  workflow_dispatch:
    inputs:
      enable_debug:
        description: "Enable logging"
        required: false
        type: boolean
        default: false

permissions:
  contents: read
  issues: read
  pull-requests: read

jobs:
  job1:
    strategy:
      fail-fast: false
      matrix:
        os:
        # source:
        # https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories
        # https://github.com/actions/runner-images?tab=readme-ov-file#available-images
        - ubuntu-slim
        - ubuntu-24.04-arm
        - ubuntu-22.04-arm
        - ubuntu-latest # eventually will pick up the next version and test it
        - ubuntu-24.04 # ubuntu-latest
        - ubuntu-22.04
        - macos-latest-large
        - macos-latest # eventually will pick up the next version and test it
        - macos-26-xlarge
        - macos-26 # public preview
        - macos-15-large
        - macos-15 # macos-latest
        - macos-15-intel
        - macos-14-xlarge
        - macos-14-large
        - macos-14
        #- windows-latest # eventually will pick up the next version and test it
        #- windows-11-arm
        #- windows-2025
        #- windows-2022 # windows-latest
        #- windows-2019

    runs-on: ${{ matrix.os }}
    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@main
        with:
          debug: ${{ github.event.inputs.enable_debug }}

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      # test github-script CA
      - name: github-script
        uses: actions/github-script@v7
        with:
          script: |
            const { data } = await github.rest.issues.listLabelsOnIssue({
              issue_number: 2,
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

      # test gh CA
      - name: gh api
        env:
            GH_TOKEN: ${{ github.token }}
        run: |
          gh api \
            -H "Accept: application/vnd.github+json" \
            /repos/${{ github.event.repository.owner.login }}/${{ github.event.repository.name }}/issues/1/labels

      # test curl CA
      - name: curl
        run: |
          curl \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ github.token }}"\
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://Api.github.com/repos/${{ github.event.repository.owner.login }}/${{ github.event.repository.name }}/labels