Add Security Analysis section with OpenTaint #71
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MIT | |
| name: Update README | |
| on: | |
| pull_request: | |
| paths: | |
| - "README_SOURCE.md" | |
| - "README.md" | |
| - "CONTRIBUTING.md" | |
| - ".github/pull_request_template.md" | |
| - ".github/workflows/update-readme.yml" | |
| - "mise.toml" | |
| - ".github/scripts/**" | |
| push: | |
| branches: | |
| - main | |
| - test | |
| paths: | |
| - "README_SOURCE.md" | |
| - ".github/workflows/update-readme.yml" | |
| - "mise.toml" | |
| - ".github/scripts/**" | |
| schedule: | |
| - cron: "0 0 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: update-readme-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Reject direct README changes | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| if ! git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- README.md; then | |
| echo "::error file=README.md::README.md is generated. Edit README_SOURCE.md instead." | |
| exit 1 | |
| fi | |
| - uses: jdx/mise-action@v3 | |
| - name: Validate source and generator | |
| run: | | |
| java .github/scripts/GenerateReadme.java self-test | |
| java .github/scripts/GenerateReadme.java check README_SOURCE.md | |
| - name: Validate added GitHub repositories | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| base_source="$RUNNER_TEMP/README_SOURCE.base.md" | |
| if git cat-file -e "${BASE_SHA}:README_SOURCE.md"; then | |
| git show "${BASE_SHA}:README_SOURCE.md" > "$base_source" | |
| java .github/scripts/GenerateReadme.java check-added "$base_source" README_SOURCE.md | |
| else | |
| echo "::notice::Base branch has no README_SOURCE.md; skipping added repository validation." | |
| fi | |
| update: | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: jdx/mise-action@v3 | |
| - name: Restore statistics cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: .cache/github-stats.tsv | |
| key: readme-stats-v3-${{ github.ref_name }}-${{ github.run_id }} | |
| restore-keys: | | |
| readme-stats-v3-${{ github.ref_name }}- | |
| - name: Validate source and generator | |
| run: | | |
| java .github/scripts/GenerateReadme.java self-test | |
| java .github/scripts/GenerateReadme.java check README_SOURCE.md | |
| - name: Generate README | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| args=() | |
| if [ "${{ github.event_name }}" = "schedule" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| args+=(--refresh-all) | |
| fi | |
| java .github/scripts/GenerateReadme.java generate README_SOURCE.md README.md .cache/github-stats.tsv "${args[@]}" --branch "$GITHUB_REF_NAME" | |
| - name: Commit README | |
| run: | | |
| git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git config --local user.name "github-actions[bot]" | |
| git add README.md | |
| if git diff --staged --quiet; then | |
| echo "README is already current" | |
| else | |
| git commit -m "Update README with latest GitHub stats" | |
| git push | |
| fi |