Deploy centralized organization stale bot#48
Deploy centralized organization stale bot#48ChrisGe4 wants to merge 10 commits intogoogle-github-actions:mainfrom
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,101 @@ | |||
| name: 'Centralized Organization Stale Bot' | |||
There was a problem hiding this comment.
@ChrisGe4 can you add a default permissions block here, i dont think youre using the github token so permissions: {} should worki think?
.github/workflows/scorecard.yml
Outdated
|
|
||
| permissions: | ||
| contents: read | ||
| security-events: write |
.github/workflows/actionlint.yml
Outdated
| lint: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
.github/workflows/actionlint.yml
Outdated
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: 'Run actionlint with reviewdog' | ||
| uses: reviewdog/action-actionlint@v1.7.2 |
| } | ||
|
|
||
| - name: 'Run official stale bot' | ||
| uses: actions/stale@v9 |
.github/workflows/scorecard.yml
Outdated
| analyze: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
.github/workflows/scorecard.yml
Outdated
| with: | ||
| persist-credentials: false | ||
| - name: 'Run Scorecard' | ||
| uses: ossf/scorecard-action@v2.4.3 |
.github/workflows/scorecard.yml
Outdated
| results_format: 'sarif' | ||
| publish_results: false | ||
| - name: 'Upload to GitHub Security Tab' | ||
| uses: github/codeql-action/upload-sarif@v4.35.1 |
There was a problem hiding this comment.
Can you run https://github.com/sethvargo/ratchet over these files? It will pin the actions to a SHA for security based on the current version
There was a problem hiding this comment.
Also as discussed offline, can you ensure all yaml values are quoted, see https://github.com/abcxyz/guardian/blob/main/.github/workflows/build.yml for an example
3 participants
Deploy a centralized multi-repository stale bot utilizing GitHub's official
actions/stalewithin a dynamic matrix workflow.To prevent individual repositories from bypassing security standards, enforce
Actionlint and Scorecard centrally using a GitHub Organization Ruleset.