-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
- Loading branch information
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
name: Update nix-direnv | ||
"on": | ||
schedule: | ||
- cron: 0 0 16 * * | ||
workflow_dispatch: | ||
permissions: | ||
contents: write | ||
Check failure Code scanning / Scorecard Token-Permissions High
score is 0: topLevel 'contents' permission set to 'write'
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow. Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. Click Remediation section below for further remediation help |
||
pull-requests: write | ||
jobs: | ||
update-nix-direnv: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- uses: actions/checkout@v4 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- uses: DeterminateSystems/nix-installer-action@v14 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- uses: DeterminateSystems/magic-nix-cache-action@v8 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- name: Update nix-direnv to the latest version | ||
run: nix run '.#update-nix-direnv' | ||
- name: Create Pull Request | ||
uses: peter-evans/create-pull-request@v7 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
with: | ||
assignees: ${{ github.repository_owner }} | ||
branch: update/nix-direnv | ||
commit-message: "chore(deps): Update nix-direnv" | ||
title: "chore(deps): Update nix-direnv" | ||
token: ${{ secrets.GH_TOKEN_FOR_UPDATES }} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,27 +1,27 @@ | ||
name: yamllint | ||
Check failure Code scanning / Scorecard Token-Permissions High
score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow. Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. Click Remediation section below for further remediation help |
||
"on": | ||
pull_request: | ||
branches: ["main"] | ||
branches: [main] | ||
paths: | ||
- '**.nix' | ||
- '**.yaml' | ||
- '**.yml' | ||
- .github/workflows/yamllint.yaml | ||
- flake.lock | ||
- '**.nix' | ||
- '**.yaml' | ||
- '**.yml' | ||
- .github/workflows/yamllint.yaml | ||
- flake.lock | ||
push: | ||
branches: ["main"] | ||
branches: [main] | ||
paths: | ||
- '**.nix' | ||
- '**.yaml' | ||
- '**.yml' | ||
- .github/workflows/yamllint.yaml | ||
- flake.lock | ||
- '**.nix' | ||
- '**.yaml' | ||
- '**.yml' | ||
- .github/workflows/yamllint.yaml | ||
- flake.lock | ||
jobs: | ||
yamllint: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- uses: actions/checkout@v4 | ||
- uses: DeterminateSystems/nix-installer-action@v14 | ||
- uses: DeterminateSystems/magic-nix-cache-action@v8 | ||
- name: Check YAML files | ||
yamllint: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- uses: actions/checkout@v4 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- uses: DeterminateSystems/nix-installer-action@v14 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- uses: DeterminateSystems/magic-nix-cache-action@v8 | ||
Check warning Code scanning / Scorecard Pinned-Dependencies Medium
score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue |
||
- name: Check YAML files | ||
run: nix develop --command yamllint --format github . |