Add ubuntu-22 as trusted runner (#291)

* update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> * update Signed-off-by: laurentsimon <laurentsimon@google.com> Signed-off-by: laurentsimon <laurentsimon@google.com>
ossf · Dec 16, 2022 · 6dde882 · 6dde882
1 parent 1724732
commit 6dde882
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/app/server/verify_workflow.go b/app/server/verify_workflow.go
@@ -37,6 +37,15 @@ var (
 	errEmptyStepUses                = errors.New("scorecard job must only have steps with `uses`")
 )
 
+// TODO(#290): retrieve the runners dynamically.
+// List below is from https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners.
+var ubuntuRunners = map[string]bool{
+	"ubuntu-latest": true,
+	"ubuntu-22.04":  true,
+	"ubuntu-20.04":  true,
+	"ubuntu-18.04":  true,
+}
+
 func verifyScorecardWorkflow(workflowContent string) error {
 	// Verify workflow contents using actionlint.
 	workflow, lintErrs := actionlint.Parse([]byte(workflowContent))
@@ -90,8 +99,8 @@ func verifyScorecardWorkflow(workflowContent string) error {
 	if len(labels) != 1 {
 		return fmt.Errorf("%w", errScorecardJobRunsOn)
 	}
-	jobEnv := labels[0].Value
-	if jobEnv != "ubuntu-latest" && jobEnv != "ubuntu-20.04" && jobEnv != "ubuntu-18.04" {
+	label := labels[0].Value
+	if _, ok := ubuntuRunners[label]; !ok {
 		return fmt.Errorf("%w", errScorecardJobRunsOn)
 	}