mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-06-16 09:45:24 -04:00
nopoz
ed6cc88974
Pin actions to commit SHAs, set persist-credentials: false on every checkout, and scope token permissions to the jobs that use them. Suppress the two findings that are safe by design: the description bot's pull_request_target trigger (no fork code runs) and an intentional word-split in the docker manifest step. Clears actionlint and zizmor against dev so the blocking gate from #1314 can pass once both land.
25 lines
695 B
YAML
25 lines
695 B
YAML
name: ci / issue description check
|
|
|
|
on:
|
|
issues:
|
|
types: [opened, edited, reopened]
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
jobs:
|
|
check:
|
|
name: Check issue description
|
|
runs-on: ubuntu-latest
|
|
# Skip bots (Dependabot, release-drafter, etc.)
|
|
if: ${{ github.event.issue.user.type != 'Bot' }}
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
sparse-checkout: .github/scripts
|
|
persist-credentials: false
|
|
|
|
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: return require('./.github/scripts/check-issue-description.js')({github, context, core})
|