-
Notifications
You must be signed in to change notification settings - Fork 85
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'testing' into add-ownership-remediation-to-mode-4
- Loading branch information
Showing
5 changed files
with
269 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,181 @@ | ||
| # MegaLinter GitHub Action configuration file | ||
| # More info at https://megalinter.io | ||
| --- | ||
| name: MegaLinter | ||
|
|
||
| # Trigger mega-linter at every push. Action will also be visible from Pull Requests to main | ||
| on: | ||
| # Comment this line to trigger action only on pull-requests | ||
| # (not recommended if you don't pay for GH Actions) | ||
| push: | ||
|
|
||
| pull_request: | ||
| branches: | ||
| - main | ||
| - testing | ||
| - dev | ||
| - experimental | ||
|
|
||
| # Comment env block if you do not want to apply fixes | ||
| env: | ||
| # Apply linter fixes configuration | ||
| # | ||
| # When active, APPLY_FIXES must also be defined as environment variable | ||
| # (in github/workflows/mega-linter.yml or other CI tool) | ||
| APPLY_FIXES: all | ||
|
|
||
| # Decide which event triggers application of fixes in a commit or a PR | ||
| # (pull_request, push, all) | ||
| APPLY_FIXES_EVENT: pull_request | ||
|
|
||
| # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) | ||
| # or posted in a PR (pull_request) | ||
| APPLY_FIXES_MODE: commit | ||
|
|
||
| concurrency: | ||
| group: ${{ github.ref }}-${{ github.workflow }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| megalinter: | ||
| name: MegaLinter | ||
| runs-on: ubuntu-latest | ||
|
|
||
| # Give the default GITHUB_TOKEN write permission to commit and push, comment | ||
| # issues & post new PR; remove the ones you do not need | ||
| permissions: | ||
| contents: write | ||
| issues: write | ||
| pull-requests: write | ||
|
|
||
| steps: | ||
|
|
||
| # Git Checkout | ||
| - name: Checkout Code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} | ||
|
|
||
| # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to | ||
| # improve performance | ||
| fetch-depth: 0 | ||
|
|
||
| # MegaLinter | ||
| - name: MegaLinter | ||
|
|
||
| # You can override MegaLinter flavor used to have faster performances | ||
| # More info at https://megalinter.io/flavors/ | ||
| # The dotnet flavor includes PowerShell, MD, YAML, JSON, spelling, and more. | ||
| uses: oxsecurity/megalinter/flavors/dotnet@v7.7.0 | ||
|
|
||
| id: ml | ||
|
|
||
| # All available variables are described in documentation | ||
| # https://megalinter.io/configuration/ | ||
| env: | ||
|
|
||
| # Validates all source when push on main, else just the git diff with | ||
| # main. Override with true if you always want to lint all sources | ||
| # | ||
| # To validate the entire codebase, set to: | ||
| # VALIDATE_ALL_CODEBASE: true | ||
| # | ||
| # To validate only diff with main, set to: | ||
| # VALIDATE_ALL_CODEBASE: >- | ||
| # ${{ | ||
| # github.event_name == 'push' && | ||
| # contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref) | ||
| # }} | ||
| VALIDATE_ALL_CODEBASE: >- | ||
| ${{ | ||
| github.event_name == 'push' && | ||
| contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref) | ||
| }} | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE | ||
| # .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY | ||
|
|
||
| # Uncomment to disable copy-paste and spell checks | ||
| # DISABLE: COPYPASTE,SPELL | ||
| DISABLE_ERRORS: true | ||
| DISABLE_LINTERS: SPELL_LYCHEE | ||
| # Uncomment DISABLE_ERRORS_LINTERS if you want to turn errors back on selectively. | ||
| # DISABLE_ERRORS_LINTERS: REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_CHECKOV,POWERSHELL_POWERSHELL,SPELL_CSPELL | ||
|
|
||
| # Upload MegaLinter artifacts | ||
| - name: Archive production artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| if: success() || failure() | ||
| with: | ||
| name: MegaLinter reports | ||
| path: | | ||
| megalinter-reports | ||
| mega-linter.log | ||
| # Set APPLY_FIXES_IF var for use in future steps | ||
| - name: Set APPLY_FIXES_IF var | ||
| run: | | ||
| printf 'APPLY_FIXES_IF=%s\n' "${{ | ||
| steps.ml.outputs.has_updated_sources == 1 && | ||
| ( | ||
| env.APPLY_FIXES_EVENT == 'all' || | ||
| env.APPLY_FIXES_EVENT == github.event_name | ||
| ) && | ||
| ( | ||
| github.event_name == 'push' || | ||
| github.event.pull_request.head.repo.full_name == github.repository | ||
| ) | ||
| }}" >> "${GITHUB_ENV}" | ||
| # Set APPLY_FIXES_IF_* vars for use in future steps | ||
| - name: Set APPLY_FIXES_IF_* vars | ||
| run: | | ||
| printf 'APPLY_FIXES_IF_PR=%s\n' "${{ | ||
| env.APPLY_FIXES_IF == 'true' && | ||
| env.APPLY_FIXES_MODE == 'pull_request' | ||
| }}" >> "${GITHUB_ENV}" | ||
| printf 'APPLY_FIXES_IF_COMMIT=%s\n' "${{ | ||
| env.APPLY_FIXES_IF == 'true' && | ||
| env.APPLY_FIXES_MODE == 'commit' && | ||
| (!contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)) | ||
| }}" >> "${GITHUB_ENV}" | ||
| # Create pull request if applicable | ||
| # (for now works only on PR from same repository, not from forks) | ||
| - name: Create Pull Request with applied fixes | ||
| uses: peter-evans/create-pull-request@v5 | ||
| id: cpr | ||
| if: env.APPLY_FIXES_IF_PR == 'true' | ||
| with: | ||
| token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} | ||
| commit-message: "[MegaLinter] Apply linters automatic fixes" | ||
| title: "[MegaLinter] Apply linters automatic fixes" | ||
| labels: bot | ||
|
|
||
| - name: Create PR output | ||
| if: env.APPLY_FIXES_IF_PR == 'true' | ||
| run: | | ||
| echo "PR Number - ${{ steps.cpr.outputs.pull-request-number }}" | ||
| echo "PR URL - ${{ steps.cpr.outputs.pull-request-url }}" | ||
| # Push new commit if applicable | ||
| # (for now works only on PR from same repository, not from forks) | ||
| - name: Prepare commit | ||
| if: env.APPLY_FIXES_IF_COMMIT == 'true' | ||
| run: sudo chown -Rc $UID .git/ | ||
|
|
||
| - name: Commit and push applied linter fixes | ||
| uses: stefanzweifel/git-auto-commit-action@v5 | ||
| if: env.APPLY_FIXES_IF_COMMIT == 'true' | ||
| with: | ||
| branch: >- | ||
| ${{ | ||
| github.event.pull_request.head.ref || | ||
| github.head_ref || | ||
| github.ref | ||
| }} | ||
| commit_message: "[MegaLinter] Apply linters fixes" | ||
| commit_user_name: megalinter-bot | ||
| commit_user_email: megalinter@dotdot.horse |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
| # | ||
| # https://github.com/microsoft/action-psscriptanalyzer | ||
| # For more information on PSScriptAnalyzer in general, see | ||
| # https://github.com/PowerShell/PSScriptAnalyzer | ||
|
|
||
| name: PSScriptAnalyzer | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "testing" ] | ||
| pull_request: | ||
| branches: [ "testing" ] | ||
| schedule: | ||
| - cron: '41 14 * * 4' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| build: | ||
| permissions: | ||
| contents: read # for actions/checkout to fetch code | ||
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| name: PSScriptAnalyzer | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
||
| - name: Run PSScriptAnalyzer | ||
| uses: microsoft/psscriptanalyzer-action@6b2948b1944407914a58661c49941824d149734f | ||
| with: | ||
| # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options. | ||
| # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules. | ||
| path: .\ | ||
| recurse: true | ||
| # Include your own basic security rules. Removing this option will run all the rules | ||
| includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' | ||
| output: results.sarif | ||
|
|
||
| # Upload the SARIF file generated in the previous step | ||
| - name: Upload SARIF results file | ||
| uses: github/codeql-action/upload-sarif@v2 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters