mirror of
https://github.com/anchore/syft.git
synced 2026-05-20 12:15:27 +02:00
66ba575ae2
Bumps the actions-minor-patch group with 2 updates in the / directory: [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) and [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `marocchino/sticky-pull-request-comment` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](70d2764d1a...d4d6b09364) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](bbbca2ddaa...043fb46d1a) --- updated-dependencies: - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
65 lines
2.5 KiB
YAML
65 lines
2.5 KiB
YAML
# Note: this workflow has been disabled manually in the UI and will be replaced in short order
|
|
|
|
name: "Detect schema changes"
|
|
|
|
on:
|
|
# IMPORTANT! This workflow is triggered by the `pull_request_target` event
|
|
# which means that forked PRs will run with access secrets from the repo
|
|
# it's forked from (the "target" repo).
|
|
#
|
|
# For this reason we only NEVER checkout the code from the pull request
|
|
# (e.g. "ref: ${{ github.event.pull_request.head.sha }}") to prevent
|
|
# accidentally running potentially untrusted code.
|
|
#
|
|
# By default the checkout will be:
|
|
# - GITHUB_SHA: Last commit on the PR base branch
|
|
# - GITHUB_REF: PR base branch
|
|
#
|
|
# ...unlike a typical PR where:
|
|
# - GITHUB_SHA: Last merge commit on the GITHUB_REF branch
|
|
# - GITHUB_REF: PR merge branch refs/pull/:prNumber/merge
|
|
pull_request_target:
|
|
|
|
env:
|
|
# note: this is used within hashFiles() so must be within the GITHUB_WORKSPACE path (or will silently fail)
|
|
CI_COMMENT_FILE: .tmp/labeler-comment.txt
|
|
# needs to be any string to uniquely identify the comment on a PR across multiple runs
|
|
COMMENT_HEADER: "label-commentary"
|
|
|
|
jobs:
|
|
label:
|
|
name: "Label changes"
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
steps:
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
repository: anchore/syft # IMPORTANT! An additional protection that this is checking out code from the expected repository
|
|
ref: main # IMPORTANT! It is CRITICAL that this only ever considers the code from main and NEVER EVER from a fork.
|
|
|
|
- run: python .github/scripts/labeler.py
|
|
env:
|
|
# note: this token has write access to the repo
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GITHUB_PR_NUMBER: ${{ github.event.number }}
|
|
|
|
- name: Delete existing comment
|
|
if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
|
|
uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff #v3.0.3
|
|
with:
|
|
header: ${{ env.COMMENT_HEADER }}
|
|
hide: true
|
|
hide_classify: "OUTDATED"
|
|
|
|
- name: Add comment
|
|
if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
|
|
uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff #v3.0.3
|
|
with:
|
|
header: ${{ env.COMMENT_HEADER }}
|
|
path: ${{ env.CI_COMMENT_FILE }}
|