ghaudit/.github/workflows/presubmit-testing.yaml at main · chainguard-dev/ghaudit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# Copyright 2024 Chainguard, Inc.
# SPDX-License-Identifier: Apache-2.0

name: e2e presubmit test

on:
  pull_request_target:
    branches: ["main"]

permissions: {}

jobs:
  e2e-presubmit-test:
    runs-on: ubuntu-latest

    # This is running untrusted code in a public repository as pull_request_target.
    # Seek a security review before changing any aspect of this workflow.
    permissions:
      contents: read
      id-token: write

    steps:
    - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
      with:
        go-version-file: './go.mod'
        check-latest: true

    - uses: chainguard-dev/octo-sts-action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
      id: octo-sts
      with:
        scope: ${{ github.repository }}
        identity: presubmit-testing

    - name: Check default permissions
      env:
        GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
        REPO_NAME: ${{ github.event.repository.name }}
      run: |
        go run . repo \
          --organization "${GITHUB_REPOSITORY_OWNER}" \
          --repository "${REPO_NAME}" \
          default-permissions

    - name: Check for deploy keys
      env:
        GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
        REPO_NAME: ${{ github.event.repository.name }}
      run: |
        go run . repo \
          --organization "${GITHUB_REPOSITORY_OWNER}" \
          --repository "${REPO_NAME}" \
          deploy-keys

    - name: Check branch protections
      env:
        GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
        REPO_NAME: ${{ github.event.repository.name }}
      run: |
        go run . repo \
          --organization "${GITHUB_REPOSITORY_OWNER}" \
          --repository "${REPO_NAME}" \
          branch-protections