Repository navigation
Package rainfrog and netscanner (#28) #73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Enrolment matches the tree | |
| run: scripts/check-enrolment.sh | |
| - name: Test | |
| run: tests/run.sh | |
| - name: shellcheck | |
| run: | | |
| docker run --rm \ | |
| --volume "$PWD:/repo" \ | |
| --workdir /repo \ | |
| koalaman/shellcheck@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d \ | |
| -x scripts/*.sh | |
| - name: actionlint | |
| # Pinned by digest; go-yaml inside it also rejects duplicate mapping | |
| # keys, which GitHub's parser rejects but many local checks accept. | |
| run: | | |
| docker run --rm \ | |
| --volume "$PWD:/repo" \ | |
| --workdir /repo \ | |
| rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \ | |
| -color | |
| keyring-author: | |
| name: The keyring is human-only | |
| # Push only. On a pull request the commits are not on master yet and the | |
| # range is the branch's own, which says nothing about what will land. | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # The whole history, because the check walks a commit range and a | |
| # shallow clone has no range to walk. | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Refuse a bot-authored write to the keyring | |
| env: | |
| BEFORE: ${{ github.event.before }} | |
| SHA: ${{ github.sha }} | |
| # The all-zeros and empty forms of github.event.before are handled | |
| # inside the script, where a test can reach them. | |
| run: scripts/check-keyring-author.sh "$BEFORE" "$SHA" |