Repository navigation
chore(runner): automated runner-base image tag bump #162
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # Backstop for the local pre-push hook (scripts/git-hooks/pre-push): re-runs the | |
| # same trust-tier guard on the PUBLIC mirror so a skipped/uninstalled local hook | |
| # can't leak secrets, internal identifiers in commit messages, or external | |
| # identifiers in content. Logic is shared via scripts/trust-tier/scan.sh. | |
| # | |
| # github-hosted on purpose (NOT the self-hosted cluster runner) — a pure text | |
| # scan with no cluster dependency, so it still runs when the cluster is down. | |
| name: "Trust-Tier Guard" | |
| on: | |
| push: | |
| branches: ["main"] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| name: Trust-Tier Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history for range scan) | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install gitleaks (checksum-verified) | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" # keep in sync with .mise.toml / .pre-commit-config.yaml | |
| run: | | |
| set -euo pipefail | |
| base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | |
| tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| tmp="$(mktemp -d)" | |
| curl -sSfL "${base}/${tarball}" -o "${tmp}/${tarball}" | |
| curl -sSfL "${base}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" -o "${tmp}/checksums.txt" | |
| # Verify the downloaded tarball against the release's published checksum | |
| # before trusting/extracting it (supply-chain posture per CLAUDE.md). | |
| ( cd "${tmp}" && grep " ${tarball}\$" checksums.txt | sha256sum -c - ) | |
| tar -xz -C /usr/local/bin -f "${tmp}/${tarball}" gitleaks | |
| gitleaks version | |
| - name: Run trust-tier guard over the pushed range | |
| env: | |
| BEFORE: ${{ github.event.before }} | |
| AFTER: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| zero='0000000000000000000000000000000000000000' | |
| # 'before' being absent/zero was already handled. It can also be | |
| # PRESENT but UNREACHABLE — e.g. a force-push after a rebase, or a | |
| # commit that has been GC'd. That used to build an invalid range which | |
| # no-op'd every check while still reporting clean (bead agents-rtm0). | |
| # scan.sh now fails closed on it, but degrade deliberately here so a | |
| # legitimate force-push gets a WIDER scan rather than a hard error. | |
| if [ -z "${BEFORE:-}" ] || [ "${BEFORE}" = "${zero}" ]; then | |
| echo "No usable 'before' SHA (new branch / first push) — scanning whole tree." | |
| bash scripts/trust-tier/scan.sh | |
| elif ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then | |
| echo "'before' SHA ${BEFORE} is unreachable (force-push or GC'd) — scanning whole tree." | |
| bash scripts/trust-tier/scan.sh | |
| else | |
| echo "Scanning range ${BEFORE}..${AFTER}" | |
| bash scripts/trust-tier/scan.sh "${BEFORE}..${AFTER}" | |
| fi |