mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 22:02:23 +01:00
Jon Ross-Perkins
97816a3598
This is coming out of advice from https://securityscorecards.dev/viewer/?uri=github.com/carbon-language/carbon-lang Updates action versions and pins by checksum. This is something we already do in other places, and doing it with actions just seems consistent. Trying to add token permissions at the same time. step-security/harden-runner is being set up to monitor network traffic for actions, with the idea that we'd set it to block unexpected traffic in the future. Note, https://app.stepsecurity.io/secureworkflow generates the pinned checksums and adds the harden-runner. In some cases it added token permissions, but we have a couple it doesn't recognize (`gh` executions, other custom commands, jlumbroso/free-disk-space, reviewdog/action-setup as examples) so I'm trying to guess my best. Because these are workflows, testing is limited.
103 lines
3.2 KiB
YAML
103 lines
3.2 KiB
YAML
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
# Exceptions. See /LICENSE for license information.
|
|
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
# Applies mutual exclusivity between states labels:
|
|
# - proposal draft
|
|
# - proposal rfc
|
|
# - proposal accepted
|
|
# - proposal declined
|
|
# - proposal deferred
|
|
#
|
|
# The "proposal" label is always applied in order to make searching for all
|
|
# proposals (regardless of state) easy, although it will typically already be
|
|
# present.
|
|
|
|
name: Proposal labeled
|
|
on:
|
|
pull_request_target:
|
|
types:
|
|
- labeled
|
|
|
|
permissions:
|
|
pull-requests: write # For gh to edit labels.
|
|
|
|
jobs:
|
|
proposal_labeled:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: draft
|
|
if: |
|
|
github.event.label.name == 'proposal draft'
|
|
run: |
|
|
gh pr edit "${PR}" \
|
|
--remove-label "proposal rfc" \
|
|
--remove-label "proposal accepted" \
|
|
--remove-label "proposal declined" \
|
|
--remove-label "proposal deferred" \
|
|
--add-label "proposal"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR: ${{ github.event.pull_request.html_url }}
|
|
|
|
- name: rfc
|
|
if: |
|
|
github.event.label.name == 'proposal rfc'
|
|
run: |
|
|
gh pr edit "${PR}" \
|
|
--remove-label "proposal draft" \
|
|
--remove-label "proposal accepted" \
|
|
--remove-label "proposal declined" \
|
|
--remove-label "proposal deferred" \
|
|
--add-label "proposal"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR: ${{ github.event.pull_request.html_url }}
|
|
|
|
- name: accepted
|
|
if: |
|
|
github.event.label.name == 'proposal accepted'
|
|
run: |
|
|
gh pr edit "${PR}" \
|
|
--remove-label "proposal draft" \
|
|
--remove-label "proposal rfc" \
|
|
--remove-label "proposal declined" \
|
|
--remove-label "proposal deferred" \
|
|
--add-label "proposal"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR: ${{ github.event.pull_request.html_url }}
|
|
|
|
- name: declined
|
|
if: |
|
|
github.event.label.name == 'proposal declined'
|
|
run: |
|
|
gh pr edit "${PR}" \
|
|
--remove-label "proposal draft" \
|
|
--remove-label "proposal rfc" \
|
|
--remove-label "proposal accepted" \
|
|
--remove-label "proposal deferred" \
|
|
--add-label "proposal"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR: ${{ github.event.pull_request.html_url }}
|
|
|
|
- name: deferred
|
|
if: |
|
|
github.event.label.name == 'proposal deferred'
|
|
run: |
|
|
gh pr edit "${PR}" \
|
|
--remove-label "proposal draft" \
|
|
--remove-label "proposal rfc" \
|
|
--remove-label "proposal accepted" \
|
|
--remove-label "proposal declined" \
|
|
--add-label "proposal"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR: ${{ github.event.pull_request.html_url }}
|