mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-09-13 11:34:54 +00:00
Shubham Pampattiwar
3191e38ac3
Add an explicit top-level permissions block to the GitHub Actions workflows that were relying on the default token permissions. Each workflow now defaults to contents: read, with additional scopes granted only where a job needs them: * nightly-trivy-scan keeps security-events: write at the job level to upload SARIF results, plus contents: read for checkout. * stale-issues gets issues: write and pull-requests: write for the actions/stale action to label and close stale items. Setting least-privilege permissions reduces the blast radius if a workflow or one of its dependencies is compromised, and satisfies the CLOMonitor token_permissions check. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
name: Pull Request Codespell Check
|
|
on: [pull_request]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
|
|
codespell:
|
|
if: github.repository == 'velero-io/velero'
|
|
name: Run Codespell
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
|
|
- name: Check out the code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Codespell
|
|
uses: codespell-project/actions-codespell@master
|
|
with:
|
|
skip: .git,*.png,*.jpg,*.woff,*.ttf,*.gif,*.ico,./go.sum,./LICENSE
|
|
ignore_words_list: iam,aks,ist,bridget,ue,shouldnot,atleast,notin,sme,optin,sie
|
|
check_filenames: true
|
|
check_hidden: true
|
|
|
|
- name: Velero.io word list check
|
|
shell: bash {0}
|
|
run: |
|
|
IGNORE_COMMENT="Velero.io word list : ignore"
|
|
FILES_TO_CHECK=$(find . -type f \
|
|
! -path "./.git/*" \
|
|
! -path "./site/content/docs/v*" \
|
|
! -path "./changelogs/CHANGELOG-*" \
|
|
! -path "./.github/workflows/pr-codespell.yml" \
|
|
! -path "./site/static/fonts/Metropolis/Open Font License.md" \
|
|
! -regex '.*\.\(png\|jpg\|woff\|ttf\|gif\|ico\|svg\)'
|
|
)
|
|
function check_word_in_files() {
|
|
local word=$1
|
|
|
|
xargs grep -Iinr "$word" <<< "$FILES_TO_CHECK" | \
|
|
grep -v "$IGNORE_COMMENT" | \
|
|
grep -i --color=always "$word" && \
|
|
EXIT_STATUS=1
|
|
}
|
|
function check_word_case_sensitive_in_files() {
|
|
local word=$1
|
|
|
|
xargs grep -Inr "$word" <<< "$FILES_TO_CHECK" | \
|
|
grep -v "$IGNORE_COMMENT" | \
|
|
grep --color=always "$word" && \
|
|
EXIT_STATUS=1
|
|
}
|
|
EXIT_STATUS=0
|
|
check_word_case_sensitive_in_files ' kubernetes '
|
|
check_word_in_files 'on-premise\b'
|
|
check_word_in_files 'back-up'
|
|
check_word_in_files 'plug-in'
|
|
check_word_in_files 'whitelist'
|
|
check_word_in_files 'blacklist'
|
|
exit $EXIT_STATUS
|