tkmind/tkmind_go
1
0
Fork 0
Code Issues Pull Requests Actions 7 Packages Projects Releases Wiki Activity

patching recipe scanning workflows for permissions changes (#4579)

Browse Source
This commit is contained in:
w. ian douglas
2025-09-09 13:04:34 -06:00
committed by GitHub
parent 2080425d9a
commit e575124cc4
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/recipe-security-scanner.yml
+7
View File
@@ -13,6 +13,7 @@ concurrency:
permissions: permissions:
contents: read contents: read
pull-requests: write pull-requests: write
issues: write
statuses: write statuses: write
jobs: jobs:
@@ -140,6 +141,12 @@ jobs:
# Set permissions for Docker container (scanner user is UID 1000) # Set permissions for Docker container (scanner user is UID 1000)
sudo chmod -R 777 "$OUT" || true sudo chmod -R 777 "$OUT" || true
# Verify secrets are available (without logging details)
if [ -z "$OPENAI_API_KEY" ] || [ -z "$TRAINING_DATA_LOW" ] || [ -z "$TRAINING_DATA_MEDIUM" ] || [ -z "$TRAINING_DATA_EXTREME" ]; then
echo "❌ One or more required secrets are missing or inaccessible"
exit 1
fi
# Initialize overall scan results # Initialize overall scan results
echo '{"scanned_recipes": [], "overall_status": "UNKNOWN", "failed_scans": 0}' > "$OUT/pr_scan_summary.json" echo '{"scanned_recipes": [], "overall_status": "UNKNOWN", "failed_scans": 0}' > "$OUT/pr_scan_summary.json"
.github/workflows/validate-recipe-pr.yml
+2 -1
View File
@@ -9,6 +9,7 @@ on:
permissions: permissions:
contents: read contents: read
pull-requests: write pull-requests: write
issues: write
jobs: jobs:
validate-recipe: validate-recipe:
@@ -158,7 +159,7 @@ jobs:
# Check if this is a new file or an update to existing file # Check if this is a new file or an update to existing file
# Get list of changed files in this PR compared to base branch # Get list of changed files in this PR compared to base branch
CHANGED_FILES=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD | grep "^$RECIPE_FILE$" || true) CHANGED_FILES=$(git diff --name-only --diff-filter=AM origin/${{ github.event.pull_request.base.ref }}...HEAD | grep "^$RECIPE_FILE$" || true)
EXISTING_FILES=$(find documentation/src/pages/recipes/data/recipes/ -name "$FILENAME.yaml" -o -name "$FILENAME.yml" | grep -v "^$RECIPE_FILE$" || true) EXISTING_FILES=$(find documentation/src/pages/recipes/data/recipes/ -name "$FILENAME.yaml" -o -name "$FILENAME.yml" | grep -v "^$RECIPE_FILE$" || true)
if [ -n "$EXISTING_FILES" ] && [ -z "$CHANGED_FILES" ]; then if [ -n "$EXISTING_FILES" ] && [ -z "$CHANGED_FILES" ]; then