feat(RAN-54): land OpenSSF Best Practices passing + Scorecard hardening #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: test | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Opt in to Node 24 runtime for actions/* (Node 20 is deprecated; | |
| # forced default in June 2026, removed in September 2026). | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| # Top-level read-only token per OpenSSF Scorecard `Token-Permissions`; | |
| # jobs scope up only when needed. | |
| permissions: read-all | |
| jobs: | |
| headless: | |
| name: Pure-logic tests (pwsh 7.5+) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 | |
| - name: Install PowerShell 7.5+ (SnipIT.ps1 requires it) | |
| shell: bash | |
| run: | | |
| dotnet tool install --global PowerShell | |
| echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH" | |
| - name: Show pwsh version | |
| shell: bash | |
| run: pwsh --version | |
| - name: Run headless tests | |
| shell: bash | |
| run: pwsh -NoProfile -File ./Test-SnipIT.ps1 | |
| # PSScriptAnalyzer moved to .github/workflows/security.yml per RAN-54 — it is | |
| # the language-specific lint slot in the OSS-CLI security stack (codeiq's | |
| # SpotBugs equivalent), not a build-time gate. | |
| parse: | |
| name: Parse SnipIT.ps1 on Windows (no execution) | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 | |
| - name: Install PowerShell 7.5+ (SnipIT.ps1 requires it) | |
| shell: pwsh | |
| run: | | |
| dotnet tool install --global PowerShell | |
| "$HOME\.dotnet\tools" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 | |
| - name: Show pwsh version | |
| shell: bash | |
| run: pwsh --version | |
| - name: Parse script (AST parser works with any pwsh version) | |
| shell: bash | |
| run: | | |
| pwsh -NoProfile -Command " | |
| \$errors = \$null | |
| [System.Management.Automation.Language.Parser]::ParseFile( | |
| (Resolve-Path ./SnipIT.ps1), [ref]\$null, [ref]\$errors) | Out-Null | |
| if (\$errors) { | |
| \$errors | ForEach-Object { Write-Host \" \$(\$_.Message) at line \$(\$_.Extent.StartLineNumber)\" } | |
| exit 1 | |
| } | |
| Write-Host 'Parsed cleanly.' | |
| " | |
| - name: Run headless tests on Windows | |
| shell: bash | |
| run: pwsh -NoProfile -File ./Test-SnipIT.ps1 |