chore(deps): update actions/checkout action to v7.0.1 #632
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate GitHub workflows | |
| on: | |
| pull_request: | |
| paths: | |
| - '.github/workflows/*.yaml' | |
| workflow_dispatch: {} | |
| permissions: {} | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Validate YAML | |
| run: | | |
| set +e | |
| # Run yamllint and capture output | |
| docker run --rm -v "$PWD:/data" -w /data \ | |
| gsoci.azurecr.io/giantswarm/yamllint:1.37.1 \ | |
| --format=parsable . > yamllint-output.txt 2>&1 | |
| exit_code=$? | |
| # Write summary only if there are failures | |
| if [ $exit_code -ne 0 ]; then | |
| echo "## YAML Validation Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "❌ Found issues in the following files:" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| # Extract and format only lines with errors | |
| if [ -s yamllint-output.txt ]; then | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| grep '\[error\]' yamllint-output.txt >> $GITHUB_STEP_SUMMARY || echo "No errors found in output" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| fi | |
| fi | |
| # Clean up | |
| rm -f yamllint-output.txt | |
| # Exit with the original exit code | |
| exit $exit_code | |
| - name: Validate GitHub Actions | |
| uses: jazzsequence/github-action-validator@863579565c8771e1d64646e44ad5ff4884eac85f # v1.0.5 | |
| with: | |
| show-ascii-art: false | |
| path-to-workflows: '.github/workflows/*.yaml' | |
| analyze-actions: | |
| name: Analyze workflows with zizmor (report-only) | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to the Security tab (code scanning is enabled) | |
| actions: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Report-only: zizmor uploads findings to the Security tab for visibility but never | |
| # blocks PRs. The repo carries pre-existing findings that are tracked separately; this | |
| # scan is here to surface regressions (e.g. re-introducing `${{ toJson(github) }}` in a | |
| # `run:` block) that CodeQL did not catch. See giantswarm/giantswarm#36940. | |
| - name: Run zizmor (non-blocking) | |
| continue-on-error: true | |
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 | |
| with: | |
| persona: regular |