59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
## SECURITY WARNING:
|
|
##
|
|
## Do not change this job unless you know what you're doing.
|
|
##
|
|
## This GitHub Action runs on: pull_request_target, which means the jobs run in
|
|
## a context where they have access to a Access Token with write access to the
|
|
## target repo, even if the PR is opened from an external contributor from their
|
|
## fork.
|
|
##
|
|
## This means that if we're not careful, we could be running third-party code
|
|
## within an authenticated scope, which isn't good. To mitigate this, this
|
|
## implementation does:
|
|
##
|
|
## 1. checkout the target branch (i.e. the project's original sources)
|
|
## 2. install the Gems from there, and install them into a directory that's
|
|
## outside the repository contents.
|
|
## 3. checkout the PRs HEAD
|
|
## 4. restore a bunch of files that would allow code execution from the
|
|
## project's upstream sources, namely:
|
|
## - bin/bundle - we'll run that in our Job
|
|
## - Gemfile/Gemfile.lock - to avoid loading a gem with an identical
|
|
## version number from a in-repo vendored directory
|
|
|
|
name: Lint
|
|
on:
|
|
pull_request_target:
|
|
|
|
permissions:
|
|
contents: read
|
|
statuses: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
pronto:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Target branch
|
|
uses: actions/checkout@v3
|
|
with:
|
|
ref: ${{ github.base_ref }}
|
|
fetch-depth: 0
|
|
- uses: ruby/setup-ruby@v1
|
|
with:
|
|
ruby-version: "3.1"
|
|
bundler-cache: true
|
|
- name: Checkout PR HEAD
|
|
run: |
|
|
git fetch -q origin +refs/pull/${{ github.event.pull_request.number }}/head:
|
|
git checkout -qf FETCH_HEAD
|
|
- name: Restore the bundle binstub and Gemfiles from the target branch
|
|
run: |
|
|
git restore -s ${{ github.base_ref }} -- bin/bundle
|
|
git restore -s ${{ github.base_ref }} -- Gemfile
|
|
git restore -s ${{ github.base_ref }} -- Gemfile.lock
|
|
- name: Run Pronto
|
|
run: bin/bundle exec pronto run -f github_status github_pr_review -c ${{ github.base_ref }}
|
|
env:
|
|
PRONTO_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
|
|
PRONTO_GITHUB_ACCESS_TOKEN: ${{ github.token }}
|