.github/.spectral.yaml at develop · lightspeedwp/.github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
extends:
  - spectral:oas

rules:
  # Workflow validation rules
  workflow-name-required:
    message: "GitHub Actions workflow must have a name"
    severity: error
    given: "$"
    then:
      field: name
      function: truthy

  workflow-on-required:
    message: "Workflow must define triggers"
    severity: error
    given: "$"
    then:
      field: "on"
      function: truthy

  job-runs-on-required:
    message: "Job must specify runs-on"
    severity: error
    given: "$.jobs.*"
    then:
      field: runs-on
      function: truthy

  # Schema validation rules
  schema-type-valid:
    message: "Schema must have valid type"
    severity: error
    given: "$.properties"
    then:
      function: schema
      functionOptions:
        schema:
          type: object

  # Frontmatter validation rules
  frontmatter-required-fields:
    message: "Must contain required frontmatter fields"
    severity: warning
    given: "$"
    then:
      function: truthy

  # Documentation rules
  heading-hierarchy-valid:
    message: "Headings must follow proper hierarchy (avoid skipping levels)"
    severity: warning
    given: "$"
    then:
      function: truthy

  # Workflow security rules
  workflow-no-hardcoded-secrets:
    message: "Workflows must not contain hardcoded secrets"
    severity: error
    given: "$.jobs.*"
    then:
      field: env
      function: pattern
      functionOptions:
        match: "^(?!.*password|.*secret|.*token).*$"
        severity: error

  workflow-permissions-explicit:
    message: "Workflows should explicitly define permissions"
    severity: warning
    given: "$"
    then:
      field: permissions
      function: truthy

  # Action pinning
  actions-pinned-to-commit:
    message: "Actions should be pinned to commit SHA"
    severity: warning
    given: "$.jobs.*.steps[*].uses"
    then:
      function: pattern
      functionOptions:
        match: "@[a-f0-9]{40}$"