From ed18fae8f609d6e8dd20b051a0c74ebd234a488e Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:51:04 +0200 Subject: [PATCH 1/6] ci: use shared PR audit workflow --- .github/workflows/pr-audit.yml | 45 +++++++++++----------------------- 1 file changed, 14 insertions(+), 31 deletions(-) diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml index b2a7d63..53c4274 100644 --- a/.github/workflows/pr-audit.yml +++ b/.github/workflows/pr-audit.yml @@ -4,13 +4,14 @@ on: pull_request: types: [labeled] -permissions: - contents: read +permissions: {} jobs: - publish: + authorize: + if: github.event.label.name == 'cyclops' runs-on: ubuntu-latest - if: github.event.action == 'labeled' && github.event.label.name == 'cyclops' + permissions: + contents: read steps: - name: Check admin permission env: @@ -24,30 +25,12 @@ jobs: exit 1 fi - - name: Publish event - env: - EVENTS_KEY: ${{ secrets.EVENTS_KEY }} - EVENTS_CERT: ${{ secrets.EVENTS_CERT }} - EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }} - REPOSITORY: ${{ github.repository }} - PR_NUMBER: ${{ github.event.pull_request.number }} - PR_SHA: ${{ github.event.pull_request.head.sha }} - run: | - set -euo pipefail - - echo "$EVENTS_KEY" > "$RUNNER_TEMP/key" - echo "$EVENTS_CERT" > "$RUNNER_TEMP/cert" - - read -r -a events_args <<< "${EVENTS_ARGS:-}" - curl -sf -o /dev/null -X POST "${events_args[@]}" \ - -H "Content-Type: application/json" \ - --key "$RUNNER_TEMP/key" \ - --cert "$RUNNER_TEMP/cert" \ - -d "{ - \"repository\": \"${REPOSITORY}\", - \"event\": \"pr_audit\", - \"data\": { - \"pr_number\": ${PR_NUMBER}, - \"sha\": \"${PR_SHA}\" - } - }" + pr-audit: + needs: authorize + permissions: + contents: read + uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@98b1081dcf34361b576aca2ab3041772708582ef + secrets: + EVENTS_KEY: ${{ secrets.EVENTS_KEY }} + EVENTS_CERT: ${{ secrets.EVENTS_CERT }} + EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }} From caffc23a31ee41febf12fa1651fc72ffb0dfd848 Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Thu, 6 Aug 2026 11:57:51 +0200 Subject: [PATCH 2/6] ci: refresh shared PR audit pin --- .github/workflows/pr-audit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml index 53c4274..7044e85 100644 --- a/.github/workflows/pr-audit.yml +++ b/.github/workflows/pr-audit.yml @@ -29,7 +29,7 @@ jobs: needs: authorize permissions: contents: read - uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@98b1081dcf34361b576aca2ab3041772708582ef + uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@483bda4a2a4b5e04a51edff03768c1590d271f80 secrets: EVENTS_KEY: ${{ secrets.EVENTS_KEY }} EVENTS_CERT: ${{ secrets.EVENTS_CERT }} From b9c665bbfc7efe13abe33bbd4a5918d1aa7464d1 Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:07:11 +0200 Subject: [PATCH 3/6] ci: ignore unversioned shared action pins --- .pinact.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .pinact.yaml diff --git a/.pinact.yaml b/.pinact.yaml new file mode 100644 index 0000000..269bf92 --- /dev/null +++ b/.pinact.yaml @@ -0,0 +1,17 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json +# pinact - https://github.com/suzuki-shunsuke/pinact +version: 3 +# min_age: +# value: 7 # threshold in days +# always: true # also run the passive audit on every `pinact run` (extra GitHub API calls) +# separator: " # " +# files: +# - pattern: action.yaml +# - pattern: */action.yaml + +rules: + # tempoxyz/gh-actions has no release version to record in a comment. + - ignore: true + conditions: + - expr: | + ActionName matches "tempoxyz/gh-actions/.*" From 1bf2efa21dacdf397ebc76d0a8a1a660ebf404f9 Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:09:30 +0200 Subject: [PATCH 4/6] chore: simplify pinact config --- .pinact.yaml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.pinact.yaml b/.pinact.yaml index 269bf92..ef3c977 100644 --- a/.pinact.yaml +++ b/.pinact.yaml @@ -1,13 +1,4 @@ -# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json -# pinact - https://github.com/suzuki-shunsuke/pinact version: 3 -# min_age: -# value: 7 # threshold in days -# always: true # also run the passive audit on every `pinact run` (extra GitHub API calls) -# separator: " # " -# files: -# - pattern: action.yaml -# - pattern: */action.yaml rules: # tempoxyz/gh-actions has no release version to record in a comment. From 6890f94c2335c364edd55c892f6b57e825914163 Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Mon, 10 Aug 2026 19:01:41 +0200 Subject: [PATCH 5/6] ci: refresh shared PR audit pin --- .github/workflows/pr-audit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml index 7044e85..f88c7ac 100644 --- a/.github/workflows/pr-audit.yml +++ b/.github/workflows/pr-audit.yml @@ -29,7 +29,7 @@ jobs: needs: authorize permissions: contents: read - uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@483bda4a2a4b5e04a51edff03768c1590d271f80 + uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@183a02178c660ce295e9a262edc5857cb7135f06 secrets: EVENTS_KEY: ${{ secrets.EVENTS_KEY }} EVENTS_CERT: ${{ secrets.EVENTS_CERT }} From f5776780ff481f91dbff4e74789ce36cd45241d9 Mon Sep 17 00:00:00 2001 From: Mablr <59505383+mablr@users.noreply.github.com> Date: Thu, 13 Aug 2026 10:36:09 +0200 Subject: [PATCH 6/6] ci: grant shared audit permissions --- .github/workflows/pr-audit.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/pr-audit.yml b/.github/workflows/pr-audit.yml index f88c7ac..6e990db 100644 --- a/.github/workflows/pr-audit.yml +++ b/.github/workflows/pr-audit.yml @@ -29,6 +29,8 @@ jobs: needs: authorize permissions: contents: read + pull-requests: read + statuses: write uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@183a02178c660ce295e9a262edc5857cb7135f06 secrets: EVENTS_KEY: ${{ secrets.EVENTS_KEY }}