feat(github-actions): add gha-sha-enforcer lint action#3797
feat(github-actions): add gha-sha-enforcer lint action#3797josephperrott wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new GitHub Action, "GHA SHA Enforcer", designed to enforce full-length SHAs and version comments for external actions within workflow files. The implementation includes the TypeScript logic, Bazel build configurations, and workspace updates. Feedback on the implementation highlights two key areas for improvement: implementing a state machine to correctly ignore uses: patterns inside multiline block scalars (such as shell scripts) to prevent false positives, and enhancing robustness by utilizing process.env.GITHUB_WORKSPACE and filtering out subdirectories during directory reads to avoid potential crashes.
There was a problem hiding this comment.
Please add this "github-actions/linting/gha-sha-enforcer/main.js" to .prettierignore to prevent formatting check-in mismatches.
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
Some minor stuff, otherwise LGTM.
josephperrott
force-pushed
the
enforce-gha-shas
branch
2 times, most recently
from
a7b27e1 to
46c3068
Compare
josephperrott
force-pushed
the
enforce-gha-shas
branch
from
46c3068 to
bea2d86
Compare
2 participants
Enforce full-length SHAs and version comments for external GitHub Actions.