mirror of
https://github.com/supabase/supabase.git
synced 2026-09-08 10:59:38 +08:00
da724eb8c6
## Summary - Add a zizmor config and CI job that lints `.github/workflows` on every PR touching it, downloading and attestation-verifying the pinned v1.26.1 release binary (cached across runs) - Fix the mutable-tag and excess-permission findings zizmor surfaces in `braintrust-evals.yml`, `publish_image.yml`, and `self-host-tests-smoke.yml`: pin `actions/checkout`/`actions/setup-node` to commit SHAs, and scope `pull-requests`/`packages`/`id-token` permissions down to the specific jobs that need them ## Test plan - [x] Confirm the `zizmor` job runs and passes on this PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated security scanning for workflow changes on pull requests. * Added configuration to allow specific workflow trigger exceptions. * **Security** * Tightened GitHub Actions permissions at the workflow level and re-granted only where required per job. * Pinned common build action versions to specific commits for more consistent execution. * **Maintenance** * Updated workflow caching and action step annotations without changing linting or fixing behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
name: Auto Label Issues
|
|
on:
|
|
issues:
|
|
types: [opened, reopened]
|
|
jobs:
|
|
check-external:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
steps:
|
|
- name: Check if organization member
|
|
id: is-org-member
|
|
uses: JamesSingleton/is-organization-member@39c59b3b17cca4eb75c81772b95e724e2a24c025 # 1.0.0
|
|
with:
|
|
organization: ${{ github.repository_owner }}
|
|
username: ${{ github.event.issue.user.login }}
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: label-member
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
NUMBER: ${{ github.event.issue.number }}
|
|
IS_INTERNAL: ${{ steps.is-org-member.outputs.result }}
|
|
run: |
|
|
if [ "$IS_INTERNAL" != "true" ]; then
|
|
echo "User is outside of organization, labeling external"
|
|
gh issue edit "$NUMBER" --add-label "external-issue"
|
|
else
|
|
echo "User is within the organization, labeling internal"
|
|
gh issue edit "$NUMBER" --add-label "internal-issue"
|
|
fi
|
|
triage-new:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
steps:
|
|
- name: Label triage
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
NUMBER: ${{ github.event.issue.number }}
|
|
LABELS: to-triage
|
|
run: |
|
|
echo "Applying triage label for new issue"
|
|
gh issue edit "$NUMBER" --add-label "$LABELS"
|
|
spam-detection:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
steps:
|
|
- name: Check GitHub Issue for spam
|
|
env:
|
|
POST_URL: ${{ secrets.POST_URL }}
|
|
BEARER_TOKEN: ${{ secrets.BEARER_TOKEN }}
|
|
NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
RESPONSE=$(curl -s -X POST "$POST_URL" \
|
|
-H "Authorization: Bearer $BEARER_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"issue_id": $NUMBER}')
|
|
echo "spam_response=$RESPONSE" >> $GITHUB_OUTPUT
|
|
- name: Use spam detector output to label issue
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
NUMBER: ${{ github.event.issue.number }}
|
|
LABEL: flagged
|
|
run: |
|
|
IS_SPAM=$(echo "$SPAM_RESPONSE" | jq -r '.spam')
|
|
if [ "$IS_SPAM" == "true" ]; then
|
|
echo "Applying flagged label for new issue suspected of spam"
|
|
gh issue edit "$NUMBER" --add-label "$LABEL"
|
|
fi
|