mrcharles
7822abf2eb
ci / audit (push) Successful in 39s
https://projects.knownelement.com/issues/784
26 lines
887 B
YAML
26 lines
887 B
YAML
# OAM fleet CI [#784] — same gate as pre-commit: shellcheck + secret scan + rule audit.
|
|
# Uniform across KNEL OAM repos (single-branch main until dev/release split lands).
|
|
name: ci
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
jobs:
|
|
audit:
|
|
runs-on: ultix
|
|
container:
|
|
image: node:20-bookworm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: install shellcheck
|
|
run: apt-get update -qq >/dev/null && apt-get install -qq -y shellcheck git >/dev/null
|
|
- name: secret scan
|
|
run: |
|
|
if grep -rInE "BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY|aws_secret_access_key *=|AKIA[0-9A-Z]{16}" --exclude-dir=.git .; then
|
|
echo "::error::secret material committed"; exit 1
|
|
else
|
|
echo "secret scan clean"
|
|
fi
|
|
- name: rule audit (framework check-rules)
|
|
run: bash scripts/check-rules.sh --fast
|