Bryan BeverlyandCursor
36f6f69707
Convert all GitHub Actions uses: refs from mutable tags to immutable SHA pins with version comments. This prevents tag-hijack supply chain attacks while preserving version tracking for Renovate. Part of the org-wide Dependency Strategy Unification (Step 2). Co-authored-by: Cursor <[email protected]>
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
name: Smoke
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
smoke:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- name: Install Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
|
|
with:
|
|
go-version: "1.25"
|
|
- name: Smoke
|
|
run: |
|
|
set -e
|
|
go run . git https://github.com/dustin-decker/secretsandstuff.git > /dev/null
|
|
go run . github --repo https://github.com/dustin-decker/secretsandstuff.git > /dev/null
|
|
zombies:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- name: Install Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
|
|
with:
|
|
go-version: "1.25"
|
|
- name: Run trufflehog
|
|
run: |
|
|
set -e
|
|
go run . git --no-verification file://. > /dev/null
|
|
# This case previously had a deadlock issue and left zombies after trufflehog exited #3379
|
|
go run . git --no-verification https://github.com/git-test-fixtures/binary.git > /dev/null
|
|
- name: Check for running git processes and zombies
|
|
run: |
|
|
if pgrep -x "git" > /dev/null
|
|
then
|
|
echo "Git processes are still running"
|
|
exit 1
|
|
else
|
|
echo "No git processes found"
|
|
fi
|
|
|
|
if ps -A -ostat,ppid | grep -e '[zZ]' > /dev/null
|
|
then
|
|
echo "Zombie processes found"
|
|
exit 1
|
|
else
|
|
echo "No zombie processes found"
|
|
fi
|