Bryan BeverlyandCursor
8fe2bd7452
The `zombies` job had a job-level `timeout-minutes: 5` that covered a full binary compile as well as the two scans it is meant to bound. On PRs that change `go.sum` the Go cache is cold, the compile takes ~2m30s instead of ~29s, and the job exceeds 5 minutes even though the zombie check itself passes. PR #5280 hit this on both attempts; #5273 passed with 19s to spare. Build to `$RUNNER_TEMP` in a separate step and move `timeout-minutes` onto the run step, so the 5-minute budget now measures only the scans (~1m42s) and no longer depends on build speed. A step-level timeout also fails the job rather than cancelling it, which is a clearer signal. `smoke` had no timeout at all and inherited the 360-minute default despite doing under a minute of work, so a hang in its live-verification scans burned six hours of runner time. Both jobs now cap at 15 minutes to catch build and infrastructure hangs. Also set `cache: false` on setup-go in `checksecretparts`. That job is stdlib-only and finishes in ~23s, so it wins the race to write the `go.sum`-keyed cache and saves ~10MB with no module cache at all. Cache keys are write-once, so every later job on the branch restores the empty entry and cannot replace it. Co-authored-by: Cursor <[email protected]>
GitHub Workflows
This directory contains GitHub Actions workflows for the TruffleHog repository.
PR Approval Check (pr-approval-check.yml)
This workflow enforces that at least one PR approver must be an active member of the @trufflesecurity/product-eng team or any of its child teams.
How it works:
-
Triggers: The workflow runs on:
pull_request_reviewevents when a review is submitted (submittedtype)pull_requestevents when a PR is opened, reopened, or synchronized (opened,reopened,synchronizetypes)
-
Approval Check Process: The workflow:
- Fetches all reviews for the PR using the GitHub API
- Filters for reviews with state
APPROVED - Gets all child teams of
@trufflesecurity/product-engusinglistChildInOrgAPI - Checks if any approver is an active member (not pending) of either:
- The parent
@trufflesecurity/product-engteam, OR - Any of its child teams
- The parent
- Sets a commit status accordingly
-
Status Check: Creates a commit status named
product-eng-approvalwith:- ✅ Success: When at least one approver is an active member of
@trufflesecurity/product-engor any child team - ❌ Failure: When there are no approvals or there are approvals but none from active
@trufflesecurity/product-engmembers
- ✅ Success: When at least one approver is an active member of
Error Handling
If there are errors listing reviews or checking team membership, the workflow reports a failure status and also fails itself.
Branch Protection
To make this check required:
- Go to Settings → Branches
- Add or edit a branch protection rule for your main branch
- Enable "Require status checks to pass before merging"
- Add
pr-approval-checkto the required status checks
Permissions
The workflow uses the default GITHUB_TOKEN which has sufficient permissions to:
- Read PR reviews
- List child teams and check team membership (for public teams)
- Create commit statuses
Note: If the product-eng team or its child teams are private, you may need to use a personal access token with appropriate permissions. The Github API returns 404 for non-members and for lack of permissions.