Enable workflows on .github repo #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check Sensitive Files | |
| on: | |
| workflow_call: | |
| inputs: | |
| skip-label: | |
| required: false | |
| type: string | |
| default: ignore-sensitive-files-pr | |
| # Direct trigger for this repository | |
| pull_request: | |
| types: [opened, synchronize] | |
| jobs: | |
| check-sensitive-files: | |
| if: ${{ github.actor != 'dependabot[bot]' }} | |
| name: Checks if sensitive files have been changed without authorization | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Get PR labels | |
| id: check-labels | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Skip if not running in a PR | |
| if [ -z "${{ github.event.pull_request.number }}" ]; then | |
| echo "skip=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| LABELS="$(gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels \ | |
| --jq '.[].name' | tr '\n' ' ')" | |
| if echo "$LABELS" | grep -qw "${{ inputs.skip-label }}"; then | |
| echo "::notice::Skipping sensitive files check due to '${{ inputs.skip-label }}' label." | |
| echo "skip=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "skip=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Detect sensitive file changes | |
| if: steps.check-labels.outputs.skip != 'true' | |
| id: sensitive-check | |
| run: | | |
| # Skip if not a PR | |
| if [ -z "${{ github.event.pull_request.base.sha }}" ]; then | |
| echo "any_changed=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| HEAD_SHA="${{ github.event.pull_request.head.sha || github.sha }}" | |
| BASE_SHA=$(git merge-base "${{ github.event.pull_request.base.sha }}" "$HEAD_SHA") | |
| SENSITIVE_PATTERNS=( | |
| '.flake8$' | |
| '.pydocstyle$' | |
| 'pyproject.toml$' | |
| '.env..*$' | |
| 'vitest.config.js$' | |
| 'src/App.tsx$' | |
| '^.github/.*' | |
| '^.husky/.*' | |
| '^scripts/.*' | |
| '^src/style/.*' | |
| 'schema.graphql$' | |
| 'package.json$' | |
| 'package-lock.json$' | |
| 'tsconfig.json$' | |
| '^.gitignore$' | |
| '^env.example$' | |
| '.node-version$' | |
| '.eslintrc.json$' | |
| '.eslintignore$' | |
| '.prettierrc$' | |
| '.prettierignore$' | |
| 'vite.config.ts$' | |
| '^docker/docker-compose.prod.yaml$' | |
| '^docker/docker-compose.dev.yaml$' | |
| '^docker/Dockerfile.dev$' | |
| '^docker/Dockerfile.prod$' | |
| '^config/docker/setup/nginx.conf$' | |
| '^config/docker/setup/nginx.prod.conf$' | |
| 'CODEOWNERS$' | |
| 'LICENSE$' | |
| 'setup.ts$' | |
| '.coderabbit.yaml$' | |
| 'CODE_OF_CONDUCT.md$' | |
| 'CODE_STYLE.md$' | |
| 'CONTRIBUTING.md$' | |
| 'DOCUMENTATION.md$' | |
| 'INSTALLATION.md$' | |
| 'ISSUE_GUIDELINES.md$' | |
| 'PR_GUIDELINES.md$' | |
| 'README.md$' | |
| 'index.html$' | |
| '.*.pem$' | |
| '.*.key$' | |
| '.*.cert$' | |
| '.*.password$' | |
| '.*.secret$' | |
| '.*.credentials$' | |
| '.nojekyll$' | |
| 'yarn.lock$' | |
| 'knip.json$' | |
| 'knip.deps.json$' | |
| '^docs/docusaurus.config.ts$' | |
| '^docs/sidebar..*' | |
| 'CNAME$' | |
| ) | |
| CHANGED_FILES="$(git diff --name-only --diff-filter=ACMRD "$BASE_SHA" "$HEAD_SHA")" | |
| UNAUTHORIZED="" | |
| for pattern in "${SENSITIVE_PATTERNS[@]}"; do | |
| MATCHES=$(echo "$CHANGED_FILES" | grep -E "$pattern" || true) | |
| if [ -n "$MATCHES" ]; then | |
| UNAUTHORIZED="$UNAUTHORIZED $MATCHES" | |
| fi | |
| done | |
| UNAUTHORIZED=$(echo "$UNAUTHORIZED" | xargs) | |
| echo "files=$UNAUTHORIZED" >> $GITHUB_OUTPUT | |
| if [ -n "$UNAUTHORIZED" ]; then | |
| echo "any_changed=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "any_changed=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Fail if sensitive files changed | |
| if: steps.sensitive-check.outputs.any_changed == 'true' | |
| run: | | |
| echo "::error::Unauthorized changes detected in sensitive files:" | |
| echo "" | |
| for file in ${{ steps.sensitive-check.outputs.files }}; do | |
| echo "- $file" | |
| done | |
| echo "" | |
| echo "To override, add the '${{ inputs.skip-label }}' label to this PR." | |
| exit 1 |