Remove https://gharbiya.hackclub.com/ (DNS takeover) #357
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: dry-run | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| merge_group: | |
| permissions: | |
| contents: read | |
| jobs: | |
| package: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Collect changed zone files | |
| id: collect | |
| env: | |
| # github.base_ref is set for pull_request events; for merge_group | |
| # events we read the merge_group base_sha from the event payload. | |
| BASE_REF: ${{ github.base_ref }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dry-run-payload/zones | |
| if [ "$EVENT_NAME" = "merge_group" ]; then | |
| DIFF_BASE="$(jq -r '.merge_group.base_sha' "$GITHUB_EVENT_PATH")" | |
| else | |
| DIFF_BASE="origin/${BASE_REF}" | |
| fi | |
| # Only top-level *.yaml zone files (no path separators). | |
| mapfile -t changed < <( | |
| git diff --name-only --diff-filter=ACMR \ | |
| "${DIFF_BASE}"...HEAD -- '*.yaml' \ | |
| | grep -Ev '/' || true | |
| ) | |
| if [ "${#changed[@]}" -eq 0 ]; then | |
| echo "No top-level zone YAML files changed." | |
| echo "found=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| for f in "${changed[@]}"; do | |
| # Sanity: defense in depth — reject anything that isn't a | |
| # bare zone filename so the consumer can't be tricked into | |
| # writing outside the repo root. | |
| case "$f" in | |
| */*|.*|*..*|"") | |
| echo "Refusing suspicious filename: $f" >&2 | |
| exit 1 ;; | |
| esac | |
| cp -- "$f" "dry-run-payload/zones/$f" | |
| done | |
| printf '%s\n' "${changed[@]}" > dry-run-payload/zones.list | |
| echo "found=true" >> "$GITHUB_OUTPUT" | |
| - name: Save PR metadata | |
| if: steps.collect.outputs.found == 'true' | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number || '0' }} | |
| run: printf '%s\n' "$PR_NUMBER" > dry-run-payload/pr_number | |
| - name: Upload dry-run payload | |
| if: steps.collect.outputs.found == 'true' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dry-run-payload | |
| retention-days: 1 | |
| path: dry-run-payload/ |