ci(deps)(deps): Bump ossf/scorecard-action from 2.4.0 to 2.4.3 in the gha-minor-patch group #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2026 Santander Group | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # License compliance. autoguardrails has no third-party runtime dependencies | |
| # (stdlib-only), so there is no dependency-license allowlist to enforce; this | |
| # workflow verifies that every Python source file declares an | |
| # SPDX-License-Identifier and that no runtime dependency creeps in. | |
| # Replace action references with SHA digests before publishing. | |
| name: License check | |
| on: | |
| push: | |
| branches: [main, development] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| no-runtime-deps: | |
| name: Assert no runtime dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Fail if a dependency manifest is introduced | |
| run: | | |
| set -euo pipefail | |
| if [ -f requirements.txt ] || grep -qE '^\s*dependencies\s*=' pyproject.toml 2>/dev/null; then | |
| echo "FAIL: a runtime dependency manifest was introduced." | |
| echo "autoguardrails must remain stdlib-only. If this is intentional," | |
| echo "add a dependency-license allowlist job to this workflow." | |
| exit 1 | |
| fi | |
| echo "OK: no runtime dependency manifest present." | |
| spdx-headers: | |
| name: SPDX headers | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Verify every Python file declares SPDX-License-Identifier | |
| run: | | |
| missing=0 | |
| while IFS= read -r f; do | |
| if ! head -n 5 "$f" | grep -q "SPDX-License-Identifier:"; then | |
| echo "MISSING SPDX header: $f" | |
| missing=$((missing + 1)) | |
| fi | |
| done < <(find autoguardrails tests -type f -name "*.py") | |
| if [ "$missing" -gt 0 ]; then | |
| echo "Found $missing files without SPDX header." | |
| exit 1 | |
| fi | |
| echo "OK: all Python files have SPDX headers." |