chore: version packages (#528) #1598
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security-scan | |
| # Security scanning for atrib. | |
| # | |
| # Caller for the reusable workflow at creatornader/oss-security-scan, | |
| # which runs typos + gitleaks + trufflehog + osv-scanner. OSV-Scanner | |
| # is gated to the scheduled run (Sunday 09:00 UTC) so PRs and pushes | |
| # stay fast. | |
| # | |
| # pre-commit job runs textleaks + oss-twin-check + the existing | |
| # hygiene + prettier hooks at PR time as the CI-side enforcement of | |
| # the local hooks in .pre-commit-config.yaml. | |
| # | |
| # All run: blocks use no github.event.* inputs. | |
| # | |
| # Vale (prose lint) and Layer B (LLM semantic prose audit) remain | |
| # local-only via the maintainer's pre-commit hooks; that's by design, | |
| # unchanged by this workflow. | |
| on: | |
| merge_group: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 9 * * 0' | |
| workflow_dispatch: # operator-triggered re-runs (matches atrib-log-pp-cli + note-to-self) | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| jobs: | |
| scan: | |
| uses: creatornader/oss-security-scan/.github/workflows/oss-security-scan.yml@v0.2.0 | |
| with: | |
| gitleaks-version: '8.30.1' | |
| gitleaks-config: '.gitleaks.toml' | |
| run-osv-scanner: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} | |
| pre-commit: | |
| # Scoped to the two NEW hooks this PR adds (textleaks + oss-twin-check). | |
| # The existing prettier + hygiene hooks in .pre-commit-config.yaml run | |
| # locally for contributors but aren't enforced in CI here. Pre-existing | |
| # un-formatted files in the tree predate this PR and need a separate | |
| # cleanup pass to enforce in CI without breaking unrelated work. | |
| name: pre-commit (textleaks + oss-twin-check) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.12' | |
| - uses: pre-commit/action@v3.0.1 | |
| env: | |
| # Skip the pre-existing hooks (they continue to run locally | |
| # for contributors). CI gates only on the two NEW hooks this | |
| # PR adds. | |
| SKIP: gitleaks,trailing-whitespace,end-of-file-fixer,check-merge-conflict,check-yaml,check-json,check-added-large-files,prettier-check |