feat: implement user switching for hytale-downloader execution in dow… #215
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "🔍 Security & Shell Lint" | |
| on: | |
| push: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| hadolint: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| strategy: | |
| matrix: | |
| dockerfile: [Dockerfile.alpine, Dockerfile.ubuntu, Dockerfile.alpine-liberica] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Install Hadolint | |
| run: | | |
| curl -sL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint | |
| chmod +x /usr/local/bin/hadolint | |
| - name: Lint Dockerfile (SARIF + console) | |
| run: | | |
| echo "Linting ${{ matrix.dockerfile }}..." | |
| # Output SARIF for GitHub Code Scanning | |
| hadolint "${{ matrix.dockerfile }}" --no-fail -f sarif > "sarif-${{ matrix.dockerfile }}.sarif" || true | |
| # Also print warnings/errors in console for visibility | |
| hadolint "${{ matrix.dockerfile }}" || true | |
| - name: Upload Hadolint SARIF | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: "sarif-${{ matrix.dockerfile }}.sarif" | |
| category: hadolint | |
| trivy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Run Trivy Scan | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: 'fs' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy SARIF | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| category: trivy | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Run ShellCheck | |
| uses: ludeeus/action-shellcheck@2.0.0 | |
| continue-on-error: true | |
| with: | |
| scandir: './scripts' |