Skip to content
This repository was archived by the owner on Dec 29, 2025. It is now read-only.

Commit 060c53e

Browse files
biow0lfbiow0lf
authored
Updates (#4)
* Add action linter * Add Spell checker * Add dependency review github action * Add fasterer * Add fasterer * Configure fasterer * Importmap audit * Add rails assets github action * Add scorecards github action
1 parent d6374a8 commit 060c53e

File tree

12 files changed

+308
-22
lines changed

12 files changed

+308
-22
lines changed

‎.fasterer.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
speedups:
2+
fetch_with_argument_vs_block: false
3+
4+
exclude_paths:
5+
- 'vendor/**/*'

‎.github/workflows/actionlint.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Action Lint
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch: {}
11+
schedule:
12+
- cron: "0 21 * * 6"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
actionlint:
19+
runs-on: ubuntu-24.04
20+
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
29+
- uses: raven-actions/actionlint@3a24062651993d40fed1019b58ac6fbdfbf276cc # v2.0.1
30+
id: actionlint
31+
with:
32+
pyflakes: false
33+
34+
- name: actionlint Summary
35+
if: ${{ steps.actionlint.outputs.exit-code != 0 }}
36+
run: |
37+
echo "Used actionlint version ${{ steps.actionlint.outputs.version-semver }}"
38+
echo "Used actionlint release ${{ steps.actionlint.outputs.version-tag }}"
39+
echo "actionlint ended with ${{ steps.actionlint.outputs.exit-code }} exit code"
40+
echo "actionlint ended because '${{ steps.actionlint.outputs.exit-message }}'"
41+
echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors"
42+
echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files"
43+
echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}"
44+
# shellcheck disable=SC2242
45+
exit ${{ steps.actionlint.outputs.exit-code }}

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎.github/workflows/codespell.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Spell Checking
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch: {}
11+
schedule:
12+
- cron: "0 21 * * 6"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
codespell:
19+
name: Check spelling of all files with codespell
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
- uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2.1

‎.github/workflows/dependency-review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "Dependency Review"
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
dependency-review:
13+
runs-on: ubuntu-24.04
14+
steps:
15+
- name: Harden Runner
16+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
17+
with:
18+
egress-policy: audit
19+
20+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
21+
- name: "Dependency Review"
22+
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1

‎.github/workflows/fasterer.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Fasterer
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch: {}
11+
schedule:
12+
- cron: "0 21 * * 6"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
fasterer:
19+
runs-on: ubuntu-24.04
20+
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
- name: Set up Ruby
29+
uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
30+
with:
31+
rubygems: latest
32+
bundler: latest
33+
bundler-cache: true
34+
- run: bin/fasterer

‎.github/workflows/importmap.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Importmap
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch: {}
11+
schedule:
12+
- cron: "0 21 * * 6"
13+
14+
permissions:
15+
contents: read
16+
17+
env:
18+
SECRET_KEY_BASE: "9c3c615176fb0617ca811c4010049b410dfb4163cf30157ed1cd20e724f5a845264d0bded3ebba8588275bbc52476905dc3fcb05985031920cc2e89017fc8a7b"
19+
20+
jobs:
21+
audit:
22+
runs-on: ubuntu-24.04
23+
24+
steps:
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
27+
with:
28+
egress-policy: audit
29+
30+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
31+
- name: Set up Ruby
32+
uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
33+
with:
34+
rubygems: latest
35+
bundler: latest
36+
bundler-cache: true
37+
- run: bin/importmap audit

‎.github/workflows/rails-assets.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Rails assets
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch: {}
11+
schedule:
12+
- cron: "0 21 * * 6"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
precompile:
19+
runs-on: ubuntu-24.04
20+
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
- name: Set up Ruby
29+
uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
30+
with:
31+
rubygems: latest
32+
bundler: latest
33+
bundler-cache: true
34+
- run: bin/rails SECRET_KEY_BASE_DUMMY=1 assets:precompile

‎.github/workflows/scorecards.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
7+
on:
8+
# For Branch-Protection check. Only the default branch is supported. See
9+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
10+
branch_protection_rule: {}
11+
# To guarantee Maintained check is occasionally updated. See
12+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
13+
push:
14+
branches:
15+
- main
16+
schedule:
17+
- cron: "0 21 * * 6"
18+
19+
# Declare default permissions as read only.
20+
permissions: read-all
21+
22+
jobs:
23+
analysis:
24+
name: Scorecard analysis
25+
runs-on: ubuntu-24.04
26+
permissions:
27+
# Needed to upload the results to code-scanning dashboard.
28+
security-events: write
29+
# Needed to publish results and get a badge (see publish_results below).
30+
id-token: write
31+
# Uncomment the permissions below if installing in a private repository.
32+
# contents: read
33+
# actions: read
34+
35+
steps:
36+
- name: Harden Runner
37+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
38+
with:
39+
egress-policy: audit
40+
41+
- name: "Checkout code"
42+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
43+
with:
44+
persist-credentials: false
45+
46+
- name: "Run analysis"
47+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
48+
with:
49+
results_file: results.sarif
50+
results_format: sarif
51+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
52+
# - you want to enable the Branch-Protection check on a *public* repository, or
53+
# - you are installing Scorecard on a *private* repository
54+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
55+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
56+
57+
# Public repositories:
58+
# - Publish results to OpenSSF REST API for easy access by consumers
59+
# - Allows the repository to include the Scorecard badge.
60+
# - See https://github.com/ossf/scorecard-action#publishing-results.
61+
# For private repositories:
62+
# - `publish_results` will always be set to `false`, regardless
63+
# of the value entered here.
64+
publish_results: true
65+
66+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
67+
# format to the repository Actions tab.
68+
- name: "Upload artifact"
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
70+
with:
71+
name: SARIF file
72+
path: results.sarif
73+
retention-days: 5
74+
75+
# Upload the results to GitHub's code scanning dashboard.
76+
- name: "Upload to code-scanning"
77+
uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
78+
with:
79+
sarif_file: results.sarif

‎Gemfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,5 @@ group :development, :test do
2929
end
3030

3131
group :development do
32+
gem "fasterer", require: false
3233
end

0 commit comments

Comments
 (0)