fix: publish a valid consumer baseline pin #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Documentation Contract | |
| on: | |
| pull_request: | |
| paths: | |
| - README.md | |
| - CONTEXT.md | |
| - docs/** | |
| - examples/** | |
| - actions/** | |
| - schemas/** | |
| - prompts/** | |
| - roadmap/** | |
| - security/** | |
| - threat-model/** | |
| - .github/workflows/** | |
| - scripts/check-docs.sh | |
| - scripts/roadmap.sh | |
| - scripts/test-roadmap.sh | |
| - scripts/check-execution-trust.sh | |
| - scripts/check-workflow-security.sh | |
| - scripts/test-workflow-security.sh | |
| - scripts/check-baseline-no-exec.sh | |
| - scripts/test-baseline-no-exec.sh | |
| - scripts/check-scanner-gates.sh | |
| - scripts/test-scanner-outcome.sh | |
| - scripts/check-evaluation-result.sh | |
| - scripts/test-evaluation-result.sh | |
| - scripts/test-gitleaks-scan.sh | |
| - scripts/test-zizmor-scan.sh | |
| - scripts/test-consumer-actions-security.sh | |
| - scripts/test-consumer-alpha.sh | |
| - scripts/check-release-graph.sh | |
| - scripts/test-release-graph.sh | |
| - scripts/check-fork-pr.sh | |
| - scripts/test-fork-pr.sh | |
| - test/fixtures/fork-pr/** | |
| - test/fixtures/evaluation-result/** | |
| - test/fixtures/ecosystem-baseline/** | |
| - test/fixtures/actions-security/** | |
| push: | |
| branches: [main] | |
| paths: | |
| - README.md | |
| - CONTEXT.md | |
| - docs/** | |
| - examples/** | |
| - actions/** | |
| - schemas/** | |
| - prompts/** | |
| - roadmap/** | |
| - security/** | |
| - threat-model/** | |
| - .github/workflows/** | |
| - scripts/check-docs.sh | |
| - scripts/roadmap.sh | |
| - scripts/test-roadmap.sh | |
| - scripts/check-execution-trust.sh | |
| - scripts/check-workflow-security.sh | |
| - scripts/test-workflow-security.sh | |
| - scripts/check-baseline-no-exec.sh | |
| - scripts/test-baseline-no-exec.sh | |
| - scripts/check-scanner-gates.sh | |
| - scripts/test-scanner-outcome.sh | |
| - scripts/check-evaluation-result.sh | |
| - scripts/test-evaluation-result.sh | |
| - scripts/test-gitleaks-scan.sh | |
| - scripts/test-zizmor-scan.sh | |
| - scripts/test-consumer-actions-security.sh | |
| - scripts/test-consumer-alpha.sh | |
| - scripts/check-release-graph.sh | |
| - scripts/test-release-graph.sh | |
| - scripts/check-fork-pr.sh | |
| - scripts/test-fork-pr.sh | |
| - test/fixtures/fork-pr/** | |
| - test/fixtures/evaluation-result/** | |
| - test/fixtures/ecosystem-baseline/** | |
| - test/fixtures/actions-security/** | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| documentation-contract: | |
| name: Documentation Contract | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout documentation and examples | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Validate documentation navigation and local links | |
| run: bash scripts/check-docs.sh | |
| - name: Test machine-readable roadmap state | |
| run: bash scripts/test-roadmap.sh | |
| - name: Validate execution-trust classification | |
| run: bash scripts/check-execution-trust.sh | |
| - name: Validate workflow authority and checkout | |
| run: bash scripts/check-workflow-security.sh | |
| - name: Test workflow-security contract | |
| run: bash scripts/test-workflow-security.sh | |
| - name: Validate non-executing baseline workflows | |
| run: bash scripts/check-baseline-no-exec.sh | |
| - name: Test malicious lifecycle-hook fixture | |
| run: bash scripts/test-baseline-no-exec.sh | |
| - name: Validate scanner gate forwarding | |
| run: bash scripts/check-scanner-gates.sh | |
| - name: Test scanner outcome semantics | |
| run: bash scripts/test-scanner-outcome.sh | |
| - name: Test Evaluation Result completion semantics | |
| run: bash scripts/test-evaluation-result.sh | |
| - name: Test generic evaluation adapter lifecycle | |
| run: bash scripts/test-evaluation-adapter.sh | |
| - name: Test Evidence Bundle aggregation | |
| run: bash scripts/test-aggregate-results.sh | |
| - name: Validate Ecosystem Baseline composition and planted fixtures | |
| run: bash scripts/test-ecosystem-baseline.sh | |
| - name: Test secretless fork and history scanning | |
| run: bash scripts/test-gitleaks-scan.sh | |
| - name: Test consumer GitHub Actions security evaluation | |
| run: bash scripts/test-consumer-actions-security.sh | |
| - name: Test consumer alpha installation contract | |
| run: bash scripts/test-consumer-alpha.sh | |
| - name: Validate immutable consumer release graph | |
| run: bash scripts/check-release-graph.sh | |
| - name: Test release graph rejection behavior | |
| run: bash scripts/test-release-graph.sh | |
| - name: Validate fork pull-request boundaries | |
| run: bash scripts/check-fork-pr.sh | |
| - name: Test fork boundary rejection behavior | |
| run: bash scripts/test-fork-pr.sh | |
| - name: Validate shell scripts | |
| run: shellcheck scripts/*.sh actions/*/*.sh actions/*/scripts/*.sh | |
| - name: Validate workflow and example syntax | |
| # actionlint v1.7.12, pinned to the release commit. | |
| run: go run github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca .github/workflows/*.yml examples/*.yml test/fixtures/fork-pr/workflow.yml |