update version #326
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # atrium-alto-postprocess — caller for the security reusable workflow | |
| # | |
| # Thin caller (mirrors docker.yml) for ufal/atrium-project's | |
| # security.reusable.yml: Trivy image scan + SBOM + version-check in one. | |
| # Pins @v1 — a moving major tag the maintainer controls, not a branch that | |
| # moves on every hub merge (#18, 2026-07-30). See docs/docker_gha.md §1. | |
| name: Security & Supply-chain | |
| on: | |
| pull_request: | |
| branches: [test, master] | |
| push: | |
| branches: [test, master] | |
| tags: ['v*'] | |
| release: | |
| types: [published] | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly re-scan of the published image (new CVEs land continuously) | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} | |
| # `github.event_name` keeps a push from cancelling the scheduled run: this group was | |
| # keyed by ref alone, so both landed in ONE group and the push won -- and a cancelled | |
| # nightly reports no failure rather than a result. (issue atrium-project#10) | |
| # never cancel a tag build - that is a publish in flight | |
| cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }} | |
| jobs: | |
| security: | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| uses: ufal/atrium-project/.github/workflows/security.reusable.yml@v1 | |
| # No `secrets:` block: security.reusable.yml consumes no secrets at all | |
| # (Trivy/SBOM read a public GHCR image, version-check reads the tree). | |
| # It previously carried `secrets: inherit` for no reason (#18). | |
| with: | |
| # The published image to scan/SBOM. | |
| image-ref: ghcr.io/ufal/atrium-alto-postprocess:latest | |
| citation-path: CITATION.cff | |
| # CRITICAL: this repo stores para_config.txt in the setup folder | |
| para-config-path: setup/para_config.txt |