Add context to workflow run in Trivy #212
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ############################################################################### | |
| # _ _ _ _ _____ _ | |
| # | | | | | | | | | __ \(_) | |
| # | | ___ | |__ _ __ | |_| |__ ___ | |__) |_ _ __ _ __ ___ _ __ | |
| # _ | |/ _ \| '_ \| '_ \ | __| '_ \ / _ \ | _ /| | '_ \| '_ \ / _ \ '__| | |
| # | |__| | (_) | | | | | | | | |_| | | | __/ | | \ \| | |_) | |_) | __/ | | |
| # \____/ \___/|_| |_|_| |_| \__|_| |_|\___| |_| \_\_| .__/| .__/ \___|_| | |
| # | | | | | |
| # |_| |_| | |
| # | |
| # Copyright (c) 2024 Claudio André <[email protected]> | |
| # | |
| # This program comes with ABSOLUTELY NO WARRANTY; express or implied. | |
| # | |
| # This program is free software: you can redistribute it and/or modify | |
| # it under the terms of the GNU General Public License as published by | |
| # the Free Software Foundation, as expressed in version 2, seen at | |
| # http://www.gnu.org/licenses/gpl-2.0.html | |
| ############################################################################### | |
| # GitHub Action to check if the PR contains the same thing as the main branch | |
| # More info at https://github.com/openwall/john-packages | |
| --- | |
| name: Branch updated | |
| "on": | |
| pull_request_target: | |
| permissions: | |
| contents: read | |
| jobs: | |
| fork: | |
| runs-on: ubuntu-latest | |
| name: check-fork | |
| outputs: | |
| commit: ${{ steps.context.outputs.commit }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| if: ${{ github.event.pull_request.head.repo.full_name != 'openwall/john-packages' }} | |
| with: | |
| fetch-depth: 0 | |
| repository: "${{ github.event.pull_request.head.repo.full_name }}" | |
| - name: Get fork context | |
| id: context | |
| if: ${{ github.event.pull_request.head.repo.full_name != 'openwall/john-packages' }} | |
| run: | | |
| BASE_COMMIT=$(git merge-base --fork-point origin/main "${{ github.event.pull_request.head.sha }}" || true) | |
| echo "commit=$BASE_COMMIT" >> "$GITHUB_OUTPUT" | |
| validate: | |
| needs: [fork] | |
| runs-on: ubuntu-latest | |
| name: check-updated | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| github.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Validate | |
| run: | | |
| ANCESTOR=1 | |
| if [[ "${{ github.event.pull_request.head.repo.full_name }}" == 'openwall/john-packages' ]]; then | |
| BASE_COMMIT="${{ github.event.pull_request.head.sha }}" | |
| else | |
| BASE_COMMIT="${{ needs.fork.outputs.commit }}" | |
| fi | |
| echo "----------- The difference between working tree and index ------------" | |
| git diff-index origin/main | |
| echo "----------------------------------------------------------------------" | |
| echo "The downward commit is: '$BASE_COMMIT'" | |
| echo "----------------------------------------------------------------------" | |
| if [[ -n "$BASE_COMMIT" ]]; then | |
| ANCESTOR=$(git merge-base --is-ancestor origin/main "$BASE_COMMIT"; echo $?) | |
| fi | |
| if [[ "ANCESTOR" -ne 0 ]]; then | |
| echo "This branch is not up to date with main. Please, update!" | |
| exit 1 | |
| fi |