diff --git a/.github/workflows/quality-checks.yaml b/.github/workflows/quality-checks.yaml index 303cc73..e33ae58 100644 --- a/.github/workflows/quality-checks.yaml +++ b/.github/workflows/quality-checks.yaml @@ -1,9 +1,12 @@ +--- name: 'Quality Checks' -on: pull_request +on: [pull_request] jobs: quality-checks: + name: 'Linters' + # yamllint disable-line rule:line-length uses: garretpatten/quality-checks/.github/workflows/quality-checks.yaml@master with: actionlint_run: true diff --git a/.github/workflows/security-checks.yaml b/.github/workflows/security-checks.yaml new file mode 100644 index 0000000..fd7d40e --- /dev/null +++ b/.github/workflows/security-checks.yaml @@ -0,0 +1,13 @@ +name: 'Security Checks' + +on: pull_request + +jobs: + scans: + name: 'Scans' + # yamllint disable-line rule:line-length + uses: garretpatten/security-checks/.github/workflows/security-checks.yaml@master + with: + semgrep_run: true + trufflehog_run: true + secrets: inherit diff --git a/.github/workflows/semgrep-scan.yaml b/.github/workflows/semgrep-scan.yaml deleted file mode 100644 index 39817d2..0000000 --- a/.github/workflows/semgrep-scan.yaml +++ /dev/null @@ -1,19 +0,0 @@ -name: Semgrep Scan - -permissions: - contents: read - -on: pull_request - -jobs: - semgrep-scan: - name: semgrep-scan - runs-on: ubuntu-latest - container: - image: returntocorp/semgrep - - if: (github.actor != 'dependabot[bot]') - steps: - - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 - - - run: semgrep ci --config=auto diff --git a/.github/workflows/trufflehog-scan.yaml b/.github/workflows/trufflehog-scan.yaml deleted file mode 100644 index b7052f6..0000000 --- a/.github/workflows/trufflehog-scan.yaml +++ /dev/null @@ -1,25 +0,0 @@ -name: Trufflehog Scan - -permissions: - contents: read - -on: pull_request - -jobs: - Trufflehog: - runs-on: ubuntu-latest - - if: ${{ github.actor != 'dependabot[bot]' }} - steps: - - name: Checkout code - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 - with: - fetch-depth: 0 - - - name: Trufflehog - uses: trufflesecurity/trufflehog@58222610ff8ff7a3069d2422276bf28ad52a743f - with: - path: ./ - base: ${{ github.event.repository.default_branch }} - head: HEAD - extra_args: --exclude-paths=.truffleignore --only-verified diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..f67b94e --- /dev/null +++ b/.yamllint @@ -0,0 +1,10 @@ +--- +extends: default + +rules: + line-length: + max: 80 + document-start: disable + truthy: + allowed-values: ['true', 'false', 'on', 'off'] + check-keys: false