fix(ci): grant the secret-scanner reusable its required job permissions #216
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Seambot - Seam hygiene and integration health | |
| # Part of gitbot-fleet (hyperpolymath/gitbot-fleet :: bots/seambot) | |
| name: Seambot Integration Health | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| # Pinned gitbot-fleet commit. Bump in lockstep when the fleet changes. | |
| GITBOT_FLEET_REF: 2e0ea3ca67821a91e650f51bf48a6cfd1c7aae1c | |
| jobs: | |
| seam-health: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - name: Check for seam register | |
| id: check-seam | |
| run: | | |
| if [ -f spec/seams/seam-register.json ]; then | |
| echo "has_seam=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "has_seam=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Setup Rust toolchain | |
| if: steps.check-seam.outputs.has_seam == 'true' | |
| uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable | |
| with: | |
| toolchain: stable | |
| # Clone BEFORE the rust-cache step: rust-cache needs the workspace | |
| # (Cargo.lock) to exist to key the cache, and cloning into a | |
| # cache-created directory fails with `destination path ... already | |
| # exists and is not an empty directory` (exit 128). | |
| - name: Fetch gitbot-fleet at pinned ref | |
| if: steps.check-seam.outputs.has_seam == 'true' | |
| run: | | |
| rm -rf "$RUNNER_TEMP/gitbot-fleet" | |
| git clone --no-checkout --filter=tree:0 \ | |
| https://github.com/hyperpolymath/gitbot-fleet.git \ | |
| "$RUNNER_TEMP/gitbot-fleet" | |
| git -C "$RUNNER_TEMP/gitbot-fleet" checkout "$GITBOT_FLEET_REF" | |
| - name: Cache dependencies | |
| if: steps.check-seam.outputs.has_seam == 'true' | |
| uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2 | |
| with: | |
| workspaces: ${{ runner.temp }}/gitbot-fleet/bots/seambot | |
| - name: Build seambot | |
| if: steps.check-seam.outputs.has_seam == 'true' | |
| working-directory: ${{ runner.temp }}/gitbot-fleet/bots/seambot | |
| env: | |
| OPENSSL_NO_VENDOR: 1 | |
| run: cargo build --release | |
| - name: Run seambot check | |
| if: steps.check-seam.outputs.has_seam == 'true' | |
| id: seambot | |
| continue-on-error: true | |
| run: | | |
| # A non-zero check is the intended signal; capture it without | |
| # letting `set -e` abort before the exit-code file is written. | |
| rc=0 | |
| "$RUNNER_TEMP/gitbot-fleet/bots/seambot/target/release/seambot" check \ | |
| > seambot-results.txt 2>&1 || rc=$? | |
| echo "$rc" > seambot-exit-code.txt | |
| exit "$rc" | |
| - name: Display results | |
| if: always() && steps.check-seam.outputs.has_seam == 'true' | |
| run: | | |
| if [ -f seambot-results.txt ]; then | |
| echo "## Seambot Integration Health Results" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| cat seambot-results.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| exit_code=$(cat seambot-exit-code.txt 2>/dev/null || echo unknown) | |
| if [ "$exit_code" = "0" ]; then | |
| echo "✅ All seam checks passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ Seam checks failed (exit code: $exit_code)" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| fi | |
| - name: Skip message | |
| if: steps.check-seam.outputs.has_seam == 'false' | |
| run: | | |
| echo "## Seambot - Skipped" >> $GITHUB_STEP_SUMMARY | |
| echo "No spec/seams/seam-register.json found. Seambot checks are not applicable to this repository." >> $GITHUB_STEP_SUMMARY | |
| - name: Upload results | |
| if: always() && steps.check-seam.outputs.has_seam == 'true' | |
| uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4 | |
| with: | |
| name: seambot-results | |
| path: seambot-results.txt | |
| if-no-files-found: ignore |