unsafe-patterns-checker.yml

name: Unsafe Patterns Checker
on:
  pull_request:
      types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]

jobs:
  # Prevent security exclusions
  security-exclusions-check:
    runs-on: ubuntu-latest
    steps:
    - name: Check PR
      uses: francesco-giordano/gh-pr-content-checker@v1.0.0
      with:
        diffDoesNotContainRegex: "\\bnosec\\b|\\bnosemgrep\\b"
        skipLabels: skip-security-exclusions-check

  # Prevent the use of recursive deletion.
  recursive-deletion-check:
    runs-on: ubuntu-latest
    steps:
      - name: Check PR (recursive true)
        uses: francesco-giordano/gh-pr-content-checker@v1.0.0
        with:
          diffDoesNotContainRegex: "recursive true"
          skipLabels: skip-recursive-deletion-check
      - name: Check PR (rm -rf)
        uses: francesco-giordano/gh-pr-content-checker@v1.0.0
        with:
          diffDoesNotContainRegex: "rm -rf"
          skipLabels: skip-recursive-deletion-check

  # Prevent bad URL suffix
  bad-url-suffix-check:
    runs-on: ubuntu-latest
    steps:
      - name: Check PR for Disallowed URL Suffixes
        uses: francesco-giordano/gh-pr-content-checker@v1.0.0
        with:
          diffDoesNotContainRegex: "amazonaws\\.com|amazonaws\\.com\\.cn|c2s\\.ic\\.gov|sc2s\\.sgov\\.gov"
          skipLabels: skip-bad-url-suffix-check