Skip to content

Commit

Permalink
✨ broaden job matcher for semantic release (#3506)
Browse files Browse the repository at this point in the history
* feat: broaden job matcher for semantic release

Signed-off-by: secustor <[email protected]>

* tests(checks/permissions): add tests for semantic release if using pnpm and yarn

Signed-off-by: secustor <[email protected]>

---------

Signed-off-by: secustor <[email protected]>
  • Loading branch information
secustor authored Oct 4, 2023
1 parent 3785f9c commit a9e2505
Show file tree
Hide file tree
Showing 4 changed files with 82 additions and 2 deletions.
24 changes: 23 additions & 1 deletion checks/permissions_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,7 @@ func TestGithubTokenPermissions(t *testing.T) {
},
},
{
name: "release workflow contents write semantic-release",
name: "release workflow contents write semantic-release with npx",
filenames: []string{"./testdata/.github/workflows/github-workflow-permissions-contents-writes-release-semantic-release.yaml"},
expected: scut.TestReturn{
Error: nil,
Expand All @@ -290,6 +290,28 @@ func TestGithubTokenPermissions(t *testing.T) {
NumberOfDebug: 4,
},
},
{
name: "release workflow contents write semantic-release with yarn command",
filenames: []string{"./testdata/.github/workflows/github-workflow-permissions-contents-writes-release-semantic-release-yarn.yaml"},
expected: scut.TestReturn{
Error: nil,
Score: checker.MaxResultScore,
NumberOfWarn: 0,
NumberOfInfo: 2,
NumberOfDebug: 4,
},
},
{
name: "release workflow contents write semantic-release with pnpm and dlx",
filenames: []string{"./testdata/.github/workflows/github-workflow-permissions-contents-writes-release-semantic-release-pnpm.yaml"},
expected: scut.TestReturn{
Error: nil,
Score: checker.MaxResultScore,
NumberOfWarn: 0,
NumberOfInfo: 2,
NumberOfDebug: 4,
},
},
{
name: "package workflow write",
filenames: []string{"./testdata/.github/workflows/github-workflow-permissions-packages-writes.yaml"},
Expand Down
2 changes: 1 addition & 1 deletion checks/raw/permissions.go
Original file line number Diff line number Diff line change
Expand Up @@ -473,7 +473,7 @@ func isReleasingWorkflow(workflow *actionlint.Workflow, fp string, pdata *permis
// Commonly JavaScript packages, but supports multiple ecosystems
Steps: []*fileparser.JobMatcherStep{
{
Run: "npx.*semantic-release",
Run: "(npx|pnpm|yarn).*semantic-release",
},
},
LogText: "candidate publishing workflow using semantic-release",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Copyright 2022 Security Scorecard Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: semantic-release release workflow
on: [push]
permissions:

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v3
- name: semantic-release
run: yarn -s semantic-release
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Copyright 2022 Security Scorecard Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: semantic-release release workflow
on: [push]
permissions:

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v3
- name: semantic-release
run: pnpm dlx semantic-release
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

0 comments on commit a9e2505

Please sign in to comment.