✨ Pull request support for GitHub action #1222
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
laurentsimon
force-pushed
the
feat/actionpr
branch
from
7ea466a to
139b1fd
Compare
actions/Dockerfile
Outdated
| @@ -12,9 +12,8 @@ | |||
| # See the License for the specific language governing permissions and | |||
| # limitations under the License. | |||
|
|
|||
| # Testing: docker run -e INPUT_SARIF_FILE=results.sarif -e GITHUB_WORKSPACE=/ -e INPUT_POLICY_FILE="/policy.yml" -e INPUT_REPO_TOKEN=$GITHUB_AUTH_TOKEN -e GITHUB_REPOSITORY="ossf/scorecard" laurentsimon/scorecard-action:latest | |||
| # Testing: docker run -e GITHUB_EVENT_NAME=pull_request -e INPUT_SARIF_FILE=results.sarif -e GITHUB_WORKSPACE=/ -e INPUT_POLICY_FILE="/policy.yml" -e INPUT_REPO_TOKEN=$GITHUB_AUTH_TOKEN -e GITHUB_REPOSITORY="ossf/scorecard" laurentsimon/scorecard-action:latest | |||
There was a problem hiding this comment.
This is not part of this PR. But could we also please change the base image. This reduces the attack vector.
There was a problem hiding this comment.
Distroless images don't support shell. So to use distroless, we need to remove the shell script and create another golang project to call as a binary. Doable, but needs some work.
We also have this tracking issue #1072
laurentsimon
force-pushed
the
feat/actionpr
branch
from
1194c68 to
de8b0b0
Compare
laurentsimon
changed the title
azeemshaikh38
approved these changes
Nov 8, 2021
ristomcgehee
approved these changes
Nov 8, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds support for pull request in the GH action.
No breaking changes.
The changes required updating how we generate our SARIF results.
This github/codeql-action#811 is an improvement that would be nice, but non-blocking.