mirror of
https://github.com/neondatabase/neon.git
synced 2025-12-26 15:49:58 +00:00
902d361107
### Summary I'm fixing one or more of the following CI/CD misconfigurations to improve security. Please feel free to leave a comment if you think the current permissions for the GITHUB_TOKEN should not be restricted so I can take a note of it as accepted behaviour. - Restrict permissions for GITHUB_TOKEN - Add step-security/harden-runner - Pin Actions to a full length commit SHA ### Security Fixes will fix https://github.com/neondatabase/cloud/issues/26141
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
name: Fast forward merge
|
|
on:
|
|
pull_request:
|
|
types: [labeled]
|
|
branches:
|
|
- release
|
|
- release-proxy
|
|
- release-compute
|
|
|
|
jobs:
|
|
fast-forward:
|
|
if: ${{ github.event.label.name == 'fast-forward' }}
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Remove fast-forward label to PR
|
|
env:
|
|
GH_TOKEN: ${{ secrets.CI_ACCESS_TOKEN }}
|
|
run: |
|
|
gh pr edit ${{ github.event.pull_request.number }} --repo "${GITHUB_REPOSITORY}" --remove-label "fast-forward"
|
|
|
|
- name: Fast forwarding
|
|
uses: sequoia-pgp/fast-forward@ea7628bedcb0b0b96e94383ada458d812fca4979
|
|
# See https://docs.github.com/en/graphql/reference/enums#mergestatestatus
|
|
if: ${{ contains(fromJSON('["clean", "unstable"]'), github.event.pull_request.mergeable_state) }}
|
|
with:
|
|
merge: true
|
|
comment: on-error
|
|
github_token: ${{ secrets.CI_ACCESS_TOKEN }}
|
|
|
|
- name: Comment if mergeable_state is not clean
|
|
if: ${{ !contains(fromJSON('["clean", "unstable"]'), github.event.pull_request.mergeable_state) }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.CI_ACCESS_TOKEN }}
|
|
run: |
|
|
gh pr comment ${{ github.event.pull_request.number }} \
|
|
--repo "${GITHUB_REPOSITORY}" \
|
|
--body "Not trying to forward pull-request, because \`mergeable_state\` is \`${{ github.event.pull_request.mergeable_state }}\`, not \`clean\` or \`unstable\`."
|