20 lines
670 B
Python
20 lines
670 B
Python
#!/usr/bin/env python3
|
|
"""Require immutable commits for third-party Gitea workflow actions."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import re
|
|
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
USE = re.compile(r"^\s*-\s+uses:\s+([^@\s]+)@([^\s#]+)", re.MULTILINE)
|
|
|
|
|
|
for workflow in sorted((ROOT / ".gitea/workflows").glob("*.y*ml")):
|
|
for action, revision in USE.findall(workflow.read_text(encoding="utf-8")):
|
|
if not action.startswith("./") and not re.fullmatch(r"[0-9a-f]{40}", revision):
|
|
raise SystemExit(f"{workflow.relative_to(ROOT)}: mutable action {action}@{revision}")
|
|
|
|
print("Protocol CI action references are immutable")
|