mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.20.0 to 2.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.21.0</h2> <h2>What's Changed</h2> <ul> <li>Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.</li> <li>Improved Support for AWS CodeBuild GitHub Actions Runners.</li> <li>Bug fixes.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0">https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0</a></p> <h2>v2.20.1</h2> <h2>What's Changed</h2> <ul> <li>AWS CodeBuild-hosted runner support</li> <li>Implicitly allow single-labeled (internal) domains in block-mode</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1">https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/05e31511f85b41b11d1cf0ef85d0992719546e2c"><code>05e3151</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/684">#684</a> from step-security/rc-42</li> <li><a href="https://github.com/step-security/harden-runner/commit/0f37afa338f57c61ee3dfc274daca8834963d83e"><code>0f37afa</code></a> fix: ignore denied-endpoints on non-enterprise tier</li> <li><a href="https://github.com/step-security/harden-runner/commit/93b58ee491c5b6cf3a5324966fca2908f8d447f3"><code>93b58ee</code></a> fix: resolve cache host read-first and never downgrade egress policy</li> <li><a href="https://github.com/step-security/harden-runner/commit/e7399dd3e93d6c159d314af54b4704bc48abf6bc"><code>e7399dd</code></a> fix: align deny-list mode detection with agent and log when both endpoint inp...</li> <li><a href="https://github.com/step-security/harden-runner/commit/c16689f716a10cdfd9cfe22e63938b8c6c0657de"><code>c16689f</code></a> test: add denied_endpoints to Configuration fixtures and cover deny-list merge</li> <li><a href="https://github.com/step-security/harden-runner/commit/40b99cf0c7161e4dcdc6c5508927188b65028df9"><code>40b99cf</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/682">#682</a> from rohan-stepsecurity/rp/feat/codebuild-self-v2</li> <li><a href="https://github.com/step-security/harden-runner/commit/fedec027a205365a7d64001a81931e4c36a1af6e"><code>fedec02</code></a> Merge branch 'rc-42' into rp/feat/codebuild-self-v2</li> <li><a href="https://github.com/step-security/harden-runner/commit/5361fb178b926b2be6df52e11ee257823821567b"><code>5361fb1</code></a> feat: add build artifacts</li> <li><a href="https://github.com/step-security/harden-runner/commit/286474fffe0b8fe7c9db855f132d04a9b48ab564"><code>286474f</code></a> feat: Support Bravo agent install on CodeBuild runners</li> <li><a href="https://github.com/step-security/harden-runner/commit/051ec05283d064bd82f41279db4f70f0717bf778"><code>051ec05</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/683">#683</a> from h0x0er/jatin/deny-list</li> <li>Additional commits viewable in <a href="https://github.com/step-security/harden-runner/compare/v2.20.0...05e31511f85b41b11d1cf0ef85d0992719546e2c">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
153 lines
4.9 KiB
YAML
153 lines
4.9 KiB
YAML
name: PR conflict labeler
|
|
|
|
on:
|
|
pull_request_target:
|
|
types:
|
|
- opened
|
|
- reopened
|
|
- synchronize
|
|
- edited
|
|
- ready_for_review
|
|
schedule:
|
|
- cron: "17 */6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: pr-conflict-labeler-${{ github.event.pull_request.number || 'all-open-prs' }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
CONFLICT_LABEL: "has conflicts"
|
|
|
|
jobs:
|
|
label-conflicts:
|
|
name: Label conflicted PRs
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read # actions/checkout
|
|
issues: write # get/create the repo-level conflict label
|
|
pull-requests: write # pulls.get/list plus add/remove the label on PRs
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Check out the repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Apply conflict label
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
github-token: ${{ github.token }}
|
|
script: |
|
|
const conflictLabel = process.env.CONFLICT_LABEL;
|
|
const owner = context.repo.owner;
|
|
const repo = context.repo.repo;
|
|
const eventPullRequest = context.payload.pull_request;
|
|
|
|
async function sleep(ms) {
|
|
await new Promise((resolve) => setTimeout(resolve, ms));
|
|
}
|
|
|
|
async function getPullRequestWithMergeableState(pullNumber) {
|
|
for (let attempt = 1; attempt <= 6; attempt += 1) {
|
|
const { data: pull } = await github.rest.pulls.get({
|
|
owner,
|
|
repo,
|
|
pull_number: pullNumber,
|
|
});
|
|
|
|
if (pull.mergeable !== null) {
|
|
return pull;
|
|
}
|
|
|
|
core.info(`PR #${pullNumber}: mergeable is not ready yet (attempt ${attempt}/6).`);
|
|
await sleep(5000);
|
|
}
|
|
|
|
const { data: pull } = await github.rest.pulls.get({
|
|
owner,
|
|
repo,
|
|
pull_number: pullNumber,
|
|
});
|
|
return pull;
|
|
}
|
|
|
|
async function ensureConflictLabel() {
|
|
try {
|
|
await github.rest.issues.getLabel({
|
|
owner,
|
|
repo,
|
|
name: conflictLabel,
|
|
});
|
|
} catch (error) {
|
|
if (error.status !== 404) {
|
|
throw error;
|
|
}
|
|
|
|
await github.rest.issues.createLabel({
|
|
owner,
|
|
repo,
|
|
name: conflictLabel,
|
|
color: 'D93F0B',
|
|
description: 'Pull request has merge conflicts with the base branch',
|
|
});
|
|
core.info(`Created '${conflictLabel}' label.`);
|
|
}
|
|
}
|
|
|
|
async function labelPullRequest(pull) {
|
|
const existingLabels = pull.labels.map((label) => label.name);
|
|
const hasConflictLabel = existingLabels.includes(conflictLabel);
|
|
const hasConflicts = pull.mergeable === false && pull.mergeable_state === 'dirty';
|
|
|
|
if (hasConflicts && !hasConflictLabel) {
|
|
await github.rest.issues.addLabels({
|
|
owner,
|
|
repo,
|
|
issue_number: pull.number,
|
|
labels: [conflictLabel],
|
|
});
|
|
core.info(`Added '${conflictLabel}' to PR #${pull.number}.`);
|
|
return;
|
|
}
|
|
|
|
if (!hasConflicts && hasConflictLabel) {
|
|
await github.rest.issues.removeLabel({
|
|
owner,
|
|
repo,
|
|
issue_number: pull.number,
|
|
name: conflictLabel,
|
|
});
|
|
core.info(`Removed '${conflictLabel}' from PR #${pull.number}.`);
|
|
return;
|
|
}
|
|
|
|
core.info(`PR #${pull.number}: no label change needed (mergeable=${pull.mergeable}, mergeable_state=${pull.mergeable_state}).`);
|
|
}
|
|
|
|
await ensureConflictLabel();
|
|
|
|
let pullNumbers;
|
|
if (eventPullRequest) {
|
|
pullNumbers = [eventPullRequest.number];
|
|
} else {
|
|
const pulls = await github.paginate(github.rest.pulls.list, {
|
|
owner,
|
|
repo,
|
|
state: 'open',
|
|
per_page: 100,
|
|
});
|
|
pullNumbers = pulls.map((pull) => pull.number);
|
|
core.info(`Checking ${pullNumbers.length} open PR(s).`);
|
|
}
|
|
|
|
for (const pullNumber of pullNumbers) {
|
|
const pull = await getPullRequestWithMergeableState(pullNumber);
|
|
await labelPullRequest(pull);
|
|
}
|