mirror of
https://github.com/storytold/wordcraft.git
synced 2026-11-11 21:12:56 +00:00
Dylan M. Taylor
411a4915a1
Adds step-security/harden-runner (audit, pinned to v2.22.4 like craft-common-actions) as the first step of each job that did not have it, so every workflow in the org's public repos reports its egress to StepSecurity. Audit, not block: block-mode allow lists come from each job's observed traffic.
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
# Quick static checks for the release pipeline (seconds, no Rust build): workflow syntax,
|
|
# packaging shell/PowerShell scripts, and the Linux desktop/AppStream/Flatpak metadata.
|
|
name: Packaging lint
|
|
|
|
on:
|
|
push:
|
|
branches: [main, release]
|
|
paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
|
|
pull_request:
|
|
paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: packaging-lint-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
# Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
|
|
uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
|
|
|
|
windows-install-policy:
|
|
timeout-minutes: 10
|
|
name: Windows installation policy (no app build)
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Harden runner
|
|
uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
|
|
with:
|
|
egress-policy: audit
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install the pinned packaging toolchain
|
|
shell: pwsh
|
|
run: |
|
|
$tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
|
|
dotnet tool install --tool-path $tools wix --version 5.0.2
|
|
if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
|
|
$tools >> $env:GITHUB_PATH
|
|
$policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
|
|
foreach ($extension in @($policy.extensions)) {
|
|
& (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
|
|
if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
|
|
}
|
|
- name: Build and check non-executable installer fixtures
|
|
shell: pwsh
|
|
run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')
|