chore(deps): Update GitHub Actions #118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================ | |
| # Shell Script Tests | |
| # ============================================================================ | |
| # Runs bats tests for scripts/ whenever shell scripts or tests change. | |
| # | |
| # Requirements: | |
| # - bats-core, bats-support, bats-assert submodules in tests/libs/ | |
| # - jq installed (used by stub helpers in tests) | |
| # | |
| # Run locally: | |
| # git submodule update --init --recursive | |
| # ./tests/libs/bats-core/bin/bats tests/*.bats | |
| # ============================================================================ | |
| name: Shell Tests | |
| on: | |
| push: | |
| paths: | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - '.github/workflows/shell-tests.yml' | |
| pull_request: | |
| paths: | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - '.github/workflows/shell-tests.yml' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| bats: | |
| name: Bats Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| submodules: recursive | |
| - name: Run bats tests | |
| # Discover all .bats files under tests/ rather than naming a single | |
| # file. Naming tests/update-pinned-actions.bats hid a class of bugs: | |
| # tests added under tests/fleet-audit-sha-pins.bats (and any future | |
| # *.bats sibling) were never executed by CI, so STRICT_AUDIT and | |
| # REPO_LIMIT regressions could ship green. find + -print0/-exec keeps | |
| # this glob-injection-safe and POSIX-clean. | |
| run: | | |
| find tests -maxdepth 1 -name '*.bats' -print0 \ | |
| | xargs -0 ./tests/libs/bats-core/bin/bats |