Fix: #8. Add checkov #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # Run the SuperLinter action with some custom setup. | |
| name: Lint | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| branches: ["main"] | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Super-Linter | |
| uses: super-linter/super-linter@47984f49b4e87383eed97890fe2dca6063bbd9c3 # v8.3.1 | |
| env: | |
| # To report GitHub Actions status checks | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Markdown delegated to pre-commit: | |
| VALIDATE_MARKDOWN: false | |
| VALIDATE_MARKDOWN_PRETTIER: false | |
| # Disabled for conflicts with the isort version used in pre-commit | |
| # you can re-enable it if you align your local isort with | |
| # the one in the super-linter image. | |
| VALIDATE_PYTHON_ISORT: false | |
| VALIDATE_XML: false | |
| VALIDATE_NATURAL_LANGUAGE: false | |
| VALIDATE_YAML: false # YAML delegated to pre-commit | |
| VALIDATE_YAML_PRETTIER: false # YAML delegated to pre-commit | |
| VALIDATE_JSCPD: false # JSCPD is too slow for our codebase | |
| pre-commit: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| container: python:3.12 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # Remove git credentials to prevent | |
| # credentials to be leaked on artifacts. | |
| persist-credentials: false | |
| - name: Run commit hooks. | |
| run: | | |
| pip3 --no-cache-dir install pre-commit | |
| git --version | |
| pwd | |
| ls -la | |
| id | |
| git config --global --add safe.directory "$PWD" | |
| pre-commit install | |
| pre-commit run -a --hook-stage pre-commit | |
| # Store (expiring) logs on failure. | |
| # Retrieve artifacts via `gh run download`. | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| if: failure() | |
| with: | |
| name: pre-commit.log | |
| path: /github/home/.cache/pre-commit/pre-commit.log | |
| retention-days: 5 |