chore: Update lint.yml to reference in-house security lint GH action
#3228
Conversation
c0db389 to
74a5811
Compare
499006d to
738f9ea
Compare
738f9ea to
1ec7b63
Compare
lint.yml to reference in-house security lint GH actionlint.yml to reference in-house security lint GH action
1ec7b63 to
59b99f2
Compare
.github/workflows/lint.yml
Outdated
| fetch-depth: 0 | ||
| repository: instructlab/ci-actions | ||
| path: ci-actions | ||
| ref: v0.1.0 |
There was a problem hiding this comment.
We have two options for references... We can pin to an actual release, like this one (v0.1.0) or we can pin to a release branch like release-v0.1 to allow for z-stream releases to be automatically consumed. (Note that release-v0.1 is a protected branch and users are not allowed to directly commit to it.)
We cannot use logic liike:
ref: v0.1
to automatically pull in z-stream releases because ref only accepts the following inputs:
- branch name
- SHA
- GitHub tag
In order to reference a GitHub action by a major version (e.g., @v3) or a minor version (e.g., @v3.2), the action needs to be published to the GH marketplace.
There was a problem hiding this comment.
Seems the branch option will be more flexible and require less work on either end - I would prefer that
There was a problem hiding this comment.
+1 to the branch option given the alternatives
Reference the newly-released GH action, `detect-exposed-workflow-secrets`, which is included in `release-v0.1.0`. Also remove the existing reference from the repo. Signed-off-by: Courtney Pacheco <[email protected]>
59b99f2 to
01500fb
Compare
|
@courtneypacheco I think these changes look good. But I have a question on the base template and the markdown file doesn't point to the new changes which are part of this lint.yaml file. Do we also need to update them ? |
|
Hey @kami619 yes, I will update the |
Checklist:
conventional commits.
Background
On Feb 11, 2025, I created an in-house GitHub action called
detect-exposed-secrets: #3112I have since taken the contents of this
detect-exposed-secretsaction and migrated them to ourci-actionsrepo here: https://github.com/instructlab/ci-actions/tree/main/actions/detect-exposed-workflow-secretsDuring this migration process, I also updated name of the action from
detect-exposed-secretstodetect-exposed-workflow-secretsso that the name of the action is accurate. (The original name implied the action might detect any type of exposed secret, when that isn't accurate.)Proposed Changes
ci-actionsrepolint.ymlfile to reference the action from theci-actionsrepo instead of from this repository.'v0.1.0so that any updates to the action are not automatically consumed without anyone's knowledge