Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(PR-41): add a shared CI standard checks workflow #66

Merged
merged 8 commits into from
Jan 10, 2024
Merged
34 changes: 34 additions & 0 deletions .github/workflows/ci-standard-checks-workflow.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
name: CI Standard Checks Workflow

on:
workflow_call:
secrets:
GH_TOKEN:
required: true
inputs:
skipChecks:
type: string
required: false
default: ''
description: 'Checks to be skipped'
enableChecks:
type: string
required: false
default: ''
description: 'Optional checks to enable'

jobs:
ci-standard-checks:
runs-on:
- ubuntu-latest
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:chefs-kiss: This is the most important part of the change, now using GH hosted runners for this workflow

steps:
- name: Check Out Source Code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: CI Standard Checks
uses: Typeform/ci-standard-checks@v1
with:
githubToken: ${{ secrets.GH_TOKEN }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that for this use case we can use the token with minimum privileges that is generated per repository (GITHUB_TOKEN) instead of this Organization wide secret GH_TOKEN which corresponds to a PAT from a user with lots of privileges. See GitHub's security hardening guidelines.

Suggested change
githubToken: ${{ secrets.GH_TOKEN }}
githubToken: ${{ secrets.GITHUB_TOKEN }}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, thanks!

skipChecks: ${{ inputs.skipChecks }}
enableChecks: ${{ inputs.enableChecks }}
1 change: 1 addition & 0 deletions reusable-workflows/ci-standard-checks/workflow.yaml
Loading