docs: correct the document outline, and say what crawlers may do #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # snare's own CI. Deliberately does NOT call the reusable workflow: that one | |
| # pulls snare from @main, which would test the published version rather than | |
| # the change under review. A PR must be validated by its own code. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Every script parses | |
| run: | | |
| for f in bin/snare lib/*.sh install.sh; do bash -n "$f" || exit 1; done | |
| echo "all scripts parse" | |
| # A two-minute shellcheck pass found a guard evasion hole that eight | |
| # rounds of manual review had missed. Keep it from coming back. | |
| - name: shellcheck | |
| run: | | |
| sudo apt-get install -y shellcheck >/dev/null 2>&1 || sudo apt-get update -qq && sudo apt-get install -y shellcheck >/dev/null 2>&1 | |
| shellcheck --version | |
| shellcheck -S warning bin/snare lib/*.sh install.sh | |
| # The shield snippet lives inside a heredoc, so neither `bash -n` nor | |
| # shellcheck ever parses it. A deleted if-body slipped through exactly | |
| # that gap. Validate the generated output itself. | |
| - name: Generated shield snippet is valid shell | |
| run: | | |
| chmod +x bin/snare | |
| ./bin/snare shield print > /tmp/snippet.sh | |
| bash -n /tmp/snippet.sh | |
| shellcheck -S warning -s bash /tmp/snippet.sh | |
| echo "snippet is valid" | |
| # help drifted: eight accepted subcommands were undocumented, including | |
| # `scan repo --new`, the only way to use the baseline feature help does | |
| # advertise. Fail the build if a dispatched command is missing from help. | |
| - name: Help documents every command | |
| run: | | |
| chmod +x bin/snare | |
| help_out="$(./bin/snare help 2>&1)" | |
| missing=0 | |
| for c in guard scan fix notify doctor update selftest report schedule \ | |
| baseline hook shield ci rotate version help; do | |
| echo "$help_out" | grep -q "snare $c" || { echo "::error::'$c' is dispatched but absent from snare help"; missing=1; } | |
| done | |
| [ "$missing" = 0 ] && echo "help covers every top-level command" | |
| exit $missing | |
| - name: Detection works (selftest) | |
| run: | | |
| chmod +x bin/snare | |
| ./bin/snare selftest | |
| # Scan snare with the code from this PR, from outside the tree so the | |
| # scanner is not scanning itself. | |
| - name: Scan this checkout | |
| run: | | |
| cp -r . "$RUNNER_TEMP/snare-tool" | |
| chmod +x "$RUNNER_TEMP/snare-tool/bin/snare" | |
| set +e | |
| "$RUNNER_TEMP/snare-tool/bin/snare" scan repo . | tee /tmp/scan.txt | |
| set -e | |
| n=$(grep -c '\[!\]' /tmp/scan.txt || true) | |
| if [ "${n:-0}" -ne 0 ]; then | |
| echo "::error::snare reported $n finding(s) against its own tree" | |
| exit 1 | |
| fi | |
| echo "clean" | |
| # Prove the reusable workflow other people depend on still works end to end. | |
| reusable: | |
| uses: ./.github/workflows/scan.yml | |
| with: | |
| snare-ref: ${{ github.head_ref || github.ref_name }} |