Repository navigation
ci: add a Plumber check on the workflows with its score badge - #2644
Open
Totara-thib wants to merge 1 commit into
Open
Totara-thib wants to merge 1 commit into
Totara-thib wants to merge 1 commit into
Conversation
A small workflow runs the Plumber CLI on pushes to next and on pull requests. It checks the GitHub workflows for the classes of findings the previous commits fixed (floating action refs, missing permissions, tokens left in checkouts) and fails under 85 points, so one small finding never blocks a pull request. The overlay keeps the built-in defaults and trusts the five actions this repository uses on top of them, all pinned by commit. The README gets the score badge in the badge block.
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follows up on #2632, merged earlier. That PR fixed three classes of findings in the workflows (floating third-party refs, missing token permissions, tokens left in checkouts). This keeps them fixed: a small workflow runs the Plumber CLI on pushes to next and on pull requests and gates at 85 points, so one small finding never blocks a PR.
What
One workflow file, an overlay that keeps the built-in defaults and trusts the five extra actions this repository uses, and the score badge in the README. Internal tooling only, so no changeset.
Score badge: It works like OpenSSF Scorecard's published results: every run publishes the score, the badge shows next, and a failed publish never fails your CI. No token or secret is needed. The badge reads gray UNKNOWN until the first run on next. If you want the check but not the badge, removing the
score-pushline is the whole opt-out.I work on Plumber. If you do not want the tool, no hard feelings, say so and I close this PR, the hardening stands on its own.
Checklist