[security] Reserve spike/system/* from substring policy matches (#301)
#32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docs Link Check | |
| on: | |
| pull_request: | |
| paths: | |
| - "docs/**" | |
| - "docs-src/**" | |
| - ".github/workflows/docs-link-check.yaml" | |
| - ".lychee.toml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "docs/**" | |
| - "docs-src/**" | |
| - ".github/workflows/docs-link-check.yaml" | |
| - ".lychee.toml" | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| lychee: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Restore lychee cache for pull requests | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: actions/cache@v4 | |
| with: | |
| path: .lycheecache | |
| key: cache-lychee-pr-${{ runner.os }}-${{ github.sha }} | |
| restore-keys: cache-lychee-pr-${{ runner.os }}- | |
| - name: Restore lychee cache for production checks | |
| if: ${{ github.event_name == 'push' }} | |
| uses: actions/cache@v4 | |
| with: | |
| path: .lycheecache | |
| key: cache-lychee-production-${{ runner.os }}-${{ github.sha }} | |
| restore-keys: cache-lychee-production-${{ runner.os }}- | |
| - name: Generate pull request lychee config | |
| if: ${{ github.event_name == 'pull_request' }} | |
| run: | | |
| cat > lychee-pr.toml <<EOF | |
| timeout = 60 | |
| max_retries = 3 | |
| retry_wait_time = 3 | |
| exclude_mail = true | |
| exclude_all_private = true | |
| accept = [200, 206, 403, 429] | |
| root_dir = "${GITHUB_WORKSPACE}/docs" | |
| index_files = ["index.html"] | |
| remap = [ | |
| '^https://spike\.ist/?$ file://${GITHUB_WORKSPACE}/docs/index.html', | |
| '^https://spike\.ist/(.*)$ file://${GITHUB_WORKSPACE}/docs/\$1', | |
| '^/+(.*)$ file://${GITHUB_WORKSPACE}/docs/\$1', | |
| '^file://.*/docs/(.*)$ file://${GITHUB_WORKSPACE}/docs/\$1', | |
| ] | |
| EOF | |
| - name: Link Checker for pull requests | |
| if: ${{ github.event_name == 'pull_request' }} | |
| id: lychee | |
| uses: lycheeverse/lychee-action@v2 | |
| with: | |
| args: >- | |
| --config ${{ github.workspace }}/lychee-pr.toml | |
| --cache --max-cache-age 1d | |
| docs | |
| format: markdown | |
| output: ./lychee/out.md | |
| fail: false | |
| - name: Link Checker for production | |
| if: ${{ github.event_name == 'push' }} | |
| id: lychee-production | |
| uses: lycheeverse/lychee-action@v2 | |
| with: | |
| args: >- | |
| --base-url https://spike.ist | |
| --cache --max-cache-age 1d | |
| --timeout 60 --max-retries 3 --retry-wait-time 3 | |
| --accept 200,206,403,429 | |
| docs | |
| format: markdown | |
| output: ./lychee/out.md | |
| fail: false | |
| - name: Upload report artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: lychee-report | |
| path: ./lychee/out.md | |
| - name: Comment on PR with report | |
| if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }} | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| with: | |
| path: ./lychee/out.md |