From 44b23c058f3eca43d8c7ecfdf6e5bf01b6a0d996 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ianar=C3=A9=20S=C3=A9vi?= Date: Tue, 3 Nov 2026 14:49:41 +0100 Subject: [PATCH 1/3] :recycle: always run betterleaks in git mode --- .github/workflows/_static-analysis.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/_static-analysis.yml b/.github/workflows/_static-analysis.yml index 6ab6f2b9..69f9cdb8 100644 --- a/.github/workflows/_static-analysis.yml +++ b/.github/workflows/_static-analysis.yml @@ -16,27 +16,31 @@ jobs: steps: - uses: actions/checkout@v7 with: + # Betterleaks scans git history across refs, so it needs the full + # history rather than the default shallow clone. fetch-depth: 0 - name: Run Betterleaks - id: betterleaks + id: betterleaks-git continue-on-error: true # version 0.1.0 uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515 with: version: "v1.9.0" + scan-mode: git + report-path: betterleaks-git-report.sarif github-token: ${{ secrets.GITHUB_TOKEN }} - name: Upload Betterleaks report - if: always() uses: actions/upload-artifact@v7 + if: always() with: - name: betterleaks-report - path: betterleaks-report.sarif + name: betterleaks-git-report + path: ${{ steps.betterleaks-git.outputs.report-path }} if-no-files-found: warn - name: Fail if Betterleaks found leaks - if: steps.betterleaks.outcome == 'failure' + if: steps.betterleaks-git.outcome == 'failure' run: exit 1 - name: Set up Python ${{ matrix.python-version }} @@ -71,6 +75,6 @@ jobs: - name: Run all static analysis env: - SKIP: sphinx-html,sphinx-linkcheck + SKIP: betterleaks,sphinx-html,sphinx-linkcheck run: | prek run --all-files From 718247d4485990ac5ee0aace333174b4fb38bddd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ianar=C3=A9=20S=C3=A9vi?= Date: Tue, 3 Nov 2026 16:24:38 +0100 Subject: [PATCH 2/3] add both --- .github/workflows/_static-analysis.yml | 32 ++++++++++++++++++-------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/workflows/_static-analysis.yml b/.github/workflows/_static-analysis.yml index 69f9cdb8..594e05fb 100644 --- a/.github/workflows/_static-analysis.yml +++ b/.github/workflows/_static-analysis.yml @@ -10,9 +10,6 @@ jobs: static-check: name: Run Static Analysis runs-on: ubuntu-latest - strategy: - matrix: - python-version: ["3.12"] steps: - uses: actions/checkout@v7 with: @@ -20,7 +17,7 @@ jobs: # history rather than the default shallow clone. fetch-depth: 0 - - name: Run Betterleaks + - name: Run Betterleaks (git) id: betterleaks-git continue-on-error: true # version 0.1.0 @@ -31,22 +28,37 @@ jobs: report-path: betterleaks-git-report.sarif github-token: ${{ secrets.GITHUB_TOKEN }} + - name: Run Betterleaks (dir) + id: betterleaks-dir + continue-on-error: true + # version 0.1.0 + uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515 + with: + version: "v1.9.0" + scan-mode: dir + report-path: betterleaks-dir-report.sarif + github-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload Betterleaks report uses: actions/upload-artifact@v7 if: always() with: - name: betterleaks-git-report - path: ${{ steps.betterleaks-git.outputs.report-path }} + name: betterleaks-report if-no-files-found: warn + path: | + ${{ steps.betterleaks-git.outputs.report-path }} + ${{ steps.betterleaks-dir.outputs.report-path }} - name: Fail if Betterleaks found leaks - if: steps.betterleaks-git.outcome == 'failure' - run: exit 1 + if: steps.betterleaks-git.outcome == 'failure' || steps.betterleaks-dir.outcome == 'failure' + run: | + echo "Betterleaks reported a failure in at least one scan." + exit 1 - - name: Set up Python ${{ matrix.python-version }} + - name: Set up Python uses: actions/setup-python@v7 with: - python-version: ${{ matrix.python-version }} + python-version: "3.12" - name: Cache dependencies uses: actions/cache@v6 From 87f7580b63c4debde1992467557a8d5bb0cae02a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ianar=C3=A9=20S=C3=A9vi?= Date: Tue, 3 Nov 2026 16:36:50 +0100 Subject: [PATCH 3/3] use shared workflow lint --- .github/workflows/_static-analysis.yml | 24 +++++------------------- .github/workflows/_workflow_lint.yml | 20 -------------------- .github/workflows/pull-request.yml | 2 +- 3 files changed, 6 insertions(+), 40 deletions(-) delete mode 100644 .github/workflows/_workflow_lint.yml diff --git a/.github/workflows/_static-analysis.yml b/.github/workflows/_static-analysis.yml index 594e05fb..cf0ab46e 100644 --- a/.github/workflows/_static-analysis.yml +++ b/.github/workflows/_static-analysis.yml @@ -17,26 +17,14 @@ jobs: # history rather than the default shallow clone. fetch-depth: 0 - - name: Run Betterleaks (git) - id: betterleaks-git + - name: Run Betterleaks + id: betterleaks continue-on-error: true # version 0.1.0 uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515 with: version: "v1.9.0" - scan-mode: git - report-path: betterleaks-git-report.sarif - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Run Betterleaks (dir) - id: betterleaks-dir - continue-on-error: true - # version 0.1.0 - uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515 - with: - version: "v1.9.0" - scan-mode: dir - report-path: betterleaks-dir-report.sarif + report-path: betterleaks-report.sarif github-token: ${{ secrets.GITHUB_TOKEN }} - name: Upload Betterleaks report @@ -45,12 +33,10 @@ jobs: with: name: betterleaks-report if-no-files-found: warn - path: | - ${{ steps.betterleaks-git.outputs.report-path }} - ${{ steps.betterleaks-dir.outputs.report-path }} + path: ${{ steps.betterleaks.outputs.report-path }} - name: Fail if Betterleaks found leaks - if: steps.betterleaks-git.outcome == 'failure' || steps.betterleaks-dir.outcome == 'failure' + if: steps.betterleaks.outcome == 'failure' run: | echo "Betterleaks reported a failure in at least one scan." exit 1 diff --git a/.github/workflows/_workflow_lint.yml b/.github/workflows/_workflow_lint.yml deleted file mode 100644 index 0e09112a..00000000 --- a/.github/workflows/_workflow_lint.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Lint workflows - -on: - workflow_call: - -permissions: - contents: read - -jobs: - actionlint: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - name: Download actionlint - id: get_actionlint - run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) - shell: bash - - name: Run actionlint - run: ${{ steps.get_actionlint.outputs.executable }} -color - shell: bash diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 617b6eac..f174d414 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -9,7 +9,7 @@ permissions: jobs: workflow-lint: - uses: ./.github/workflows/_workflow_lint.yml + uses: mindee/client-lib-actions/.github/workflows/workflow-lint.yml@main static-analysis: uses: ./.github/workflows/_static-analysis.yml needs: workflow-lint