ai-space/goose
3
0
Fork 0
mirror of https://github.com/aaif-goose/goose.git synced 2026-07-03 14:10:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

patching recipe scanning workflows for permissions changes (#4579)

Browse Source
This commit is contained in:
w. ian douglas
2025-09-09 13:04:34 -06:00
committed by GitHub
parent 2080425d9a
commit e575124cc4
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/recipe-security-scanner.yml
+7
View File
@@ -13,6 +13,7 @@ concurrency:
permissions:
contents: read
pull-requests: write
issues: write
statuses: write
jobs:
@@ -140,6 +141,12 @@ jobs:
# Set permissions for Docker container (scanner user is UID 1000)
sudo chmod -R 777 "$OUT" || true
# Verify secrets are available (without logging details)
if [ -z "$OPENAI_API_KEY" ] || [ -z "$TRAINING_DATA_LOW" ] || [ -z "$TRAINING_DATA_MEDIUM" ] || [ -z "$TRAINING_DATA_EXTREME" ]; then
echo "❌ One or more required secrets are missing or inaccessible"
exit 1
fi
# Initialize overall scan results
echo '{"scanned_recipes": [], "overall_status": "UNKNOWN", "failed_scans": 0}' > "$OUT/pr_scan_summary.json"
.github/workflows/validate-recipe-pr.yml
+2 -1
View File
@@ -9,6 +9,7 @@ on:
permissions:
contents: read
pull-requests: write
issues: write
jobs:
validate-recipe:
@@ -158,7 +159,7 @@ jobs:
# Check if this is a new file or an update to existing file
# Get list of changed files in this PR compared to base branch
CHANGED_FILES=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD | grep "^$RECIPE_FILE$" || true)
CHANGED_FILES=$(git diff --name-only --diff-filter=AM origin/${{ github.event.pull_request.base.ref }}...HEAD | grep "^$RECIPE_FILE$" || true)
EXISTING_FILES=$(find documentation/src/pages/recipes/data/recipes/ -name "$FILENAME.yaml" -o -name "$FILENAME.yml" | grep -v "^$RECIPE_FILE$" || true)
if [ -n "$EXISTING_FILES" ] && [ -z "$CHANGED_FILES" ]; then