Skip to content

ci: install reusable lint workflow - #1

Merged
topcoder1 merged 2 commits into
mainfrom
ci/install-lint-1777661002
May 2, 2026
Merged

ci: install reusable lint workflow#1
topcoder1 merged 2 commits into
mainfrom
ci/install-lint-1777661002

Conversation

@topcoder1

Copy link
Copy Markdown
Member

Adds actionlint (catches GHA-specific bugs in .github/workflows/*.yml) and prettier --check (markdown glob: **/*.md) on every PR.

Calls the reusable workflow at https://github.com/topcoder1/ci-workflows/blob/main/.github/workflows/lint.yml.

🤖 Installed via install-lint.sh.

ci-bot and others added 2 commits May 1, 2026 11:43
Adds actionlint + prettier --check on PR via topcoder1/ci-workflows.
Table column padding + emphasis style (`*` -> `_`). No prose reflow.

jobs:
lint:
uses: topcoder1/ci-workflows/.github/workflows/lint.yml@main

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Supply-chain risk: mutable ref on external workflow

@main is a mutable branch — if topcoder1/ci-workflows is ever compromised or accidentally force-pushed, this workflow will silently pick up the changed code on the next CI run with no review in this repo.

Pin to an immutable commit SHA instead:

Suggested change
uses: topcoder1/ci-workflows/.github/workflows/lint.yml@main
uses: topcoder1/ci-workflows/.github/workflows/lint.yml@<FULL_40_CHAR_SHA>

Run git ls-remote https://github.com/topcoder1/ci-workflows refs/heads/main to get the current SHA, then keep it in sync via Dependabot (update-type: digest) or a manual bump PR. GitHub's own security hardening guide recommends pinning any uses: that targets code outside the current repo to a full commit SHA.

@claude

claude Bot commented May 1, 2026

Copy link
Copy Markdown

Flagged 1 issue inline: reusable workflow pinned to @main on an external repo — should use a full commit SHA to avoid supply-chain risk. All other changes are markdown prettier normalization with no logic or security concerns.

@topcoder1
topcoder1 merged commit 8306109 into main May 2, 2026
5 checks passed
@topcoder1
topcoder1 deleted the ci/install-lint-1777661002 branch May 2, 2026 00:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant