ci: install reusable lint workflow - #1
Conversation
Adds actionlint + prettier --check on PR via topcoder1/ci-workflows.
Table column padding + emphasis style (`*` -> `_`). No prose reflow.
|
|
||
| jobs: | ||
| lint: | ||
| uses: topcoder1/ci-workflows/.github/workflows/lint.yml@main |
There was a problem hiding this comment.
Supply-chain risk: mutable ref on external workflow
@main is a mutable branch — if topcoder1/ci-workflows is ever compromised or accidentally force-pushed, this workflow will silently pick up the changed code on the next CI run with no review in this repo.
Pin to an immutable commit SHA instead:
| uses: topcoder1/ci-workflows/.github/workflows/lint.yml@main | |
| uses: topcoder1/ci-workflows/.github/workflows/lint.yml@<FULL_40_CHAR_SHA> |
Run git ls-remote https://github.com/topcoder1/ci-workflows refs/heads/main to get the current SHA, then keep it in sync via Dependabot (update-type: digest) or a manual bump PR. GitHub's own security hardening guide recommends pinning any uses: that targets code outside the current repo to a full commit SHA.
|
Flagged 1 issue inline: reusable workflow pinned to |
Adds
actionlint(catches GHA-specific bugs in.github/workflows/*.yml) andprettier --check(markdown glob:**/*.md) on every PR.Calls the reusable workflow at https://github.com/topcoder1/ci-workflows/blob/main/.github/workflows/lint.yml.
🤖 Installed via install-lint.sh.