Documentation
¶
Overview ¶
Package workflow reads GitHub Actions workflow files: the repo guards, secrets and push triggers the CI audit reports, and the guard rewrite the gate applies to its CI candidate. It knows nothing of git or the forge.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsPushSkip ¶
IsPushSkip reports whether expr holds the advised push guard for the public repo, so it skips every push run outside that repo.
func IsWorkflowPath ¶
IsWorkflowPath reports whether GitHub Actions reads path as a workflow: a .yml or .yaml file directly under .github/workflows.
Types ¶
type File ¶
type File struct {
Path string
Guards []Guard
Secrets []string
Inherit []string
Environments []string
// PushGuarded is true when every job has an if: holding the advised
// push guard (github.event_name != 'push' || github.repository ==
// '<public>'), so a push outside the public repo runs none of them.
PushGuarded bool
// contains filtered or unexported fields
}
File is what the CI audit needs from one workflow file.
func Parse ¶
Parse reads one workflow file. A file that is not valid YAML returns the parse error; GitHub reports such files itself.
func (File) PushTriggered ¶
PushTriggered reports whether a push to any of branches starts this workflow. A pattern it can't evaluate exactly counts as a match, so the audit errs toward reporting.
type Guard ¶
type Guard struct {
Path string `json:"path"`
Job string `json:"job"`
Step *string `json:"step"`
Expr string `json:"expr"`
Rewritable bool `json:"rewritable"`
}
Guard is one if: that compares the running repo with the public repo, so it skips in the shadow repo unless rewritten.
func Rewrite ¶
Rewrite widens every rewritable guard in src so it also matches the shadow repo. Only the bytes of those if: values change. The result is parsed again: unless every other value is unchanged and each if: reads exactly as intended, Rewrite returns src and reports every guard unrewritable. The same src and names always give the same bytes. The error is only ever src's YAML parse error.
type GuardReport ¶
type GuardReport struct {
Mode string `json:"mode"`
Rewritten []Guard `json:"rewritten"`
Unrewritable []Guard `json:"unrewritable"`
// Skipped are rewritable guards left as they are because
// ci.rewrite_repo_guards is warn, so their jobs skip in the shadow repo
// too. Nil in a plan written before 0.9.
Skipped []Guard `json:"skipped"`
}
GuardReport is what the gate did with a candidate's guards.
Source Files