Skip to content

Commit e9e1693

Browse files
snazysnazy
committed
Move to top-level folder, adapt README
1 parent 94597be commit e9e1693

4 files changed

Lines changed: 145 additions & 84 deletions

File tree

‎.github/workflows/check-project-actions.yml‎

Lines changed: 0 additions & 62 deletions
This file was deleted.

‎README.md‎

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,10 @@ This repository hosts GitHub Actions developed by the ASF community and approved
1616

1717
You can let your CI workflows check if the Actions used in your project are approved for use in the ASF.
1818

19-
Either create a new workflow in your project repository, e.g. `.github/workflows/check-project-actions.yml`,
20-
like the following example, or call the workflow from a job from your existing CI workflow in your repository.
19+
An example workflow that can be used as a template for your project's CI can be found
20+
[here `check-actions-usage/sample-ci-workflow.yml`](check-actions-usage/sample-ci-workflow.yml).
2121

22-
```yaml
23-
name: Check action references
24-
on:
25-
workflow_dispatch:
26-
push:
27-
branches:
28-
- main
29-
paths:
30-
- ".github/**"
31-
pull_request:
32-
paths:
33-
- ".github/**"
34-
jobs:
35-
# This is the job that verifies your project's usage of approved GitHub actions
36-
check:
37-
name: Check actions usage
38-
uses: apache/infrastructure-actions/.github/workflows/check-project-actions.yml@main
39-
```
40-
41-
When calling the `check-project-actions` from a `push` or `pull_request` event, the workflow should work
22+
When calling the `check-project-actions` workflow from a `push` or `pull_request` event, it should work
4223
automatically against the "right" reference.
4324

4425
You can also pass the `repository`, `ref`, `fetch-depth` and `submodules` parameters, as documented for

‎check-actions-usage/check-project-actions.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
# Workflow to be called from ASF project repository workflows to check
21+
# whether the GitHub actions references in GitHub workflows (`.github/workflows`) and
22+
# composite actions (`.github/actions`) are approved.
23+
#
24+
# The README.md of ASF Infrastructure Actions repository https://github.com/apache/infrastructure-actions
25+
# contains usage instructions.
26+
#
27+
# See: ASF Infrastructure GitHub Actions Policy: https://infra.apache.org/github-actions-policy.html
28+
29+
30+
name: check-project-actions.yml
31+
on:
32+
workflow_call:
33+
inputs:
34+
repository:
35+
required: false
36+
description: |
37+
Optional, the `repository` parameter for `actions/checkout`.
38+
If not specified, the default is to use the repository of the calling workflow.
39+
See https://github.com/actions/checkout?tab=readme-ov-file#usage for details.
40+
type: string
41+
ref:
42+
required: false
43+
description: |
44+
Optional, the `ref` parameter for `actions/checkout`
45+
If not specified, the default is to use the repository of the calling workflow.
46+
See https://github.com/actions/checkout?tab=readme-ov-file#usage for details.
47+
type: string
48+
fetch-depth:
49+
required: false
50+
description: |
51+
Optional, the `fetch-depth` parameter for `actions/checkout`.
52+
See https://github.com/actions/checkout?tab=readme-ov-file#usage for details.
53+
type: number
54+
default: 1
55+
submodules:
56+
required: false
57+
description: |
58+
Optional, the `submodules` parameter for `actions/checkout`.
59+
See https://github.com/actions/checkout?tab=readme-ov-file#usage for details.
60+
type: boolean
61+
default: false
62+
63+
jobs:
64+
check-project-actions:
65+
runs-on: ubuntu-latest
66+
steps:
67+
- name: "Checkout apache/infrastructure-actions"
68+
uses: actions/checkout@v2
69+
with:
70+
repository: 'apache/infrastructure-actions'
71+
ref: 'main'
72+
path: infrastructure-actions
73+
74+
- name: "Checkout repository to be checked"
75+
uses: actions/checkout@v2
76+
with:
77+
repository: '${{ inputs.repository }}'
78+
ref: ${{ inputs.ref }}
79+
fetch-depth: ${{ inputs.fetch-depth }}
80+
submodules: ${{ inputs.submodules }}
81+
path: repository
82+
83+
- run: pip install ruyaml
84+
85+
- name: Check allowed actions usage
86+
working-directory: infrastructure-actions
87+
shell: python
88+
run: |
89+
import sys
90+
sys.path.append("./gateway/")
91+
92+
import check_repository_actions as c
93+
c.check_project_actions('../repository', '../infrastructure-actions/approved_patterns.yml')

‎check-actions-usage/sample-ci-workflow.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
name: Example CI workflow for projects
21+
on:
22+
# If you want to run this workflow manually, keep `workflow_dispatch`. Otherwise, remove this trigger.
23+
workflow_dispatch:
24+
# Trigger the workflow on push or pull requests when the contents of your `.github` directory change.
25+
# Note: the cheeck-project-actions.yml workflow inspects the `.github/workflows` and `.github/actions` directories.
26+
push:
27+
branches:
28+
- main
29+
paths:
30+
- ".github/**"
31+
pull_request:
32+
paths:
33+
- ".github/**"
34+
35+
permissions:
36+
contents: read
37+
38+
jobs:
39+
# This is the job that verifies your project's usage of approved GitHub actions
40+
check:
41+
name: Check actions usage
42+
uses: apache/infrastructure-actions/check-project-actions/check-project-actions.yml@main
43+
# Optional: specify a different repository and/or ref to check. These options are passed to
44+
# GitHub actions/checkout, see https://github.com/actions/checkout?tab=readme-ov-file#usage for details.
45+
#with:
46+
#repository: apache/my-project
47+
#ref: my-branch
48+
#fetch-depth:
49+
#submodules:

0 commit comments

Comments
 (0)