mirror of
https://github.com/redwoodjs/local-ci.git
synced 2026-09-19 07:54:29 +08:00
Peter Pistorius
ef7029adf3
Replace mutable tag refs (@v4, @v5, @v1, @main) with 40-char commit SHAs and a trailing `# vX.Y.Z` comment, per GitHub's hardening guidance. Covers .github/workflows/, .docs/marketing/demo-recording/, and the skill-evals fixture repos. Embedded YAML inside heredocs is also pinned. No packages/ code changes, so no changeset.
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
name: "Smoke: defaults.run.working-directory scoping"
|
|
|
|
# Exercises the three scopes at which `working-directory` can be set:
|
|
# - workflow-level `defaults.run.working-directory` (applies to every step)
|
|
# - job-level `defaults.run.working-directory` (overrides workflow-level)
|
|
# - step-level `working-directory` (overrides both)
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, labeled, synchronize]
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: .github
|
|
|
|
jobs:
|
|
workflow-default:
|
|
name: Workflow-level default
|
|
if: '!github.event.pull_request.draft && (contains(fromJSON(''["MEMBER", "OWNER", "COLLABORATOR"]''), github.event.pull_request.author_association) || contains(github.event.pull_request.labels.*.name, ''safe-to-run''))'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Step inherits workflow-level working-directory
|
|
run: |
|
|
case "$(pwd)" in
|
|
*/\.github) echo "✅ cwd=$(pwd)" ;;
|
|
*) echo "❌ expected cwd ending in /.github, got $(pwd)"; exit 1 ;;
|
|
esac
|
|
|
|
- name: Step-level working-directory overrides workflow-level
|
|
working-directory: .github/workflows
|
|
run: |
|
|
case "$(pwd)" in
|
|
*/\.github/workflows) echo "✅ cwd=$(pwd)" ;;
|
|
*) echo "❌ expected cwd ending in /.github/workflows, got $(pwd)"; exit 1 ;;
|
|
esac
|
|
|
|
job-default:
|
|
name: Job-level default overrides workflow-level
|
|
if: '!github.event.pull_request.draft && (contains(fromJSON(''["MEMBER", "OWNER", "COLLABORATOR"]''), github.event.pull_request.author_association) || contains(github.event.pull_request.labels.*.name, ''safe-to-run''))'
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: .github/workflows
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Step inherits job-level working-directory
|
|
run: |
|
|
case "$(pwd)" in
|
|
*/\.github/workflows) echo "✅ cwd=$(pwd)" ;;
|
|
*) echo "❌ expected cwd ending in /.github/workflows, got $(pwd)"; exit 1 ;;
|
|
esac
|