1dbec56140
* ci: migrate workflows + dependabot from opencode * ci: replace self-hosted with ubuntu-latest + update paths * ci: add bootstrap job + hashFiles conditions for bootstrapping * docs(handoff): add pr-6 handoff + ADR-002 * fix(ci): wrap hashFiles in expression syntax for job-level if * fix(ci): replace hashFiles with output-based skip conditions * docs(handoff): update pr-6 handoff + ADR-002 for output-based * docs(handoff): fix PR number in handoff filename * docs: add project map for PR #18 --------- Co-authored-by: opencode-agent <agent@slaid098.dev>
33 lines
913 B
YAML
33 lines
913 B
YAML
name: Permission Security Check
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.opencode/opencode.json'
|
|
- '.opencode/agents/**'
|
|
- '.opencode/scripts/check-permissions.py'
|
|
- '.github/workflows/permissions-check.yml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- id: check
|
|
run: |
|
|
if [ -f .opencode/scripts/check-permissions.py ]; then
|
|
echo "has_script=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "has_script=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
- uses: actions/setup-python@v5
|
|
if: steps.check.outputs.has_script == 'true'
|
|
with:
|
|
python-version: "3.12"
|
|
- run: python3 .opencode/scripts/check-permissions.py
|
|
if: steps.check.outputs.has_script == 'true'
|