Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce workflows for receiving comments on a PR #1357

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

Introduce workflows for receiving comments on a PR #1357

wants to merge 5 commits into from
+114 −2

Conversation

rickie
Copy link
Member

@rickie rickie commented Oct 9, 2024

Credits to @timtebeek for helping out with setting this up!

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 9, 2024
View reviewed changes
.github/workflows/comment-pr.yml
@@ -0,0 +1,56 @@
# Description: This workflow is triggered when the `receive-pr` workflow completes to post suggestions on the PR.

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help
.github/workflows/comment-pr.yml Fixed Show fixed Hide fixed
.github/workflows/comment-pr.yml Fixed Show fixed Hide fixed
.github/workflows/comment-pr.yml
repository: ${{github.event.workflow_run.head_repository.full_name}}

# Download the patch
- uses: actions/download-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/comment-pr.yml
rm git-diff.patch

# Download the PR number
- uses: actions/download-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/receive-pr.yml
@@ -0,0 +1,54 @@
# Description: This workflow runs OpenRewrite recipes against opened pull request and upload the patch.

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help
.github/workflows/receive-pr.yml
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/receive-pr.yml Fixed Show fixed Hide fixed
.github/workflows/receive-pr.yml
# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
- name: Create pr_number.txt
run: echo "${{ github.event.number }}" > pr_number.txt
- uses: actions/upload-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/receive-pr.yml Fixed Show fixed Hide fixed
@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 9, 2024

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 9, 2024
View reviewed changes
.github/workflows/comment-pr.yml
rm pr_number.txt
# Post suggestions as a comment on the PR
- uses: googleapis/code-suggester@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/receive-pr.yml
- name: Create patch
run: |
git diff | tee git-diff.patch
- uses: actions/upload-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 9, 2024

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 9, 2024
View reviewed changes
.github/workflows/comment-pr.yml
ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
timeout-minutes: 10
steps:
- uses: actions/a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
.github/workflows/pitest-update-pr.yml
@@ -37,7 +37,7 @@
java-distribution: temurin
maven-version: 3.9.9
- name: Download Pitest analysis artifact
uses: dawidd6/action-download-artifact@09f2f74827fd3a8607589e5ad7f9398816f540fe # v3.1.4
uses: dawidd6/action-download-artifact@`09f2f74827fd3a8607589e5ad7f9398816f540fe # v3.1.4`

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 9, 2024

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

2 similar comments
@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 9, 2024

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 9, 2024

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

@rickie rickie force-pushed the rossendrijver/setup_comments_for_ep branch from c3c1299 to 7d977af Compare October 13, 2024 15:44
@github-actions GitHub Actions
Copy link

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

1 similar comment
@github-actions GitHub Actions
Copy link

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

@rickie rickie force-pushed the rossendrijver/setup_comments_for_ep branch from 7d977af to 05369eb Compare October 14, 2024 07:54
@github-actions GitHub Actions
Copy link

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@rickie rickie marked this pull request as draft November 10, 2024 13:50
@rickie rickie force-pushed the rossendrijver/setup_comments_for_ep branch from 05369eb to b5c1985 Compare December 25, 2024 14:06
@github-actions GitHub Actions
Copy link

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@rickie