mirror of https://github.com/pixelfed/pixelfed
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
70 lines
2.8 KiB
YAML
70 lines
2.8 KiB
YAML
# Generated by `psalm-laravel add github`, then trimmed to type analysis only.
|
|
# Psalm 6 runs type and taint analysis in separate modes. This workflow runs the type-analysis
|
|
# pass and fails on Psalm's exit code. Taint (security) scanning is available via
|
|
# `./vendor/bin/psalm --taint-analysis`; enable it as a second job once you are ready to triage
|
|
# its findings in a private channel (see the plugin README for the SARIF + Code Scanning setup).
|
|
|
|
name: PHP - Psalm
|
|
|
|
on:
|
|
push:
|
|
branches: [staging, dev, unstable]
|
|
pull_request:
|
|
branches: [staging, dev, unstable]
|
|
|
|
permissions:
|
|
contents: read
|
|
# Required for github/codeql-action/upload-sarif to publish Code Scanning alerts.
|
|
security-events: write
|
|
|
|
concurrency:
|
|
group: psalm-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
static-analysis:
|
|
name: Psalm type analysis
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Block unexpected egress
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
# Covers checkout, setup-php and Composer (public Packagist). Extend for other hosts
|
|
# (private registry, VCS repos, extra plugins). Use egress-policy: audit to discover them.
|
|
egress-policy: block
|
|
allowed-endpoints: >
|
|
api.github.com:443
|
|
codeload.github.com:443
|
|
github.com:443
|
|
packagist.org:443
|
|
release-assets.githubusercontent.com:443
|
|
repo.packagist.org:443
|
|
|
|
# No git ops after checkout, so drop the token: a compromised later step cannot push.
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
|
|
with:
|
|
php-version: '8.4'
|
|
coverage: none
|
|
|
|
- uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
|
|
|
|
# --output-format=github emits workflow annotations so findings appear inline
|
|
# on the PR's Files changed view. --report writes SARIF for Code Scanning upload.
|
|
# Reporting only: `|| true` keeps the step (and job) green even when Psalm finds
|
|
# issues, so this workflow surfaces findings without ever blocking a PR.
|
|
- name: Run Psalm (type analysis, report only)
|
|
run: ./vendor/bin/psalm --output-format=github --report=psalm.sarif.json || true
|
|
|
|
# Surface findings as Code Scanning alerts on the PR (Security tab). Runs even
|
|
# when Psalm failed above, so the alerts are still published for triage.
|
|
- name: Upload SARIF to Code Scanning
|
|
if: ${{ !cancelled() }}
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: psalm.sarif.json
|
|
category: psalm
|