From 9ef47fbce77fe0b76918d6df07802833a6b6fde8 Mon Sep 17 00:00:00 2001 From: kleinbem Date: Thu, 5 Nov 2026 18:48:00 +0000 Subject: [PATCH] ci: add fleet-lint and fix its zizmor finding Adds the shared fleet-lint check (kleinbem/actions/lint v1.3.0) and persist-credentials: false on validate.yaml's checkout. kleinbem/coderabbit's sync-org copies only .coderabbit.yaml, so the workflows here stay as they are. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/fleet-lint.yaml | 21 +++++++++++++++++++++ .github/workflows/validate.yaml | 2 ++ 2 files changed, 23 insertions(+) create mode 100644 .github/workflows/fleet-lint.yaml diff --git a/.github/workflows/fleet-lint.yaml b/.github/workflows/fleet-lint.yaml new file mode 100644 index 0000000..67cf88c --- /dev/null +++ b/.github/workflows/fleet-lint.yaml @@ -0,0 +1,21 @@ +name: fleet-lint + +on: + push: + branches: [main] + pull_request: + +permissions: {} + +jobs: + fleet-lint: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 # gitleaks scans every commit of the PR + persist-credentials: false + - uses: kleinbem/actions/nix-setup@fac6dda312df4b995db2fff7e8552945104b050c # v1.3.0 + - uses: kleinbem/actions/lint@fac6dda312df4b995db2fff7e8552945104b050c # v1.3.0 diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index f3f8054..4c2af6a 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -13,6 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Check .coderabbit.yaml against CodeRabbit's schema run: | curl -fsSL https://coderabbit.ai/integrations/schema.v2.json -o /tmp/schema.json