chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.38.0 #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Always-on lint/test gate. Path-filtered action suites stay in test-actions.yaml. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| # The policy tests compile and evaluate generated Rego rather than | |
| # grepping it, so they fail rather than skip when opa is missing. | |
| # | |
| # Straight from the GitHub release, not openpolicyagent.org/downloads: | |
| # that is a redirector, and its target has stalled here past the | |
| # timeout. The digest is pinned either way, so the host is a question of | |
| # availability rather than of trust. | |
| - name: Install opa | |
| env: | |
| OPA_VERSION: "1.19.1" | |
| OPA_SHA256: "c9f985ce0d345f5484006ade2c695ed9e3f308e4441139e46695c5c182ac0839" | |
| run: | | |
| curl -fSL --retry 3 --retry-all-errors \ | |
| --connect-timeout 10 --max-time 180 -o /tmp/opa \ | |
| "https://github.com/open-policy-agent/opa/releases/download/v${OPA_VERSION}/opa_linux_amd64_static" | |
| echo "${OPA_SHA256} /tmp/opa" | sha256sum --check - | |
| sudo install -m 0755 /tmp/opa /usr/local/bin/opa | |
| opa version | |
| - name: Compile Python sources | |
| run: | | |
| python -m compileall -q \ | |
| .github/actions \ | |
| .github/workflows \ | |
| tests | |
| - name: Test | |
| run: pytest -v --tb=short |