38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
name: 'Plugin registry validate'
|
|
|
|
# Runs on PRs that touch the curated plugin registry. Uses `pull_request` (NOT
|
|
# pull_request_target), read-only permissions, and NO secrets — so cloning +
|
|
# statically auditing a submitter's plugin can never reach a token or write the
|
|
# repo. No plugin code is executed (the manifest is parsed, the audit is static).
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'plugins-registry.json'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate registry entries
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
# Deterministic shape gate (no network).
|
|
- name: Validate registry shape
|
|
run: node validate-plugin-registry.mjs
|
|
|
|
# Deep gate: clone each entry at its pinned SHA + static-validate + audit.
|
|
# No secrets are present in this job; nothing the plugin ships is executed.
|
|
- name: Clone + audit each registry entry
|
|
run: node validate-plugin-registry.mjs --deep
|
|
|
|
- name: One plugin per PR
|
|
run: |
|
|
CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- plugins-registry.json | wc -l)
|
|
if [ "$CHANGED" -gt 1 ]; then echo "Only plugins-registry.json may change in a registry PR"; exit 1; fi
|