Repository navigation
build(deps): bump the actions group across 1 directory with 5 updates #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify cookbook | |
| on: | |
| pull_request: | |
| merge_group: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "24.19.0" | |
| - name: Install Python style tools | |
| run: python3 -m pip install ruff==0.16.8 | |
| - name: Check Python lint | |
| run: | | |
| ruff check scripts tests | |
| - name: Check Prettier formatting | |
| run: npx --yes prettier@3.9.6 --check . --ignore-unknown | |
| - name: Check generated catalog | |
| run: python3 scripts/catalog.py check | |
| - name: Verify repository structure and provenance | |
| run: python3 scripts/verify.py | |
| - name: Run repository tests | |
| run: python3 -B -m unittest discover -s tests | |
| history-secrets: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| path: content | |
| # Policy changes take effect only after review and merge into the base branch. | |
| - name: Check out trusted scanner policy | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.sha }} | |
| persist-credentials: false | |
| sparse-checkout: .gitleaks.toml | |
| sparse-checkout-cone-mode: false | |
| path: policy | |
| - name: Scan repository history for secrets | |
| run: | | |
| docker run --rm --network=none --cap-drop=ALL \ | |
| --security-opt=no-new-privileges \ | |
| -v "$GITHUB_WORKSPACE/content:/repo:ro" \ | |
| -v "$GITHUB_WORKSPACE/policy/.gitleaks.toml:/policy/gitleaks.toml:ro" \ | |
| zricethezav/gitleaks@sha256:e1b35e12a8c6fa8901f060459cfb6b2fc4c484d3afbe3b029733a3bbfab07055 \ | |
| detect --source=/repo --redact --verbose --ignore-gitleaks-allow \ | |
| --gitleaks-ignore-path=/dev/null --config=/policy/gitleaks.toml | |
| representative-recipes: | |
| name: ${{ matrix.name }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: Python clean install and import | |
| runtime: python | |
| directory: examples/python/getting-started-with-browserbase | |
| command: uv sync && uv run python -c 'import browserbase, dotenv, playwright' | |
| - name: TypeScript clean install and typecheck | |
| runtime: node | |
| directory: examples/typescript/getting-started-with-browserbase | |
| command: npm install --ignore-scripts --package-lock=false && npm run typecheck | |
| - name: Go dependency and compile check | |
| runtime: go | |
| directory: examples/go/hackernews | |
| command: go test ./... | |
| - name: Playbook 1Password typecheck | |
| runtime: node | |
| directory: playbook/guides/1password/node | |
| command: npm install --ignore-scripts --package-lock=false && npm run typecheck | |
| - name: Temporal integration tests and typecheck | |
| runtime: node | |
| directory: integrations/examples/integrations/temporal | |
| command: npm ci --ignore-scripts && npm test && npm run typecheck | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| if: matrix.runtime == 'python' | |
| with: | |
| python-version: "3.13" | |
| - uses: astral-sh/setup-uv@d0d8abe699bfb85fec6de9f7adb5ae17292296ff # v6 | |
| if: matrix.runtime == 'python' | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| if: matrix.runtime == 'node' | |
| with: | |
| node-version: "24.19.0" | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| if: matrix.runtime == 'go' | |
| with: | |
| go-version-file: ${{ matrix.directory }}/go.mod | |
| cache-dependency-path: ${{ matrix.directory }}/go.sum | |
| - name: Enforce npm package release-age policy | |
| if: matrix.runtime == 'node' | |
| run: npm config set min-release-age 7 | |
| - name: Run representative check | |
| working-directory: ${{ matrix.directory }} | |
| run: ${{ matrix.command }} | |
| merge-checks: | |
| name: Merge checks | |
| if: ${{ always() }} | |
| needs: [verify, history-secrets, representative-recipes] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Require every validation job to pass | |
| env: | |
| RESULTS: ${{ toJSON(needs) }} | |
| run: | | |
| python3 - <<'PYTHON' | |
| import json | |
| import os | |
| import sys | |
| results = json.loads(os.environ["RESULTS"]) | |
| failed = [name for name, job in results.items() if job["result"] != "success"] | |
| for name, job in results.items(): | |
| print(f"{name}: {job['result']}") | |
| if failed: | |
| print("::error::Required validation did not pass: " + ", ".join(failed)) | |
| sys.exit(1) | |
| PYTHON |