fix 🐛: Increase redaction level in PR check workflow #19
Reference in New Issue
Block a user
Delete Branch "dev"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This change updates the redaction level from
falseto100in the.gitea/workflows/pr-check.yamlfile. This ensures that more sensitive information is redacted during pull request checks, enhancing security.handle_failuresto run regardless of previous job resultsReview Summary
yaml # https://github.com/kekxv/pr-check name: PR check on: pull_request: types: [opened, synchronize] jobs: leak_test: name: Gitleaks runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v6 with: github-server-url: ${{ vars.GIT_SERVER_URL }} - name: Install Gitleaks run: | curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz \ | tar -xz sudo mv gitleaks /usr/local/bin/ - name: Run Gitleaks run: | gitleaks dir . \ --redact=10 \ --verbose \ --exit-code 1 lint_test: name: lint tests runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v6 with: github-server-url: ${{ vars.GIT_SERVER_URL }} - name: Install Node.js uses: actions/setup-node@v4 with: node-version: 20 - name: Run markdownlint run: npx markdownlint-cli2 "**/*.md" "#node_modules" - name: Set up Python uses: actions/setup-python@v5 with: python-version: "3.14" - name: Install ansible-lint and yamllint run: | python -m pip install --upgrade pip pip install ansible ansible-lint yamllint - name: Run yamllint run: | yamllint . - name: Run ansible-lint run: | ansible-lint handle_failures: runs-on: ubuntu-latest needs: [leak_test, lint_test] if: needs.leak_test.result != 'success' || needs.lint_test.result != 'success' steps: - name: Comment, label, and close PR run: | API="${{ vars.GIT_SERVER_URL }}/api/v1/repos/${{ github.repository }}" PR="${{ github.event.pull_request.number }}" TOKEN="${{ secrets.GITEA_TOKEN }}" # ... (rest of the handle_failures steps) handle_success: runs-on: ubuntu-latest needs: [leak_test, lint_test] if: needs.leak_test.result == 'success' && needs.lint_test.result == 'success' steps: - name: Update comment, remove label, reopen PR run: | API="${{ vars.GIT_SERVER_URL }}/api/v1/repos/${{ github.repository }}" PR="${{ github.event.pull_request.number }}" TOKEN="${{ secrets.GITEA_TOKEN }}" # ... (rest of the handle_success steps)@@ -0,0 +20,4 @@- name: Install Gitleaksrun: |curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz \| tar -xz[Lines 15-23] [Score: 3] Consider using a specific action for checking out the code to avoid differences in behavior between actions and self-hosted runners. For example, you can use
actions/checkout@v6instead of the defaultactions/checkout.@@ -0,0 +45,4 @@uses: actions/setup-node@v4with:node-version: 20[Lines 47-48] [Score: 3] Consider explicitly specifying the LTS (Long Term Support) version instead of a specific minor version. This will help ensure compatibility with future changes in Node.js and prevent unexpected issues. For example, you can use
16.xor14.x.@@ -0,0 +53,4 @@uses: actions/setup-python@v5with:python-version: "3.14"[Lines 55-56] [Score: 3] Consider explicitly specifying the latest point release of Python instead of a specific minor version for maximum compatibility and security. For example, you can use
3.9.x.@@ -10,3 +10,3 @@## 📌 Key Features## 📌 Features✅ **Proxmox VE Optimized** - Specifically designed for Proxmox Virtual Environment[Score: 2] Consider adding a comment explaining the purpose of this constant 'a'. This will help future maintainers understand its role in the code.
Review Summary
.gitea/workflows/pr-check-yaml). The removed file was responsible for running various checks on pull requests, including leak tests, linting, and CI checks. The removal of this file potentially impacts security, performance, and maintainability as it removes automated checks that were previously in place. Since the file is completely deleted, it's assumed that there are no more checks being performed for newly opened pull requests.@@ -0,0 +20,4 @@- name: Install Gitleaksrun: |curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz \| tar -xz[Lines 15-23] [Score: 3] Consider using a specific action for checking out the code to avoid differences in behavior between actions and self-hosted runners. For example, you can use
actions/checkout@v6instead of the defaultactions/checkout.@@ -0,0 +45,4 @@uses: actions/setup-node@v4with:node-version: 20[Lines 47-48] [Score: 3] Consider explicitly specifying the LTS (Long Term Support) version instead of a specific minor version. This will help ensure compatibility with future changes in Node.js and prevent unexpected issues. For example, you can use
16.xor14.x.@@ -0,0 +53,4 @@uses: actions/setup-python@v5with:python-version: "3.14"[Lines 55-56] [Score: 3] Consider explicitly specifying the latest point release of Python instead of a specific minor version for maximum compatibility and security. For example, you can use
3.9.x.@@ -10,3 +10,3 @@## 📌 Key Features## 📌 Features✅ **Proxmox VE Optimized** - Specifically designed for Proxmox Virtual Environment[Score: 2] Consider adding a comment explaining the purpose of this constant 'a'. This will help future maintainers understand its role in the code.
❌ CI checks failed.
Leak: failure
Lint: success
Pull request closed