@groovy.transform.CompileStatic abstract class ValidateActionsTask extends DefaultTask
Validates that every uses: entry in the project's GitHub Actions workflow files
complies with the ASF approved-actions policy
(https://github.com/apache/infrastructure-actions).
Policy:
actions/*, github/* or apache/* namespaces are
auto-approved.@* (any-version) allowlist entry or be pinned
to a full-SHA commit that appears in approved_patterns.yml.Violations are reported as ERRORs and fail the build. A trailing # vX.Y.Z comment
that disagrees with the tag ASF recorded for the pinned SHA gives a WARNING.
Note: the code for this task would be simpler using groovy-yaml or similar, but the YAML parsing requirements are minimal, and extra dependencies in build-logic are best avoided.
| Constructor and description |
|---|
ValidateActionsTask() |
| Type Params | Return Type | Name and description |
|---|---|---|
|
abstract DirectoryProperty |
getRootDirectory()Base directory the reported paths are relativised against; affects messages only. |
|
abstract ConfigurableFileCollection |
getWorkflowFiles()The workflow files to scan. |
|
void |
validate() |
Base directory the reported paths are relativised against; affects messages only.
The workflow files to scan.