mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-04 19:21:51 +00:00
stepsecurity-app[bot]
716c130140
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
name: 'Tools: PR Merged'
|
|
|
|
on:
|
|
# zizmor: ignore[dangerous-triggers] - intentional: needs read access to merged PR metadata, no PR code checkout
|
|
pull_request_target:
|
|
branches:
|
|
- 'master'
|
|
types:
|
|
- 'closed'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
trigger-cloud-pull-request:
|
|
if: |
|
|
github.event.pull_request.merged == true &&
|
|
github.repository == 'prowler-cloud/prowler' &&
|
|
!contains(github.event.pull_request.labels.*.name, 'skip-sync')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Calculate short commit SHA
|
|
id: vars
|
|
run: |
|
|
SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
|
|
echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
|
|
env:
|
|
GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
|
|
|
|
- name: Trigger Cloud repository pull request
|
|
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
|
|
with:
|
|
token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
|
|
repository: ${{ secrets.CLOUD_DISPATCH }}
|
|
event-type: prowler-pull-request-merged
|
|
client-payload: |
|
|
{
|
|
"PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
|
|
"PROWLER_COMMIT_SHORT_SHA": "${{ steps.vars.outputs.short_sha }}",
|
|
"PROWLER_PR_NUMBER": "${{ github.event.pull_request.number }}",
|
|
"PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
|
|
"PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
|
|
"PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
|
|
"PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
|
|
"PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
|
|
"PROWLER_PR_BASE_BRANCH": "${{ github.event.pull_request.base.ref }}",
|
|
"PROWLER_PR_HEAD_BRANCH": "${{ github.event.pull_request.head.ref }}"
|
|
}
|