volker.raschekandCopilot
ee977a8610
Floating tags let a compromised or force pushed release change what the workflows execute. Pinning the actions to a commit sha and restricting the default token to read access limits the blast radius of a supply chain attack. The outdated ansible-lint and markdownlint-cli2 versions are raised along with the pinning. The ansible-lint run installs the collections of the molecule scenario, because the scenario is linted as well and depends on community.docker beside the community.general requirement of the role. Co-authored-by: Copilot <copilot@github.com>
26 lines
699 B
YAML
26 lines
699 B
YAML
name: Ansible Linter
|
|
|
|
on:
|
|
pull_request:
|
|
types: [ "opened", "reopened", "synchronize" ]
|
|
push:
|
|
branches: [ '**' ]
|
|
tags-ignore: [ '**' ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ansible-lint:
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- name: Run ansible-lint
|
|
uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294 # v26.8.0
|
|
with:
|
|
args: "--config-file .ansible-lint"
|
|
# The molecule scenario is linted as well, so its collections are required beside the ones of the role.
|
|
requirements_file: "molecule/default/collections.yml"
|
|
setup_python: "true"
|