Merge pull request #48 from tighten/alk/add-security-for-gh-actions

Update Github actions workflows
tighten · Aug 31, 2022 · 5f0f9eb · 5f0f9eb
2 parents 06c76e0 + 28481ea
commit 5f0f9eb
Show file tree

Hide file tree

Showing 2 changed files with 60 additions and 57 deletions.
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
@@ -2,19 +2,22 @@ name: Run Tests
 
 on:
   push:
-    branches: [ main ]
-  pull_request:
+    branches: [main]
+  pull_request_target:
+    types: [labeled]
+    branches: [main]
 
 jobs:
   test:
     name: PHP ${{ matrix.php }}, Laravel ${{ matrix.laravel }}
     runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test')
 
     strategy:
       max-parallel: 1
       matrix:
-        php: [ 7.4, 8.0, 8.1 ]
-        laravel: [ 8.*, 9.* ]
+        php: [7.4, 8.0, 8.1]
+        laravel: [8.*, 9.*]
         include:
           - php: 7.4
             laravel: 8.*
@@ -47,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
+        uses: actions/checkout@v3
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -1,57 +1,57 @@
 name: Lint
 
 on:
-    push:
-        branches: [ main ]
-    pull_request:
+  push:
+    branches: [main]
+  pull_request_target:
+    types: [labeled]
+    branches: [main]
 
 jobs:
-    phpcs:
-        name: PHPCS
-
-        continue-on-error: false
-
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v2
-
-            - name: Setup PHP
-              uses: shivammathur/setup-php@v2
-              with:
-                  php-version: 8.0
-                  extensions: posix, dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick
-                  coverage: none
-
-            - name: Install dependencies
-              run: |
-                composer config "http-basic.nova.laravel.com" "${{ secrets.NOVA_USERNAME }}" "${{ secrets.NOVA_LICENSE_KEY }}"
-                composer upgrade --no-interaction --no-suggest
-
-            - name: PHP-8 compatible PHPCS
-              run: vendor/bin/phpcs
-
-    tlint:
-        name: TLint
-
-        continue-on-error: false
-
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v1
-
-            - name: Setup PHP
-              uses: shivammathur/setup-php@v2
-              with:
-                  php-version: 8.0
-                  extensions: posix, dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick
-                  coverage: none
-
-            - name: Install dependencies
-              run: |
-                composer config "http-basic.nova.laravel.com" "${{ secrets.NOVA_USERNAME }}" "${{ secrets.NOVA_LICENSE_KEY }}"
-                composer install --no-interaction --no-suggest
-
-            - name: Tlint Lint
-              run: vendor/bin/tlint
+  phpcs:
+    name: PHPCS
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test')
+    continue-on-error: false
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+            php-version: 8.0
+            extensions: posix, dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick
+            coverage: none
+
+      - name: Install dependencies
+        run: |
+          composer config "http-basic.nova.laravel.com" "${{ secrets.NOVA_USERNAME }}" "${{ secrets.NOVA_LICENSE_KEY }}"
+          composer upgrade --no-interaction --no-suggest
+
+      - name: PHP-8 compatible PHPCS
+        run: vendor/bin/phpcs
+
+  tlint:
+    name: TLint
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test')
+    continue-on-error: false
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+            php-version: 8.0
+            extensions: posix, dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick
+            coverage: none
+
+      - name: Install dependencies
+        run: |
+          composer config "http-basic.nova.laravel.com" "${{ secrets.NOVA_USERNAME }}" "${{ secrets.NOVA_LICENSE_KEY }}"
+          composer install --no-interaction --no-suggest
+
+      - name: Tlint Lint
+        run: vendor/bin/tlint