mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-22 19:55:35 +00:00
Oliver Kieselbach
c26542776e
Every job that runs third-party code (restore, build, tests, npm ci, next build, wix) now holds only a read-only token and hands its output on as one archive. Signing, publishing and deploying happen in separate jobs on a fresh runner that run only this repository's scripts and pinned actions, unpack artifacts outside the checkout and take no build-job output into a script. - build-agent: reserve -> build -> release - build-msi: sign-loader -> build -> release - deploy-backend: reserve -> build -> deploy (publish output as one tar.gz) - deploy-web: build -> deploy (SWA token only, no id-token) -> record - combine-rules: validate (read-only, PRs too) -> publish (push to main only) - deploy-mcp: same shape; documents docker build as its boundary Deploy-only jobs run in the production environment. The jobs that sign stay without an environment for now: a job carries one OIDC subject, and the signing identity still trusts the ref. oidc-login-test.yml is removed; combine-rules no longer triggers on the dev branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
11 lines
567 B
YAML
11 lines
567 B
YAML
# zizmor (GitHub Actions static analysis) configuration. Read by the zizmor job in
|
|
# .github/workflows/action-pins.yml and by the local run before a workflow commit.
|
|
# Every ignore carries its reason; an ignore without one is itself a finding.
|
|
rules:
|
|
artipacked:
|
|
ignore:
|
|
# The publish job pushes the regenerated rule outputs to main with the job token that
|
|
# checkout leaves in the credential helper -- the one job that needs persisted
|
|
# credentials. It installs no packages; the validate job beside it is read-only.
|
|
- combine-rules.yml
|