capcheck/action.yml at main · git-pkgs/capcheck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: go-capcheck
description: Fail CI when Go code or dependencies gain new privileged operations, using google/capslock
author: git-pkgs
branding:
  icon: lock
  color: blue

inputs:
  go-version:
    description: Go version to install (passed to actions/setup-go)
    required: false
    default: stable
  capcheck-version:
    description: capcheck version to install
    required: false
    default: latest
  working-directory:
    description: Directory containing the Go module
    required: false
    default: .
  packages:
    description: Package patterns to analyse
    required: false
    default: ./...
  config:
    description: Path to capcheck.json
    required: false
    default: ""
  baseline:
    description: Path to capcheck.lock.json (overrides config)
    required: false
    default: ""
  strict:
    description: Fail on removed capabilities as well as added
    required: false
    default: "false"
  ignore:
    description: Comma-separated capabilities to ignore (stacks with capcheck.json)
    required: false
    default: ""

runs:
  using: composite
  steps:
    - uses: actions/setup-go@v6
      with:
        go-version: ${{ inputs.go-version }}

    - name: Install capcheck
      shell: bash
      run: go install github.com/git-pkgs/capcheck/cmd/capcheck@${{ inputs.capcheck-version }}

    - name: Run capcheck
      id: check
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        set +e
        args=(check --format github)
        if [ -n "${{ inputs.config }}" ]; then
          args+=(--config "${{ inputs.config }}")
        fi
        if [ -n "${{ inputs.baseline }}" ]; then
          args+=(--baseline "${{ inputs.baseline }}")
        fi
        if [ "${{ inputs.strict }}" = "true" ]; then
          args+=(--strict)
        fi
        if [ -n "${{ inputs.ignore }}" ]; then
          args+=(--ignore "${{ inputs.ignore }}")
        fi
        capcheck "${args[@]}" ${{ inputs.packages }}
        code=$?
        echo "exit-code=$code" >> "$GITHUB_OUTPUT"
        exit 0

    - name: Job summary
      if: steps.check.outputs.exit-code != '0'
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        args=(check)
        if [ -n "${{ inputs.config }}" ]; then
          args+=(--config "${{ inputs.config }}")
        fi
        if [ -n "${{ inputs.baseline }}" ]; then
          args+=(--baseline "${{ inputs.baseline }}")
        fi
        {
          echo '### capcheck'
          echo
          echo '```'
          capcheck "${args[@]}" ${{ inputs.packages }} || true
          echo '```'
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Fail if changed
      if: steps.check.outputs.exit-code != '0'
      shell: bash
      run: exit ${{ steps.check.outputs.exit-code }}