mirror of
https://github.com/rommapp/romm.git
synced 2026-10-11 22:40:04 +00:00
Georges-Antoine AssiandClaude Opus 5.5
1e03363816
aquasecurity's IP allow list rejects GitHub API calls from hosted runners, so pinact 403s verifying the trivy-action tag comment. A .pinact.yaml rule skips verification for aquasecurity actions only once they are pinned to a full SHA, so an unpinned ref is still flagged. zizmor (enabled on master) wants the $/ self-repository syntax for the reusable workflow call, but actionlint 1.7.12 rejects it, so the finding is suppressed inline for now. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
9 lines
423 B
YAML
9 lines
423 B
YAML
# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
|
|
version: 3
|
|
rules:
|
|
# aquasecurity's IP allow list rejects API calls from GitHub-hosted runners,
|
|
# so skip verifying the tag comment once the action is pinned to a SHA.
|
|
- ignore: true
|
|
conditions:
|
|
- expr: ActionRepoOwner == "aquasecurity" && ActionVersion matches "^[0-9a-f]{40}$"
|