b1b0966cae
* Add zizmor checks on CI. * Fix zizmor credentials warnings * Add persist-credentials: false to action-cached-lfs-checkout too. * Add empty permissions by default. * Ignore pull_request_target failure and add a warning.
24 lines
785 B
YAML
24 lines
785 B
YAML
name: Prevent blocked
|
|
|
|
on:
|
|
# Privilege escalation necessary to access PR context and set status checks
|
|
# 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
|
|
pull_request_target: # zizmor: ignore[dangerous-triggers]
|
|
types: [opened, labeled, unlabeled, synchronize]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
prevent-blocked:
|
|
name: Prevent blocked
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
pull-requests: read
|
|
steps:
|
|
- name: Add notice
|
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
|
if: contains(github.event.pull_request.labels.*.name, 'X-Blocked')
|
|
with:
|
|
script: |
|
|
core.setFailed("PR has been labeled with X-Blocked; it cannot be merged.");
|