chore(deps): bump hadolint/hadolint-action from 3.3.0 to 3.4.0 #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dogfoods the reusable docker workflow (./.github/workflows/docker.yaml) by building | |
| # a tiny image (testdata/Dockerfile) through the full pipeline: lint -> scan -> smoke | |
| # -> push. This is how changes to docker.yaml itself get validated end-to-end. | |
| # | |
| # Uses a LOCAL reusable-workflow reference (./.github/workflows/docker.yaml) so that a | |
| # PR modifying docker.yaml tests ITS OWN version of the workflow, not the one on main. | |
| # | |
| # Prerequisites on THIS repo (leonidgrishenkov/github-actions): | |
| # * Repository variable YC_REGISTRY_ID (same value as on caller repos) | |
| # * Repository secret YC_CR_SA_AUTH_JSON (same YC service-account JSON key) | |
| # Without these, the scan job's "Log in to Yandex Container Registry" step fails before | |
| # build/scan run. Add them under Settings > Secrets and variables > Actions. | |
| # | |
| # The tiny image is pushed to cr.yandex/<YC_REGISTRY_ID>/github-actions/pipeline-self-test. | |
| # Triggered manually (workflow_dispatch), on tags, and on PRs to main. | |
| name: Pipeline self-test | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| docker: | |
| permissions: | |
| contents: read # checkout | |
| security-events: write # Trivy SARIF -> Code Scanning (scan job) | |
| id-token: write # cosign keyless OIDC (push job) | |
| uses: ./.github/workflows/docker.yaml | |
| with: | |
| image-name: pipeline-self-test | |
| registry-repo: github-actions | |
| dockerfile: tests/Dockerfile | |
| smoke-test-args: "/etc/pipeline-test" | |
| # Lint + scan only — don't push the throwaway self-test image to the registry. | |
| # Flip to 'true' (or omit) to also exercise the multi-arch push/sign job. | |
| push: 'false' | |
| secrets: inherit # forwards YC_CR_SA_AUTH_JSON; reads vars.YC_REGISTRY_ID |