workflows/ci: fix template-injection zizmor findings #109129
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Triage tasks | |
| on: pull_request_target | |
| concurrency: | |
| group: "triage-${{ github.event.number }}" | |
| cancel-in-progress: true | |
| jobs: | |
| limit-pull-requests: | |
| if: > | |
| always() && github.repository_owner == 'Homebrew' && | |
| (github.event_name == 'pull_request_target' && | |
| github.event.action == 'opened') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: Homebrew/actions/limit-pull-requests@master | |
| with: | |
| except-users: | | |
| BrewTestBot | |
| comment-limit: 15 | |
| comment: | | |
| Hi, thanks for your contribution to Homebrew! You already have >=15 open pull requests, so please get them ready to be merged or close them before you open more. If CI fails on any of them, please fix it or ask for help doing so. | |
| If you are performing simple version bumps, @BrewTestBot automatically bumps [a list of casks](https://github.com/${{ github.repository }}/blob/HEAD/.github/autobump.txt) so you don't need to. Please take a look at issues and pull requests labelled https://github.com/${{ github.repository }}/labels/help%20wanted and see if you can help to fix any of them. Thanks! | |
| close-limit: 30 | |
| close: true | |
| triage: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Check commit format | |
| uses: Homebrew/actions/check-commit-format@master | |
| with: | |
| token: ${{secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN}} | |
| - name: Label pull request | |
| uses: Homebrew/actions/label-pull-requests@master | |
| if: always() | |
| with: | |
| token: ${{secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN}} | |
| def: | | |
| - label: cask deprecated | |
| path: Casks/.+ | |
| content: \n deprecate!.*\n | |
| - label: cask disabled | |
| path: Casks/.+ | |
| content: \n disable!.*\n | |
| - label: new cask | |
| status: added | |
| path: Casks/.+ | |
| - label: marked for removal/rejection | |
| status: removed | |
| path: Casks/.+ | |
| - label: documentation | |
| path: (.*\.md|\.github/ISSUE_TEMPLATE/.*\.yml) | |
| - label: bump-cask-pr | |
| pr_body_content: Created with `brew bump-cask-pr` | |
| - label: missing description | |
| path: Casks/.+ | |
| missing_content: | |
| - \n desc .+\n | |
| - cask "font- | |
| - label: extract_plist livecheck | |
| path: Casks/.+ | |
| content: strategy :extract_plist | |
| - label: missing zap | |
| path: Casks/.+ | |
| missing_content: zap .+\n | |
| - label: autobump | |
| path: \.github/autobump\.txt | |
| allow_any_match: true |