mirror of
https://github.com/ivuorinen/actions.git
synced 2026-01-26 03:23:59 +00:00
Ismo Vuorinen
9aa16a8164
* feat: use our own actions in our workflows * fix: add missing inputs to validate-inputs, refactor node * chore: cr comment fixes * fix: update-validators formatting * chore: update validators, add tests, conventions * feat: validate severity with severity_enum * feat: add 10 generic validators to improve input validation coverage Add comprehensive validation system improvements across multiple phases: Phase 2A - Quick Wins: - Add multi_value_enum validator for 2-10 value enumerations - Add exit_code_list validator for Unix/Linux exit codes (0-255) - Refactor coverage_driver to use multi_value_enum Phase 2B - High-Value Validators: - Add key_value_list validator with shell injection prevention - Add path_list validator with path traversal and glob support Quick Wins - Additional Enums: - Add network_mode validator for Docker network modes - Add language_enum validator for language detection - Add framework_mode validator for PHP framework modes - Update boolean pattern to include 'push' Phase 2C - Specialized Validators: - Add json_format validator for JSON syntax validation - Add cache_config validator for Docker BuildKit cache configs Improvements: - All validators include comprehensive security checks - Pattern-based validation with clear error messages - 23 new test methods with edge case coverage - Update special case mappings for 20+ inputs - Fix build-args mapping test expectation Coverage impact: 22 actions now at 100% validation (88% → 92%) Test suite: 762 → 785 tests (+23 tests, all passing) * chore: regenerate rules.yml with improved validator coverage Regenerate validation rules for all actions with new validators: - compress-images: 86% → 100% (+1 input: ignore-paths) - docker-build: 63% → 100% (+4 inputs: cache configs, platform-build-args) - docker-publish: 73% → 100% (+1 input: build-args) - language-version-detect: 67% → 100% (+1 input: language) - php-tests: 89% (fixed framework→framework_mode mapping) - prettier-lint: 86% → 100% (+2 inputs: file-pattern, plugins) - security-scan: 86% (maintained coverage) Overall: 23 of 25 actions now at 100% validation coverage (92%) * fix: address PR #377 review comments - Add | None type annotations to 6 optional parameters (PEP 604) - Standardize injection pattern: remove @# from comma_separated_list validator (@ and # are not shell injection vectors, allows npm scoped packages) - Remove dead code: unused value expression in key_value_list validator - Update tests to reflect injection pattern changes
77 lines
1.8 KiB
YAML
77 lines
1.8 KiB
YAML
---
|
|
# Validation rules for codeql-analysis action
|
|
# Generated by update-validators.py v1.0.0 - DO NOT EDIT MANUALLY
|
|
# Schema version: 1.0
|
|
# Coverage: 94% (15/16 inputs)
|
|
#
|
|
# This file defines validation rules for the codeql-analysis GitHub Action.
|
|
# Rules are automatically applied by validate-inputs action when this
|
|
# action is used.
|
|
#
|
|
|
|
schema_version: '1.0'
|
|
action: codeql-analysis
|
|
description: Run CodeQL security analysis for a single language with configurable query suites
|
|
generator_version: 1.0.0
|
|
required_inputs:
|
|
- language
|
|
optional_inputs:
|
|
- build-mode
|
|
- category
|
|
- checkout-ref
|
|
- config
|
|
- config-file
|
|
- output
|
|
- packs
|
|
- queries
|
|
- ram
|
|
- skip-queries
|
|
- source-root
|
|
- threads
|
|
- token
|
|
- upload-results
|
|
- working-directory
|
|
conventions:
|
|
build-mode: codeql_build_mode
|
|
category: category_format
|
|
checkout-ref: branch_name
|
|
config: codeql_config
|
|
config-file: file_path
|
|
language: codeql_language
|
|
output: file_path
|
|
packs: codeql_packs
|
|
queries: codeql_queries
|
|
ram: numeric_range_256_32768
|
|
skip-queries: boolean
|
|
source-root: file_path
|
|
threads: numeric_range_1_128
|
|
token: github_token
|
|
working-directory: file_path
|
|
overrides:
|
|
build-mode: codeql_build_mode
|
|
category: category_format
|
|
config: codeql_config
|
|
language: codeql_language
|
|
output: file_path
|
|
packs: codeql_packs
|
|
queries: codeql_queries
|
|
ram: numeric_range_256_32768
|
|
skip-queries: boolean
|
|
source-root: file_path
|
|
threads: numeric_range_1_128
|
|
token: github_token
|
|
statistics:
|
|
total_inputs: 16
|
|
validated_inputs: 15
|
|
skipped_inputs: 0
|
|
coverage_percentage: 94
|
|
validation_coverage: 94
|
|
auto_detected: true
|
|
manual_review_required: false
|
|
quality_indicators:
|
|
has_required_inputs: true
|
|
has_token_validation: true
|
|
has_version_validation: false
|
|
has_file_validation: true
|
|
has_security_validation: true
|