chore(deps): bump r-lib/actions/setup-r-dependencies from 2.11.4 to 2.13.0 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Keeps the upstream OSV base/head diff check available on every PR. The | |
| # central Security Scan workflow owns the blocking OSV result, finding logs, | |
| # and SARIF upload so this supplemental check does not duplicate installation | |
| # API calls or fail an otherwise clean PR when GitHub's upload quota is spent. | |
| name: OSV-Scanner PR | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, closed] | |
| branches: [main, master, develop] | |
| concurrency: | |
| group: >- | |
| osv-scanner-pr-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.repository }}-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| # Scorecard Token-Permissions (alert #41): keep the workflow-level token | |
| # read-only. SARIF upload needs security-events:write, but the osv-scan job | |
| # below already grants it at job scope, so it is redundant (and over-broad) | |
| # here. | |
| actions: read | |
| contents: read | |
| jobs: | |
| changed-scope: | |
| name: Detect changed scope | |
| # The org ruleset IGNORES every `on:` filter (paths, branches, types) when it | |
| # runs this workflow in another repository, and a trigger-level skip would | |
| # leave `.github`'s classic required contexts Pending forever. Both | |
| # mechanisms honour a JOB-level skip, so the doc/image-only decision is made | |
| # here and consumed through `needs`. See | |
| # docs/doctoring/required-workflow-path-filter-boundary.md. | |
| # Fails OPEN: an unreadable, empty, or truncated file list scans everything. | |
| if: github.event.action != 'closed' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| code: ${{ steps.scope.outputs.code }} | |
| deps: ${{ steps.scope.outputs.deps }} | |
| steps: | |
| - name: Classify changed paths | |
| id: scope | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.event.pull_request.base.repo.full_name || github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| EXPECTED_FILES: ${{ github.event.pull_request.changed_files }} | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| code=true | |
| deps=true | |
| if [ -n "${PR}" ] && [ -n "${EXPECTED_FILES}" ]; then | |
| changed="" | |
| for attempt in 1 2 3; do | |
| if changed="$(gh api --paginate "repos/${REPO}/pulls/${PR}/files?per_page=100" --jq '.[].filename')" && [ -n "$changed" ]; then | |
| break | |
| fi | |
| changed="" | |
| sleep $((attempt * 3)) | |
| done | |
| # GitHub caps /pulls/N/files at 3000 entries; a short list would hide | |
| # source files behind a doc-only verdict, so require an exact count. | |
| if [ -n "$changed" ] && [ "$(printf '%s\n' "$changed" | wc -l | tr -d ' ')" = "${EXPECTED_FILES}" ]; then | |
| code=false | |
| deps=false | |
| while IFS= read -r changed_path; do | |
| case "$changed_path" in | |
| *.md|*.markdown|*.rst|*.png|*.jpg|*.jpeg|*.gif|*.webp|*.bmp|*.ico|LICENSE|LICENSE.txt|COPYING|COPYING.txt|NOTICE|NOTICE.txt|.github/ISSUE_TEMPLATE/*) ;; | |
| *) code=true ;; | |
| esac | |
| case "$changed_path" in | |
| requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION) deps=true ;; | |
| esac | |
| done <<<"$changed" | |
| else | |
| echo "::notice::changed-scope could not read a complete PR file list; scanning everything." | |
| fi | |
| fi | |
| echo "code=${code}" >> "$GITHUB_OUTPUT" | |
| echo "deps=${deps}" >> "$GITHUB_OUTPUT" | |
| echo "changed-scope code=${code} deps=${deps}" | |
| osv-scan: | |
| needs: changed-scope | |
| if: github.event.action != 'closed' && needs.changed-scope.outputs.deps == 'true' | |
| # ponytail: use upstream reusable PR workflow, don't hand-roll the diff scan | |
| # Pinned to v2.3.8 + 1 commit (3a7550f) which gates the JSON job outputs | |
| # behind the new `export-results` input (default false). v2.3.8 dumped the | |
| # full old/new osv-scanner JSON into job outputs unconditionally, tripping | |
| # GitHub's 1,048,576-byte job-outputs cap and failing the run. Same nested | |
| # action pins as v2.3.8; only the Export step is now conditional. | |
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate | |
| permissions: | |
| actions: read | |
| contents: read | |
| # The pinned upstream reusable workflow declares this permission at its | |
| # top level, so GitHub validates it even when upload-sarif is false. | |
| security-events: write | |
| with: | |
| # Keep the PR code-scanning upload deterministic: direct manifest | |
| # vulnerabilities are uploaded, but public registry rate limits cannot | |
| # make the required upload check fail before SARIF reaches GitHub. | |
| # The security-scan workflow still performs the full base/head OSV pass | |
| # first and logs its --no-resolve fallback reason when registries are | |
| # transiently unavailable. | |
| scan-args: |- | |
| --maven-registry=https://maven-central.storage-download.googleapis.com/maven2 | |
| --no-resolve | |
| -r | |
| ./ | |
| # The required central security-scan.yml job uploads the comprehensive | |
| # current-head OSV SARIF. Avoid a second upload through the reusable | |
| # workflow because installation rate-limit failures are not findings. | |
| upload-sarif: false | |
| # Merge gating is done by central security-scan.yml with | |
| # --fail-on-vuln=true after printing package, version, OSV ID and aliases. | |
| fail-on-vuln: false |