The latest-state copy of a record is slimmed too #2714
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Governance | |
| # Additive OSS-governance gates: SPDX license-header enforcement on Rust | |
| # sources and forward-looking secret scanning. Both jobs are dependency-light | |
| # (no Rust toolchain, no private git dependencies) so they stay green on any | |
| # runner. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| license-headers: | |
| name: license headers (SPDX) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify SPDX Apache-2.0 header on all Rust sources | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| files=$(git ls-files 'crates/**/*.rs' 'sdk/**/*.rs') | |
| if [ -z "$files" ]; then | |
| echo "No Rust sources found."; exit 0 | |
| fi | |
| missing=$(grep -L 'SPDX-License-Identifier: Apache-2.0' $files || true) | |
| if [ -n "$missing" ]; then | |
| echo "The following Rust sources are missing the SPDX Apache-2.0 header:" | |
| echo "$missing" | |
| exit 1 | |
| fi | |
| echo "OK: all $(echo "$files" | wc -l) Rust sources carry the SPDX Apache-2.0 header." | |
| secret-scan: | |
| name: secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| # Run the gitleaks CLI directly (pinned) rather than gitleaks-action@v2: | |
| # the action wrapper does not reliably apply the repo-root .gitleaks.toml | |
| # allowlist, and the CLI invocation below is exactly what maintainers run | |
| # locally to validate the same allowlist against full history. | |
| - name: Run gitleaks | |
| run: | | |
| set -euo pipefail | |
| VERSION=8.18.4 | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| tar -xzf /tmp/gitleaks.tgz -C /tmp gitleaks | |
| /tmp/gitleaks detect --source . --config .gitleaks.toml --redact --no-banner --exit-code 1 |