verity-images/devbox.json at main · tektum/verity-images · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
{
  "packages": [
    "actionlint@1.7.12",
    "check-jsonschema@0.37.4",
    "findutils@4.10.0",
    "gnugrep@3.12",
    "jq@1.8.2",
    "melange",
    "python@3.13.14",
    "shellcheck@0.11.0",
    "uv@0.11.28",
    "yamllint@1.37.1",
    "ruff@0.15.22",
    "github:NixOS/nixpkgs/eaad089433ca2bb662274377d33df3d0e51ef28b#renovate"
  ],
  "shell": {
    "scripts": {
      "lint": [
        "renovate-config-validator --strict --no-global renovate.json",
        "renovate-config-validator --strict --no-global .github/renovate-apk.json",
        "renovate-config-validator --strict .github/renovate-global.json",
        "actionlint",
        "yamllint .",
        "git ls-files --cached --others --exclude-standard '*.sh' check | xargs shellcheck",
        "ruff check --isolated --no-cache scripts",
        "python3 scripts/gen_matrix.py --all >/dev/null",
        "python3 scripts/gen_apko_lock_targets.py --all >/dev/null",
        "python3 scripts/test_gen_matrix.py",
        "python3 scripts/test_gen_apk_matrix.py",
        "python3 scripts/test_gen_apko_lock_targets.py",
        "bash scripts/test_refresh_apko_locks.sh",
        "bash scripts/test_renovate_refresh_apko_locks.sh",
        "python3 scripts/check_readme_refs.py",
        "scripts/test_build_catalog.sh",
        "scripts/test_cancel_stalled_jobs.sh",
        "scripts/test_dispatch_catalog_catchup.sh",
        "scripts/test_attest_sboms.sh",
        "scripts/test_evaluate_scan_gate.sh",
        "python3 scripts/test_update_go_release_checksums.py",
        "scripts/test_install_image_tools.sh",
        "scripts/test_monitor_sboms.sh",
        "python3 scripts/test_classify_monitor_remediation.py",
        "scripts/test_dispatch_vulnerability_rebuilds.sh",
        "python3 scripts/test_build_monitor_sarif.py",
        "python3 scripts/test_build_monitor_inventory.py",
        "python3 scripts/test_select_monitor_shards.py",
        "python3 scripts/test_build_image_dashboard.py",
        "scripts/test_parse_push_digest.sh",
        "scripts/test_replace_gosu.sh",
        "scripts/test_apk_repository.sh",
        "python3 scripts/test_compose_apk_inputs.py && printf '%s\\n' 'passed scripts/test_compose_apk_inputs.py'",
        "python3 scripts/test_assemble_apk_snapshot.py && printf '%s\\n' 'passed scripts/test_assemble_apk_snapshot.py'",
        "check-jsonschema --schemafile packages/repository-state.schema.json packages/repository-state.json",
        "check-jsonschema --schemafile packages/repository-state.schema.json packages/repository-state.pin.json",
        "python3 scripts/test_repository_state.py",
        "python3 scripts/test_catalog_pages.py",
        "bash scripts/test_prepare_apk_signing_key.sh",
        "bash scripts/test_build_apk_package.sh",
        "bash scripts/test_validate_artifact_digest.sh",
        "bash scripts/test_reserve_apk_release_identity.sh",
        "bash scripts/test_build_report_filter.sh",
        "python3 scripts/test_apk_release_workflow.py",
        "python3 scripts/test_apk_replacement_inputs.py",
        "bash scripts/test_build_candidate.sh",
        "python3 scripts/test_shared_ci.py",
        "python3 scripts/test_renovate_helpers.py",
        "python3 scripts/test_validate_security_floor_pr.py",
        "python3 scripts/test_go_remediation.py",
        "python3 scripts/test_cargo_remediation.py",
        "python3 scripts/test_cargo_omnibump_contract.py",
        "bash scripts/test_fips_foundation.sh",
        "python3 scripts/test_fips_matrix.py",
        "python3 scripts/test_workflow_policy.py",
        "if LC_ALL=C grep -PRn '[^\\x00-\\x7F]' --exclude-dir=.codegraph --exclude-dir=.devbox --exclude-dir=.git --exclude-dir=.omo --exclude-dir=.venv --exclude-dir=.wrangler --exclude-dir=node_modules --include='*.md' --include='*.yaml' --include='*.yml' --include='*.py' --include='*.sh' .; then exit 1; fi",
        "if grep -PRn 'uses:\\s+(?!\\./)[^[:space:]@]+@(?![0-9a-f]{40}(?:[[:space:]]|$))' --include='*.yaml' --include='*.yml' .github; then exit 1; fi"
      ]
    }
  }
}