|
15 | 15 | run_tests: |
16 | 16 | description: 'Run tests' |
17 | 17 | required: false |
18 | | - default: 'true' |
| 18 | + default: true |
19 | 19 | type: boolean |
20 | 20 | run_security: |
21 | 21 | description: 'Run security scan' |
22 | 22 | required: false |
23 | | - default: 'true' |
| 23 | + default: true |
24 | 24 | type: boolean |
25 | 25 |
|
26 | 26 | # Add explicit permissions for security features |
|
43 | 43 | ( |
44 | 44 | github.actor == 'github-actions[bot]' || |
45 | 45 | github.actor == 'dependabot[bot]' || |
| 46 | + github.actor == 'doljae' || |
| 47 | + startsWith(github.event.pull_request.head.ref, 'release/') || |
46 | 48 | github.event.pull_request.head.repo.full_name == github.repository |
47 | 49 | ) |
48 | 50 | ) || |
@@ -98,7 +100,22 @@ jobs: |
98 | 100 | # Only run security scanning on public repositories or when explicitly enabled |
99 | 101 | if: > |
100 | 102 | (github.event.repository.private == false || github.event_name == 'schedule') && |
101 | | - (github.event_name != 'workflow_dispatch' || github.event.inputs.run_security == 'true') |
| 103 | + (github.event_name != 'workflow_dispatch' || github.event.inputs.run_security == 'true') && |
| 104 | + ( |
| 105 | + github.event_name == 'pull_request' || |
| 106 | + ( |
| 107 | + github.event_name == 'pull_request_target' && |
| 108 | + ( |
| 109 | + github.actor == 'github-actions[bot]' || |
| 110 | + github.actor == 'dependabot[bot]' || |
| 111 | + github.actor == 'doljae' || |
| 112 | + startsWith(github.event.pull_request.head.ref, 'release/') || |
| 113 | + github.event.pull_request.head.repo.full_name == github.repository |
| 114 | + ) |
| 115 | + ) || |
| 116 | + github.event_name == 'push' || |
| 117 | + github.event_name == 'schedule' |
| 118 | + ) |
102 | 119 | |
103 | 120 | steps: |
104 | 121 | - name: Checkout code |
@@ -126,7 +143,22 @@ jobs: |
126 | 143 | runs-on: ubuntu-latest |
127 | 144 | if: > |
128 | 145 | github.event.repository.private == true && |
129 | | - (github.event_name != 'workflow_dispatch' || github.event.inputs.run_security == 'true') |
| 146 | + (github.event_name != 'workflow_dispatch' || github.event.inputs.run_security == 'true') && |
| 147 | + ( |
| 148 | + github.event_name == 'pull_request' || |
| 149 | + ( |
| 150 | + github.event_name == 'pull_request_target' && |
| 151 | + ( |
| 152 | + github.actor == 'github-actions[bot]' || |
| 153 | + github.actor == 'dependabot[bot]' || |
| 154 | + github.actor == 'doljae' || |
| 155 | + startsWith(github.event.pull_request.head.ref, 'release/') || |
| 156 | + github.event.pull_request.head.repo.full_name == github.repository |
| 157 | + ) |
| 158 | + ) || |
| 159 | + github.event_name == 'push' || |
| 160 | + github.event_name == 'schedule' |
| 161 | + ) |
130 | 162 | |
131 | 163 | steps: |
132 | 164 | - name: Checkout code |
|
0 commit comments