mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-13 00:34:43 +00:00
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: Repo Boundary Audit
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Install boundary audit dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --yes --no-install-recommends ripgrep
|
|
|
|
- name: Run Boundary Audit (report mode)
|
|
run: |
|
|
./scripts/audit-private-boundary.sh | tee repo-boundary-audit.txt
|
|
|
|
- name: Enforce API Import Boundary
|
|
run: ./scripts/audit-private-boundary.sh --enforce-api-imports
|
|
|
|
- name: Enforce API Root Import Boundary
|
|
run: ./scripts/audit-private-boundary.sh --enforce-api-root-imports
|
|
|
|
- name: Enforce Non-API Import Boundary
|
|
run: ./scripts/audit-private-boundary.sh --enforce-nonapi-imports
|
|
|
|
- name: Enforce API pkg/licensing Bridge Boundary
|
|
run: ./scripts/audit-private-boundary.sh --enforce-api-pkg-licensing-imports
|
|
|
|
- name: Enforce Paid Surface Allowlist Integrity
|
|
run: ./scripts/audit-private-boundary.sh --enforce-paid-surface-allowlist
|
|
|
|
- name: Enforce No Paid-Domain Leaks Outside Allowlist
|
|
run: ./scripts/audit-private-boundary.sh --enforce
|
|
|
|
- name: Upload Audit Report
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: repo-boundary-audit
|
|
path: repo-boundary-audit.txt
|