ci: right-size OpenGrep PR scan · openclaw/openclaw@005eeca
vincentkoc
·
2026-04-30
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -9,23 +9,38 @@ name: OpenGrep — PR Diff
|
9 | 9 | |
10 | 10 | on: |
11 | 11 | pull_request: |
| 12 | +types: [opened, synchronize, reopened, ready_for_review] |
| 13 | +paths: |
| 14 | + - ".github/workflows/opengrep-precise.yml" |
| 15 | + - ".github/workflows/opengrep-precise-full.yml" |
| 16 | + - ".semgrepignore" |
| 17 | + - "apps/**" |
| 18 | + - "extensions/**" |
| 19 | + - "packages/**" |
| 20 | + - "scripts/**" |
| 21 | + - "security/opengrep/**" |
| 22 | + - "src/**" |
12 | 23 | |
13 | 24 | concurrency: |
14 | 25 | group: opengrep-pr-diff-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} |
15 | 26 | cancel-in-progress: true |
16 | 27 | |
| 28 | +env: |
| 29 | +FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" |
| 30 | + |
17 | 31 | permissions: |
18 | 32 | contents: read |
19 | 33 | security-events: write |
20 | 34 | |
21 | 35 | jobs: |
22 | 36 | scan: |
23 | 37 | name: Scan changed paths (precise) |
24 | | -runs-on: blacksmith-16vcpu-ubuntu-2404 |
| 38 | +if: ${{ !github.event.pull_request.draft }} |
| 39 | +runs-on: blacksmith-4vcpu-ubuntu-2404 |
25 | 40 | timeout-minutes: 30 |
26 | 41 | steps: |
27 | 42 | - name: Checkout |
28 | | -uses: actions/checkout@v4 |
| 43 | +uses: actions/checkout@v6 |
29 | 44 | with: |
30 | 45 | persist-credentials: false |
31 | 46 | # `scripts/run-opengrep.sh --changed` diffs base...HEAD. |
|
59 | 74 | scripts/run-opengrep.sh --changed --sarif --error |
60 | 75 | |
61 | 76 | - name: Upload SARIF to GitHub Code Scanning |
62 | | -uses: github/codeql-action/upload-sarif@v3 |
| 77 | +uses: github/codeql-action/upload-sarif@v4 |
63 | 78 | # Only upload if the scan actually produced a SARIF file. |
64 | 79 | if: always() && hashFiles('.opengrep-out/precise.sarif') != '' |
65 | 80 | with: |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
