Remove GitHub workflow metadata
ober
b5af8643195f2da7095f2019797d8f0df55c853d
deleted file mode 100644 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: CI - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -env: - JERBOA_VERSION: v0.2.3 - JERBUILD: ${{ github.workspace }}/.jerboa/bin/jerbuild - JERBOA_SSL_REPO: https://git.sr.ht/~lisp/jerboa-ssl - JERBOA_MAIL_REPO: https://git.sr.ht/~lisp/jerboa-mail - JERBOA_SSL_DIR: ${{ github.workspace }}/.deps/jerboa-ssl - JERBOA_MAIL_DIR: ${{ github.workspace }}/.deps/jerboa-mail - -jobs: - build-and-test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - - name: Install system tools - run: | - set -eu - sudo apt-get update - sudo apt-get install -y --no-install-recommends build-essential git curl ca-certificates libssl-dev - - - name: Install Jerboa toolchain - run: sh support/ensure-jerboa.sh "$JERBOA_VERSION" .jerboa/bin support/jerboa-toolchain.lock - - - name: Fetch dependencies - run: | - set -eu - mkdir -p .deps - support/locked-dependency.sh fetch dependencies.lock jerboa-ssl "$JERBOA_SSL_DIR" - support/locked-dependency.sh fetch dependencies.lock jerboa-mail "$JERBOA_MAIL_DIR" - - - name: Release evidence - run: make release-evidence deleted file mode 100644 --- a/.github/workflows/security-baseline.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Security Baseline - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - baseline: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - - name: Required release files - run: | - set -eu - test -f LICENSE - test -f SECURITY.md - test -f .gitignore - find . -maxdepth 1 -iname "README*" -type f | grep -q . - - - name: High-confidence secret scan - run: | - set -eu - pattern="(BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-(ant-api03|proj|svcacct)-[A-Za-z0-9_-]{30,}|AKIA[0-9A-Z]{16})" - matches="$(git grep -n -I -E "$pattern" -- . ":!*.png" ":!*.jpg" ":!*.jpeg" ":!*.gif" ":!*.so" ":!*.dylib" ":!*.o" ":!*.a" ":!*.boot" ":!*.tar.gz" || true)" - if [ -n "$matches" ]; then - echo "$matches" - echo "High-confidence secret pattern found." - exit 1 - fi - - - name: Security policy regression gate - run: make security