add trufflehog, gitleaks, vulnix and grype packages #158
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint with statix | |
| on: | |
| push: | |
| paths: | |
| - "**.nix" | |
| workflow_dispatch: | |
| jobs: | |
| statix: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check Out Repository | |
| uses: actions/checkout@v4 | |
| - name: Set Up Nix | |
| uses: cachix/install-nix-action@master | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| - name: Run statix check | |
| uses: workflow/nix-shell-action@main | |
| continue-on-error: true | |
| with: | |
| packages: statix | |
| script: | | |
| statix check | |
| - name: Run statix fix | |
| uses: workflow/nix-shell-action@main | |
| with: | |
| packages: statix | |
| script: | | |
| statix fix | |
| # Import GPG key for signing commits | |
| - name: Import GPG key | |
| id: import-gpg | |
| uses: crazy-max/ghaction-import-gpg@v6 | |
| with: | |
| gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.PASSPHRASE }} | |
| git_user_signingkey: true | |
| git_commit_gpgsign: true | |
| - name: Commit and push changes | |
| uses: stefanzweifel/git-auto-commit-action@v5 | |
| with: | |
| commit_message: "lint with statix" | |
| commit_author: "${{ steps.import-gpg.outputs.name }} <${{ steps.import-gpg.outputs.email }}>" | |
| commit_user_name: ${{ steps.import-gpg.outputs.name }} | |
| commit_user_email: ${{ steps.import-gpg.outputs.email }} |