mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
d7bf0df10b
Every workflow action is pinned to a commit SHA, dependabot auto-merge is limited to patch and minor updates behind the now-required status checks on main, and the audit, Trivy and ESLint gates block instead of warning. The published image finally carries its build SHA and build timestamp so the version endpoint can prove which commit is running. The API-token HMAC key fails closed under 32 characters, compose pins the database minor and denies privilege escalation, and the changelog drops working-note references in favour of neutral wording.
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
name: No TODO markers
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Product code is currently zero TODO / FIXME / XXX / HACK markers and
|
|
# the convention is to keep it that way — open a real follow-up issue
|
|
# instead of leaving a marker in the source. This gate fails fast if a
|
|
# future contributor reintroduces the pattern.
|
|
grep:
|
|
name: Forbidden marker grep
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Scan src/ for TODO/FIXME/XXX/HACK markers
|
|
run: |
|
|
# Tests are exempt — they can legitimately reference an outstanding
|
|
# ticket via a TODO; `src/generated/` is third-party output from
|
|
# `prisma generate` and is regenerated on every db:generate.
|
|
if grep -rEn "\b(TODO|FIXME|XXX|HACK)\b" src/ \
|
|
--include='*.ts' \
|
|
--include='*.tsx' \
|
|
--exclude-dir='__tests__' \
|
|
--exclude-dir='generated' \
|
|
--exclude='*.test.ts' \
|
|
--exclude='*.test.tsx'; then
|
|
echo "::error::TODO/FIXME/XXX/HACK markers detected in product code — open a follow-up issue instead."
|
|
exit 1
|
|
fi
|
|
echo "::notice::No forbidden markers in product code."
|