prowler/.github/workflows/pr-merged.yml at 7ceee1ee74bec3981369998e3298ab1fabad3651 · prowler-cloud/prowler · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
name: 'Tools: PR Merged'

on:
  # zizmor: ignore[dangerous-triggers] - intentional: needs read access to merged PR metadata, no PR code checkout
  pull_request_target:
    branches:
      - 'master'
    types:
      - 'closed'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  trigger-cloud-pull-request:
    if: |
      github.event.pull_request.merged == true &&
      github.repository == 'prowler-cloud/prowler' &&
      !contains(github.event.pull_request.labels.*.name, 'skip-sync')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443

      - name: Calculate short commit SHA
        id: vars
        run: |
          SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
          echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
        env:
          GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Trigger Cloud repository pull request
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
          repository: ${{ secrets.CLOUD_DISPATCH }}
          event-type: prowler-pull-request-merged
          client-payload: |
            {
              "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
              "PROWLER_COMMIT_SHORT_SHA": "${{ steps.vars.outputs.short_sha }}",
              "PROWLER_PR_NUMBER": "${{ github.event.pull_request.number }}",
              "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
              "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
              "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
              "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
              "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
              "PROWLER_PR_BASE_BRANCH": "${{ github.event.pull_request.base.ref }}",
              "PROWLER_PR_HEAD_BRANCH": "${{ github.event.pull_request.head.ref }}"
            }