bf6b353b52
The lean cut removed scan-darkwing-portable.yml and scan-darkwing-pr.yml from
main on the reasoning that they name an internal scanner and so are
site-specific tooling rather than product. That reasoning was wrong, and it
showed up as scan-darkwing.cmd failing with
HTTP 422: Workflow does not have 'workflow_dispatch' trigger
because the command dispatches against the DEFAULT branch and the file was no
longer there.
A CI workflow is repository infrastructure, not shipped product. It never
reaches a receiving site, so "does a site need this file" is the wrong question
to ask about it - and main is the branch a site pulls FROM, which makes it the
last place that should lose its scanning. Removing them turned security scanning
off on the default branch silently: nothing failed, no test covered it, and the
only signal was a dispatch error days later.
Both restored unchanged. scan-darkwing-portable.yml carries the
workflow_dispatch trigger the command calls; scan-darkwing-pr.yml runs on
pull_request. Neither references anything the lean cut removed.
Checked the rest of .github/ for the same mistake: the only other difference
from the site line is GE-ENFORCE-COLLECTOR-FIX.html, which is correctly absent
because the geenforce plugin is not bundled here.
33 lines
1.0 KiB
YAML
33 lines
1.0 KiB
YAML
# Darkwing vulnerability scan, manual dispatch.
|
|
#
|
|
# Copied verbatim from the ge-aero/darkwing README so it stays byte-identical
|
|
# to the sanctioned integration. Do not edit this file to add triggers or
|
|
# gating - see scan-darkwing-pr.yml for that, which is ours to change.
|
|
#
|
|
# The file must sit on the default branch before a scan can run on ANY branch.
|
|
name: Scan (darkwing, portable)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
target_ref:
|
|
description: Ref, branch, or sha of this repo to scan
|
|
required: false
|
|
type: string
|
|
default: main
|
|
|
|
permissions:
|
|
contents: read # checkout this repo via the ambient GITHUB_TOKEN
|
|
security-events: write # SARIF upload to the Security tab
|
|
actions: read # required by upload-sarif on private/internal repos
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: darkwing-scan
|
|
steps:
|
|
# @v1 is a moving tag pointing to the latest release that is compatible
|
|
# with this workflow file.
|
|
- uses: ge-aero/darkwing@v1
|
|
with:
|
|
target_ref: ${{ inputs.target_ref || 'main' }}
|