Pillow/.github/workflows/tidelift.yml

name: Tidelift Align
on:
  schedule:
    - cron: "30 2 * * *"  # daily at 02:30 UTC
  push:
    paths:
      - "Pipfile*"
      - ".github/workflows/tidelift.yml"
  pull_request:
    paths:
      - "Pipfile*"
      - ".github/workflows/tidelift.yml"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    if: github.repository_owner == 'python-pillow'
    name: Run Tidelift to ensure approved open source packages are in use
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Scan
        uses: tidelift/alignment-action@main
        env:
          TIDELIFT_API_KEY: ${{ secrets.TIDELIFT_API_KEY }}
          TIDELIFT_ORGANIZATION: team/aclark4life
          TIDELIFT_PROJECT: pillow
Create tidelift.yml 2021-10-14 20:42:18 +03:00			`name: Tidelift Align`
Add hugovk suggestion 2021-12-01 21:58:13 +03:00			`on:`
			`schedule:`
			`- cron: "30 2 * * *" # daily at 02:30 UTC`
			`push:`
			`paths:`
Run Tidelift Align on Pipfile changes 2022-04-18 12:10:11 +03:00			`- "Pipfile*"`
Add hugovk suggestion 2021-12-01 21:58:13 +03:00			`- ".github/workflows/tidelift.yml"`
			`pull_request:`
			`paths:`
Run Tidelift Align on Pipfile changes 2022-04-18 12:10:11 +03:00			`- "Pipfile*"`
Add hugovk suggestion 2021-12-01 21:58:13 +03:00			`- ".github/workflows/tidelift.yml"`
			`workflow_dispatch:`
Create tidelift.yml 2021-10-14 20:42:18 +03:00
chore: Set permissions for GitHub actions Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com> 2022-07-04 04:19:58 +03:00			`permissions:`
			`contents: read`

Create tidelift.yml 2021-10-14 20:42:18 +03:00			`jobs:`
			`build:`
Don't run for forks: missing secrets would fail 2021-10-14 23:00:02 +03:00			`if: github.repository_owner == 'python-pillow'`
Create tidelift.yml 2021-10-14 20:42:18 +03:00			`name: Run Tidelift to ensure approved open source packages are in use`
			`runs-on: ubuntu-latest`
			`steps:`
			`- name: Checkout`
Updated setup-python, checkout and upload-artifact actions to v3 2022-03-04 12:04:12 +03:00			`uses: actions/checkout@v3`
Create tidelift.yml 2021-10-14 20:42:18 +03:00			`- name: Scan`
Update .github/workflows/tidelift.yml Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> 2021-12-02 01:05:02 +03:00			`uses: tidelift/alignment-action@main`
Create tidelift.yml 2021-10-14 20:42:18 +03:00			`env:`
			`TIDELIFT_API_KEY: ${{ secrets.TIDELIFT_API_KEY }}`
Not deprecated, re-add org and proj 2021-12-01 22:15:40 +03:00			`TIDELIFT_ORGANIZATION: team/aclark4life`
			`TIDELIFT_PROJECT: pillow`