99permissions :
1010 contents : read
1111jobs :
12- install-check :
12+ secure- install-check :
1313 name : Secure Install Check
1414 runs-on : ${{ matrix.os }}
1515 strategy :
@@ -19,21 +19,24 @@ jobs:
1919 - name : Checkout PR branch with full history
2020 uses : actions/checkout@v3
2121 with :
22- fetch-depth : 0 # full history for accurate diffing
22+ fetch-depth : 0
2323 - name : Add upstream remote and fetch base branch
24+ shell : bash
2425 run : |
2526 git remote add upstream https://github.com/${{ github.repository }}.git
2627 git fetch upstream master
2728 - name : Detect fork
2829 id : forkcheck
30+ shell : pwsh
2931 run : |
30- if [ "${{ github.repository }}" != "${{ github.event.pull_request.head.repo.full_name }}" ]; then
31- echo "is_fork=true" >> $GITHUB_OUTPUT
32- else
33- echo "is_fork=false" >> $GITHUB_OUTPUT
34- fi
32+ if ( "${{ github.repository }}" -ne "${{ github.event.pull_request.head.repo.full_name }}") {
33+ "is_fork=true" >> $env: GITHUB_OUTPUT
34+ } else {
35+ "is_fork=false" >> $env: GITHUB_OUTPUT
36+ }
3537 - name : Check if install scripts were modified
3638 id : filecheck
39+ shell : bash
3740 run : |
3841 MODIFIED=$(git diff --name-only upstream/master HEAD)
3942 echo "$MODIFIED"
@@ -44,14 +47,17 @@ jobs:
4447 fi
4548 - name : Decide whether to run scripts
4649 id : safecheck
50+ shell : pwsh
4751 run : |
48- if [ "${{ steps.filecheck.outputs.scripts_modified }}" = "false" ]; then
49- echo "safe=true" >> $GITHUB_OUTPUT
50- elif [ "${{ steps.forkcheck.outputs.is_fork }}" = "false" ]; then
51- echo "safe=true" >> $GITHUB_OUTPUT
52- else
53- echo "safe=false" >> $GITHUB_OUTPUT
54- fi
52+ if ("${{ steps.filecheck.outputs.scripts_modified }}" -eq "false") {
53+ "safe=true" >> $env:GITHUB_OUTPUT
54+ } elseif ("${{ github.event_name }}" -eq "push") {
55+ "safe=true" >> $env:GITHUB_OUTPUT
56+ } elseif ("${{ steps.forkcheck.outputs.is_fork }}" -eq "false") {
57+ "safe=true" >> $env:GITHUB_OUTPUT
58+ } else {
59+ "safe=false" >> $env:GITHUB_OUTPUT
60+ }
5561 - name : Execute install scripts
5662 if : steps.safecheck.outputs.safe == 'true'
5763 shell : pwsh
0 commit comments