fix(ui): enforce 100-char limit on mute rule name input #9318
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Tools: Check Changelog' | |
| on: | |
| pull_request: | |
| types: | |
| - 'opened' | |
| - 'synchronize' | |
| - 'reopened' | |
| - 'labeled' | |
| - 'unlabeled' | |
| branches: | |
| - 'master' | |
| - 'v5.*' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| check-changelog: | |
| if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| env: | |
| MONITORED_FOLDERS: 'api ui prowler mcp_server' | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 1 | |
| # zizmor: ignore[artipacked] | |
| persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch | |
| - name: Fetch PR base ref for tj-actions/changed-files | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: git fetch --depth=1 origin "${BASE_REF}" | |
| - name: Get changed files | |
| id: changed-files | |
| uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5 | |
| with: | |
| files: | | |
| api/** | |
| ui/** | |
| prowler/** | |
| mcp_server/** | |
| poetry.lock | |
| pyproject.toml | |
| - name: Check for folder changes and changelog presence | |
| id: check-folders | |
| run: | | |
| missing_changelogs="" | |
| if [[ "${STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED}" == "true" ]]; then | |
| # Check monitored folders | |
| for folder in $MONITORED_FOLDERS; do | |
| # Get files changed in this folder | |
| changed_in_folder=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^${folder}/" || true) | |
| if [ -n "$changed_in_folder" ]; then | |
| echo "Detected changes in ${folder}/" | |
| # Check if CHANGELOG.md was updated | |
| if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then | |
| echo "No changelog update found for ${folder}/" | |
| missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n' | |
| fi | |
| fi | |
| done | |
| # Check root-level dependency files (poetry.lock, pyproject.toml) | |
| # These are associated with the prowler folder changelog | |
| root_deps_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep -E "^(poetry\.lock|pyproject\.toml)$" || true) | |
| if [ -n "$root_deps_changed" ]; then | |
| echo "Detected changes in root dependency files: $root_deps_changed" | |
| # Check if prowler/CHANGELOG.md was already updated (might have been caught above) | |
| prowler_changelog_updated=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^prowler/CHANGELOG.md$" || true) | |
| if [ -z "$prowler_changelog_updated" ]; then | |
| # Only add if prowler wasn't already flagged | |
| if ! echo "$missing_changelogs" | grep -q "prowler"; then | |
| echo "No changelog update found for root dependency changes" | |
| missing_changelogs="${missing_changelogs}- \`prowler\` (root dependency files changed)"$'\n' | |
| fi | |
| fi | |
| fi | |
| fi | |
| { | |
| echo "missing_changelogs<<EOF" | |
| echo -e "${missing_changelogs}" | |
| echo "EOF" | |
| } >> $GITHUB_OUTPUT | |
| env: | |
| STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED: ${{ steps.changed-files.outputs.any_changed }} | |
| STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }} | |
| - name: Find existing changelog comment | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| id: find-comment | |
| uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-author: 'github-actions[bot]' | |
| body-includes: '<!-- changelog-check -->' | |
| - name: Update PR comment with changelog status | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-id: ${{ steps.find-comment.outputs.comment-id }} | |
| edit-mode: replace | |
| body: | | |
| <!-- changelog-check --> | |
| ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠️ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:** | |
| {0} | |
| Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }} | |
| - name: Fail if changelog is missing | |
| if: steps.check-folders.outputs.missing_changelogs != '' | |
| run: | | |
| echo "::error::Missing changelog updates in some folders" | |
| exit 1 |