mirror of
https://github.com/comfyanonymous/ComfyUI.git
synced 2026-06-01 11:57:24 +08:00
668cb0748e
Best-practice hardening for the caller of the reusable detector workflow: - Replace @v1 tag with the immutable commit SHA 5d9602ee... (# v1 comment preserves human-readable version info). Satisfies pin-validation tools like pinact and zizmor. - Add explicit minimum permissions (contents: read, pull-requests: read) at workflow level so the default permissive token scope is not granted.
25 lines
631 B
YAML
25 lines
631 B
YAML
name: Detect Unreviewed Merge
|
|
|
|
# SOC 2 compliance — reusable workflow lives in Comfy-Org/github-workflows,
|
|
# tracking issues are filed in Comfy-Org/unreviewed-merges.
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
|
|
concurrency:
|
|
group: detect-unreviewed-merge-${{ github.sha }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
detect:
|
|
uses: Comfy-Org/github-workflows/.github/workflows/detect-unreviewed-merge.yml@5d9602ee861466a7873270cd6b2037ebdfdee9a3 # v1
|
|
with:
|
|
approval-mode: latest-per-reviewer
|
|
secrets:
|
|
UNREVIEWED_MERGES_TOKEN: ${{ secrets.UNREVIEWED_MERGES_TOKEN }}
|