todos.yml

name: "Analysis: TODO"

on:
  push:
    branches:
      - main

concurrency:
  group: ${{github.workflow}}-${{github.ref}}
  cancel-in-progress: true

permissions:
  issues: write
  repository-projects: read
  contents: read

jobs:
  todos:
    runs-on: ubuntu-latest

    steps:
      - name: "Harden Security"
        uses: step-security/harden-runner@v2.10.2
        with:
          egress-policy: block
          disable-sudo: true
          allowed-endpoints: >
            api.github.com:443
            api.osv.dev:443
            api.securityscorecards.dev:443
            codeload.github.com:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443

      - name: "Checkout code"
        uses: actions/checkout@v4.1.1
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: "Seach for TODOS"
        uses: derjuulsn/todo-issue@main
        with:
          excludePattern: '(node_modules/)'
          autoAssign: 'true'
          keywords: 'TODO'
          blobLines: 7
          blobLinesBefore: 2
          caseSensitive: false
          label: true
          reopenClosed: true

        env:
          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}}