Repository navigation

cra-triage-main #96

	# Copy to .github/workflows/cra-triage-main.yml in each repository. Polls the
	# default branch's alerts once a day and mirrors them to issues, using
	# the triage code from cra-gates. Dependabot alerts need a token with the
	# Dependabot alerts permission: add a fine grained token as the TRIAGE_TOKEN
	# secret (Dependabot alerts: read, Issues: write). Without it the run still
	# reconciles code scanning alerts and warns about the rest.
	name: cra-triage-main

	on:
	schedule:
	- cron: "23 5 * * *"
	workflow_dispatch:

	permissions:
	contents: read
	issues: write
	security-events: read

	concurrency:
	group: cra-triage-main
	cancel-in-progress: false

	jobs:
	reconcile:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	fetch-depth: 0

	- name: Fetch the triage code and vector table
	uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	repository: cybertec-postgresql/cra-gates
	ref: 9845b5e227e276ac60d06fd7df8e6c1572905432
	path: .cra-gates

	# PYTHONSAFEPATH keeps this repository's own directory off the import
	# path, so a stale triage/ folder here cannot shadow the cra-gates code.
	- name: Check triage configuration
	env:
	PYTHONSAFEPATH: "1"
	run: PYTHONPATH=.cra-gates python3 -m triage check

	- name: Reconcile alerts with issues
	env:
	PYTHONSAFEPATH: "1"
	GITHUB_TOKEN: ${{ secrets.TRIAGE_TOKEN \|\| secrets.GITHUB_TOKEN }}
	TRIAGE_DEFAULT_ASSIGNEE: ${{ vars.TRIAGE_DEFAULT_ASSIGNEE }}
	run: PYTHONPATH=.cra-gates python3 -m triage main --repo-dir .