From 6637729d2100ecdf0dc94aa3aecd917062fa482e Mon Sep 17 00:00:00 2001 From: Christoph Blecker Date: Tue, 10 Mar 2026 12:15:17 -0700 Subject: [PATCH] Modernize CI: harden workflow, replace JSON validator, add dependabot Upgrade checkout to v6 with persist-credentials: false, add read-only permissions, replace unmaintained Docker-based JSON validator with check-jsonschema, fix invalid \\! escape in schema email pattern, and add dependabot config for automated action updates. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Christoph Blecker --- .github/dependabot.yml | 6 ++++++ .github/workflows/validate.yml | 16 +++++++++++----- schema.json | 2 +- 3 files changed, 18 insertions(+), 6 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..5ace4600 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 4a71c495..b0700a47 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -2,13 +2,19 @@ name: Validate JSONs on: [pull_request] +permissions: + contents: read + jobs: verify-json-validation: runs-on: oracle-2cpu-8gb-x86-64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 + with: + persist-credentials: false + - uses: actions/setup-python@v6 + with: + python-version: '>= 3.14' + pip-install: check-jsonschema - name: Validate JSON - uses: docker://orrosenblatt/validate-json-action:latest - env: - INPUT_SCHEMA: /schema.json - INPUT_JSONS: /people.json + run: check-jsonschema --schemafile schema.json people.json diff --git a/schema.json b/schema.json index 5d61062c..eb3af731 100644 --- a/schema.json +++ b/schema.json @@ -18,7 +18,7 @@ "youtube": {"anyOf": [ { "maxLength": 0 }, {"type": "string", "format": "uri", "default": "null"} ] }, "priority": {"anyOf": [ { "maxLength": 0 }, { "type": "number" } ] }, "image": {"type": "string"}, - "email": {"type": "string", "pattern": "^[^\\s@]+\\![^\\s@]+\\.[^\\s@]+$"}, + "email": {"type": "string", "pattern": "^[^\\s@]+![^\\s@]+\\.[^\\s@]+$"}, "slack_id": {"type": "string"}, "category": { "type": "array",