Daily Website Security Check #144
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| # SPDX-FileCopyrightText: 2025-2026 Kaito Udagawa <umireon@kaito.tokyo> | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Daily Website Security Check | |
| # file: .github/workflows/daily-website-security-check.yml | |
| # author: Kaito Udagawa <umireon@kaito.tokyo> | |
| # version: 1.0.0 | |
| # date: 2026-04-17 | |
| on: | |
| schedule: | |
| - cron: "23 11 * * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: false | |
| jobs: | |
| security-check: | |
| name: Run Security Check | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 10 | |
| permissions: | |
| attestations: read | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Run Security Check | |
| shell: bash --noprofile --norc -euo pipefail -O nullglob {0} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| PRODUCTION_BASE_URL="https://$GITHUB_REPOSITORY_OWNER.github.io/${GITHUB_REPOSITORY#*/}" | |
| curl --retry 3 -fsS \ | |
| -O "$PRODUCTION_BASE_URL/provenance.json" \ | |
| -O "$PRODUCTION_BASE_URL/provenance.attestation.json" | |
| GH_FORCE_TTY="100%" gh attestation verify provenance.json \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --bundle provenance.attestation.json | |
| rm -rf site | |
| mkdir -p site | |
| jq -r --arg base "$PRODUCTION_BASE_URL" ' | |
| .subject[] | | |
| .name as $url | | |
| ($url | sub($base; "")) as $path | | |
| "url = \"\($url)\"", | |
| "output = \"site/\($path)\"", | |
| "create-dirs" | |
| ' provenance.json | curl --retry 3 -fsS -K - | |
| jq -r --arg base "$PRODUCTION_BASE_URL" ' | |
| .subject[] | | |
| (.name | sub($base; "")) as $path | | |
| "\(.digest.sha384) site/\($path)" | |
| ' provenance.json > SHA384SUMS.txt | |
| sha384sum --check --strict SHA384SUMS.txt |