sethvargo / ratchet

A tool for securing CI/CD workflows with version pinning.
Apache License 2.0
771 stars 32 forks source link

provide new 'check' subcommand #6

Closed Dentrax closed 2 years ago

Dentrax commented 2 years ago

I was reading the README and understanding the overall mental model. And this is very promising, thanks for the project.


It would be great to have a new subcommand called check. So, what is check?

# checks the input file for all pinned values
# if we found _any_ "unpinned" version, exists 1.
# if everything is already pinned, exists 0.
$ ratchet check workflow.yml

By doing so, we can create a ratchet-github-action to include this check in our CI/CD process. Workflow will eventually fail if someone tries to push "unpinned" value.

If you like the idea, we can (@developer-guy) work on this!