niriga

Like nixpkgs-review-gha, but simple/featureless and security-focused.

When used incorrectly, it is easy to have security vulnerabilities in GitHub Actions. Attackers can get your GitHub token or other secrets when that happens.

This project aims to only run nixpkgs-review against Nixpkgs PRs using GitHub Actions with security best practices, including but not limited to:

• GH_TOKEN with empty permissions
• No secrets
• No cache
• Dependencies pinned to git commit hash
• Dependencies regularly updated

1. Fork this project.
2. Enable "Dependabot version updates" in your fork.
3. Enable "Dependabot security updates" in your fork.
4. Go to the "Actions" tab in your fork and enable GitHub Actions.
5. To run nixpkgs-review against a Nixpkgs PR, run the nixpkgs-review workflow in your fork. The report is available in the "Show reports" step of the "Show reports" job after the workflow finishes.

This project is usable now.

This project is under development. Expect any kind of changes.

This project is inspired by nixpkgs-review-gha.

AGPL-3.0-or-later