Self-lint nightly #104
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Self-lint nightly | |
| on: | |
| schedule: | |
| - cron: "0 6 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-sigmahq: | |
| name: Lint SigmaHQ/sigma corpus | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.11" | |
| - name: Install sigmalint from source | |
| run: pip install -e ".[dev]" | |
| - name: Clone SigmaHQ corpus | |
| id: clone | |
| run: | | |
| set -euo pipefail | |
| git clone --depth 1 https://github.com/SigmaHQ/sigma.git sigmahq | |
| sha=$(git -C sigmahq rev-parse HEAD) | |
| echo "sha=$sha" >> "$GITHUB_OUTPUT" | |
| echo "Cloned SigmaHQ/sigma at $sha" | |
| - name: Run sigmalint over corpus | |
| id: lint | |
| run: | | |
| set +e | |
| sigmalint lint sigmahq/rules --format json --fail-on never > report.json | |
| rc=$? | |
| echo "rc=$rc" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| - name: Summarize | |
| if: always() | |
| run: | | |
| set -euo pipefail | |
| mean=$(python -c "import json; r=json.load(open('report.json')); s=r.get('summary',{}); print(s.get('mean_score'))") | |
| files=$(python -c "import json; r=json.load(open('report.json')); print(len(r.get('files',[])))") | |
| { | |
| echo "## sigmalint nightly self-lint" | |
| echo "" | |
| echo "- SigmaHQ/sigma commit: \`${{ steps.clone.outputs.sha }}\`" | |
| echo "- Files scanned: $files" | |
| echo "- Mean score: $mean" | |
| echo "- CLI exit code: ${{ steps.lint.outputs.rc }}" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload report | |
| if: always() | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: sigmalint-corpus-report | |
| path: report.json |