# See .github/workflows/CheckBadMerge.groovy for explanation
name: Check bad merge commit
on:
  pull_request:
    types:
     - opened
     - synchronize

permissions: {}

jobs:
  check_pr_commits:
    permissions:
      contents: read
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up JDK 11

circle circus.museum cisco ciscofreak.com cistron.nl citadel citi citic city city.hu cityeats civilaviation.aero civilisation.museum civilization.museum civilwar.museum ck.ua cl cl.it claims clan.rip cleaning clerk.app clerkstage.app cleverapps.io click clicketcloud.com clickrising.net clinic clinique clinton.museum clock.museum clothing cloud cloud-fr1.unispace.io cloud.fedoraproject.org cloud.goog cloud.interhostsolutions.be cloud.jelastic.open.tim.it cloud.nospamproxy.com cloud66.ws cloud66.zone...

name: Check pulls metadata

on:
  pull_request_target:
    types: [ closed ]

permissions: {}

jobs:
  check_pull_metadata:
    permissions:
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      # Check that PRs have proper metadata: labels and milestone
      # https://github.com/gradle/issue-management-action/blob/main/src/pull-metadata.ts
      - uses: gradle/issue-management-action@v1

    outputs:
      matrix: ${{ steps.setup-matrix.outputs.matrix }}
      sys-prop-args: ${{ steps.determine-sys-prop-args.outputs.sys-prop-args }}

  sanity-check:
    name: "Sanity Check on Linux"
    permissions:
      contents: read
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: git clone
        uses: actions/checkout@v4
      - name: setup java

    # Note that AWS ELB will by default perform health checks on the first port
    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
    - port: 15021
      targetPort: 15021
      name: status-port
    - port: 80
      targetPort: 8080

      - name: Store coverage HTML
        uses: actions/upload-artifact@v3
        with:
          name: coverage-html
          path: htmlcov

  # https://github.com/marketplace/actions/alls-green#why
  check:  # This job does nothing and is only used for the branch protection
    if: always()
    needs:
      - coverage-combine
    runs-on: ubuntu-latest
    steps:
      - name: Dump GitHub context
        env:

                  set will be used only if the pools with priority can't be used.
                  If multiple matching IPAddressPools are available it will check
                  for the availability of IPs sorting the matching IPAddressPools
                  by priority, starting from the highest to the lowest. If multiple

# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:

# The original version of this file is located in the https://github.com/istio/common-files repo.
# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

ignored:
  - DL3008
  - DL3059

trustedRegistries:
  - gcr.io
  - docker.io
  - quay.io
  - "*.pkg.dev"

    # Note that AWS ELB will by default perform health checks on the first port
    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
    - port: 15021
      targetPort: 15021
      name: status-port
    - port: 80
      targetPort: 8080