Add digger workflow

.github/workflows/digger.yml

@@ -0,0 +1,38 @@
+name: Digger Workflow
+
+on:
+  pull_request:
+    types: [ closed, opened, synchronize, reopened ]
+
+  # Only used with a backend github app
+  workflow_dispatch:
+    inputs:
+      spec:
+        required: true
+      run_name:
+        required: false
+
+jobs:
+  digger-job:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write      # required to merge PRs
+      actions: write       # required for plan persistence
+      id-token: write      # required for workload-identity-federation
+      pull-requests: write # required to post PR comments
+      issues: read         # required to check if PR number is an issue or not
+      statuses: write      # required to validate combined PR status
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897
+        with:
+          digger-spec: ${{ inputs.spec }}
+          digger-version: v0.6.128
+          setup-terraform: true
+          no-backend: true
+          terraform-version: 1.13.3
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -1 +1,29 @@
-# test-allowed-gha
+# Allowed GHA Testing
+
+
+```
+diggerhq/digger@bd1a54120e1fe0e410e84b6d9a5e9bbcce7f3897,
+autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e,
+opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716,
+rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627,
+```
+
+The following are allowed by enabling verified creators and official actions
+
+```
+hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+pulumi/actions@a3f382e1242b69ab33854c253c3b580f1226348e
+actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830,
+actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830,
+actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955,
+actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b,
+actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5,
+```
+
+##
+
+Test allowed list:
+
+```
+docker/build-push-action@v3, docker/build-push-action@v5, docker/login-action@v2, docker/login-action@v3, docker/metadata-action@v3, docker/metadata-action@v5, docker/setup-buildx-action@v2, docker/setup-buildx-action@v3, dtolnay/rust-toolchain@stable, hashicorp/setup-terraform@v2, int128/docker-build-cache-config-action@v1, jdx/mise-action@v2, jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566, jwalton/gh-docker-logs@v2, ludeeus/action-shellcheck@master, meteorengineer/setup-meteor@v1, naveenk1223/action-pr-title@master, peter-evans/create-or-update-comment@v4, pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd, psf/black@23.9.1, psf/black@24.1.1, psf/black@stable, reproducible-containers/buildkit-cache-dance@v3, softprops/action-gh-release@v1, svenstaro/upload-release-action@v2, terraform-linters/setup-tflint@v4, terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6, theappnest/terraform-monorepo-action@master, tibdex/github-app-token@v2, tj-actions/changed-files@b1ba699b304f2083b602164e06a89b868c84f076, toshimaru/auto-author-assign@v1.6.0, vemonet/setup-spark@v1, autero1/action-terragrunt@aefb0a43c4f5503a91fefb307745c4d51c26ed0e, opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716, rhythmictech/actions-setup-tfenv@ef1296cdbec243306d3a3d31909582ca1eeb4627
+```