.github/workflows/validate.yml #390

	on:
	pull_request_review:
	types: [submitted]

	permissions:
	contents: read

	jobs:
	validate:
	if: github.event.review.state == 'approved' && github.event.pull_request.head.repo.fork == false
	name: Validate
	runs-on: ubuntu-latest
	env:
	API_HOST: ${{ secrets.API_HOST }}
	API_TOKEN: ${{ secrets.API_TOKEN }}
	steps:
	- uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
	with:
	egress-policy: audit
	- name: Validate Secrets
	if: ${{ env.API_HOST == '' \|\| env.API_TOKEN == '' }}
	run: \|
	echo "API_HOST or API_TOKEN not set"
	exit 0

	- name: Checkout panther-analysis
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

	- name: Set python version
	uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
	with:
	python-version: "3.11"

	- name: Install pipenv
	run: pip install pipenv

	- name: Setup venv
	run: make venv

	- name: validate
	run: \|
	pipenv run panther_analysis_tool validate --api-host ${{ env.API_HOST }} --api-token ${{ env.API_TOKEN }}

Provide feedback