11on :
22 workflow_dispatch :
3- branches :
4- - main
53 push :
64 branches :
75 - main
@@ -20,31 +18,42 @@ jobs:
2018 npm_version : ${{ steps.npm_version_output.outputs.NPM_VERSION }}
2119 npm_tag : ${{ steps.npm_version_output.outputs.NPM_TAG }}
2220 steps :
23- - uses : maxim-lobanov/setup-xcode@v1
21+ - name : Harden the runner (Audit all outbound calls)
22+ uses : step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
23+ with :
24+ egress-policy : audit
25+ - uses : maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
2426 with :
2527 xcode-version : ${{env.XCODE_VERSION}}
26- - uses : actions/checkout@v3
28+ - uses : actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2729 with :
2830 fetch-depth : 0
2931 - name : LLVM cache
30- uses : actions/cache@v3
32+ uses : actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
3133 with :
3234 path : ./llvm
3335 key : ${{ hashFiles('download_llvm.sh') }}
34- - uses : actions/setup-node@v3
36+ - uses : actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
3537 with :
3638 node-version : 20
3739 registry-url : " https://registry.npmjs.org"
3840 - name : Install Python
39- uses : actions/setup-python@v4
41+ uses : actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
4042 with :
4143 python-version : " 3"
4244 - name : Install Dependencies
4345 run : |
4446 npm install
4547 python3 -m pip install --upgrade pip six
46- brew install cmake
47- [ ! -f /usr/local/bin/cmake ] && ln -s /usr/local/bin/cmake $(which cmake) || true
48+ # Ensure CMake is available without conflicting with pinned Homebrew formula
49+ if ! command -v cmake >/dev/null; then
50+ brew list cmake || brew install cmake
51+ fi
52+ # Some scripts expect cmake at /usr/local/bin; create a shim if needed
53+ if [ ! -x /usr/local/bin/cmake ]; then
54+ sudo mkdir -p /usr/local/bin
55+ sudo ln -sf "$(command -v cmake)" /usr/local/bin/cmake
56+ fi
4857 - name : Get Current Version
4958 run : |
5059 NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
@@ -64,12 +73,12 @@ jobs:
6473 - name : Build
6574 run : npm run build-ios
6675 - name : Upload npm package artifact
67- uses : actions/upload-artifact@v3
76+ uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6877 with :
6978 name : npm-package
7079 path : dist/akylas-nativescript-ios-runtime-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
7180 - name : Upload dSYMs artifact
72- uses : actions/upload-artifact@v3
81+ uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7382 with :
7483 name : NativeScript-dSYMs
7584 path : dist/dSYMs
@@ -78,28 +87,39 @@ jobs:
7887 runs-on : macos-14
7988 needs : build
8089 steps :
81- - uses : maxim-lobanov/setup-xcode@v1
90+ - name : Harden the runner (Audit all outbound calls)
91+ uses : step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
92+ with :
93+ egress-policy : audit
94+ - uses : maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
8295 with :
8396 xcode-version : ${{env.XCODE_VERSION}}
84- - uses : actions/checkout@v3
97+ - uses : actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
8598 - name : LLVM cache
86- uses : actions/cache@v3
99+ uses : actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
87100 with :
88101 path : ./llvm
89102 key : ${{ hashFiles('download_llvm.sh') }}
90- - uses : actions/setup-node@v3
103+ - uses : actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
91104 with :
92105 node-version : 20
93106 - name : Install Python
94- uses : actions/setup-python@v4
107+ uses : actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
95108 with :
96109 python-version : " 3"
97110 - name : Install Dependencies
98111 run : |
99112 npm install
100113 python3 -m pip install --upgrade pip six
101- brew install cmake
102- [ ! -f /usr/local/bin/cmake ] && ln -s /usr/local/bin/cmake $(which cmake) || true
114+ # Ensure CMake is available without conflicting with pinned Homebrew formula
115+ if ! command -v cmake >/dev/null; then
116+ brew list cmake || brew install cmake
117+ fi
118+ # Some scripts expect cmake at /usr/local/bin; create a shim if needed
119+ if [ ! -x /usr/local/bin/cmake ]; then
120+ sudo mkdir -p /usr/local/bin
121+ sudo ln -sf "$(command -v cmake)" /usr/local/bin/cmake
122+ fi
103123 brew install chargepoint/xcparse/xcparse
104124 npm install -g @edusperoni/junit-cli-report-viewer verify-junit-xml
105125 - name : Prepare
@@ -109,7 +129,7 @@ jobs:
109129 mkdir -p dist-test
110130 echo TEST_FOLDER=$(pwd)/dist-test >> $GITHUB_ENV
111131 - name : Xcode Tests
112- uses : nick-fields/retry@v2
132+ uses : nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
113133 # try to run the tests with xcpretty. If it fails then try again without xcpretty twice for better log output
114134 # the xcode tests are a bit flaky and they should never fail on this step, as this step only collects the JS test results as junit xml
115135 with :
@@ -125,7 +145,7 @@ jobs:
125145 find $TEST_FOLDER/test-out -name "*junit*.xml" -maxdepth 1 -print0 | xargs -n 1 -0 npx verify-junit-xml
126146 - name : Archive Test Result Data
127147 if : always()
128- uses : actions/upload-artifact@v3
148+ uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
129149 with :
130150 name : test-results
131151 path : ${{env.TEST_FOLDER}}/test_results.xcresult
@@ -141,11 +161,15 @@ jobs:
141161 NPM_VERSION : ${{needs.build.outputs.npm_version}}
142162 NPM_TAG : ${{needs.build.outputs.npm_tag}}
143163 steps :
144- - uses : actions/setup-node@v3
164+ - name : Harden the runner (Audit all outbound calls)
165+ uses : step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
166+ with :
167+ egress-policy : audit
168+ - uses : actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
145169 with :
146170 node-version : 20
147171 registry-url : " https://registry.npmjs.org"
148- - uses : actions/download-artifact@v3
172+ - uses : actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
149173 with :
150174 name : npm-package
151175 path : dist
@@ -167,19 +191,23 @@ jobs:
167191 env :
168192 NPM_VERSION : ${{needs.build.outputs.npm_version}}
169193 steps :
170- - uses : actions/checkout@v3
194+ - name : Harden the runner (Audit all outbound calls)
195+ uses : step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
196+ with :
197+ egress-policy : audit
198+ - uses : actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
171199 with :
172200 fetch-depth : 0
173- - uses : actions/setup-node@v3
201+ - uses : actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
174202 with :
175203 node-version : 20
176204 - name : Setup
177205 run : npm install
178- - uses : actions/download-artifact@v3
206+ - uses : actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
179207 with :
180208 name : npm-package
181209 path : dist
182- - uses : actions/download-artifact@v3
210+ - uses : actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
183211 with :
184212 name : NativeScript-dSYMs
185213 path : dist/dSYMs
@@ -188,8 +216,9 @@ jobs:
188216 run : find . -maxdepth 1 -name '*.dSYM' -print | xargs -I@ zip -r @.zip @
189217 - name : Partial Changelog
190218 run : npx conventional-changelog -p angular -r2 > body.md
191- - uses : ncipollo/release-action@v1
219+ - uses : ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
192220 with :
193221 artifacts : " dist/akylas-nativescript-ios-runtime-*.tgz,dist/dSYMs/*.zip"
194222 bodyFile : " body.md"
195223 prerelease : ${{needs.build.outputs.npm_tag != 'latest'}}
224+ allowUpdates : true
0 commit comments