refactor(cli): migrate to Effect 4 (4.0.0-rc.112) #3167
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Audit Typescript SDK | |
| on: | |
| push: | |
| branches: [master, next] | |
| paths: | |
| - 'ts/**' | |
| - '.github/actions/setup-node-pnpm-bun/action.yml' | |
| - '.github/workflows/ts.audit.yml' | |
| - 'mise.toml' | |
| - 'mise.lock' | |
| - 'package.json' | |
| - 'pnpm-lock.yaml' | |
| - 'pnpm-workspace.yaml' | |
| pull_request: | |
| branches: [master, next] | |
| paths: | |
| - 'ts/**' | |
| - '.github/actions/setup-node-pnpm-bun/action.yml' | |
| - '.github/workflows/ts.audit.yml' | |
| - 'mise.toml' | |
| - 'mise.lock' | |
| - 'package.json' | |
| - 'pnpm-lock.yaml' | |
| - 'pnpm-workspace.yaml' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| name: Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Node.js, pnpm, Bun | |
| uses: ./.github/actions/setup-node-pnpm-bun | |
| with: | |
| enable-caching: 'false' | |
| - name: Verify mise.lock is fresh | |
| run: | | |
| mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 | |
| git diff --exit-code mise.lock | |
| - name: Run pnpm audit (production dependencies only) | |
| id: audit | |
| continue-on-error: true | |
| run: pnpm audit --prod > audit-output.txt 2>&1 | |
| - name: Comment on PR if audit failed | |
| if: steps.audit.outcome == 'failure' && github.event_name == 'pull_request' | |
| run: | | |
| { | |
| echo "⚠️ **Security Audit Warning**" | |
| echo "" | |
| echo "The \`pnpm audit --prod\` check found security vulnerabilities in production dependencies." | |
| echo "" | |
| echo "Please review and fix the vulnerabilities. You can try running:" | |
| echo "\`\`\`bash" | |
| echo "pnpm audit --fix --prod" | |
| echo "\`\`\`" | |
| echo "" | |
| echo "<details>" | |
| echo "<summary>Audit output</summary>" | |
| echo "" | |
| echo "\`\`\`" | |
| cat audit-output.txt | |
| echo "\`\`\`" | |
| echo "" | |
| echo "</details>" | |
| } > audit-comment.txt | |
| - name: Post audit comment to PR | |
| if: steps.audit.outcome == 'failure' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository | |
| uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 | |
| with: | |
| file-path: audit-comment.txt | |
| comment-tag: pnpm-audit-security-warning | |
| - name: Fail on high/critical advisories | |
| # No --ignore here: the flag writes the advisory into pnpm-workspace.yaml's | |
| # auditConfig and exits 0 regardless of what else is outstanding, which | |
| # silently disarms this gate. Advisories that genuinely cannot be fixed by | |
| # a version bump belong in `auditConfig.ignoreGhsas`, with a comment. | |
| run: pnpm audit --prod --audit-level=high |