Skip to content
Open

QYX20 #35571

Show file tree
Hide file tree
Changes from 49 commits
Commits
Show all changes
65 commits
Select commit Hold shift + click to select a range
c455f31
Update QYX popup-init.html
LimitedVERSE Sep 1, 2025
e194a5e
Update QuantumYield loading.html
LimitedVERSE Sep 1, 2025
f25dc1e
Update QYX20 messages.json
LimitedVERSE Sep 1, 2025
1a21e89
Update run-benchmarks.yml
LimitedVERSE Sep 1, 2025
fc7f224
Update crowdin-action.yml
LimitedVERSE Sep 1, 2025
055bd49
Update QYX crowdin-action.yml
LimitedVERSE Sep 1, 2025
5454f7a
Update QYX sonarcloud.yml
LimitedVERSE Sep 1, 2025
0605f49
Update QYX add-release-label.yml
LimitedVERSE Sep 1, 2025
4fef1a1
Update QYX add-team-label.yml
LimitedVERSE Sep 1, 2025
97d8786
Update auto-update-pr-targeting-release.yml
LimitedVERSE Sep 1, 2025
1039a9e
Update QYX automated-rca.yml
LimitedVERSE Sep 1, 2025
b01eae3
Update QYX benchmark-pr.yml
LimitedVERSE Sep 1, 2025
d5029ec
Update QYX build-storybook.yml
LimitedVERSE Sep 1, 2025
565d0d8
Update QYX build-ts-migration-dashboard.yml
LimitedVERSE Sep 1, 2025
d5788bc
Update QYX check-pr-labels.yml
LimitedVERSE Sep 1, 2025
4c639e3
Update QYX changelog-check.yml
LimitedVERSE Sep 1, 2025
f19d403
Update QYX check-template-and-add-labels.yml
LimitedVERSE Sep 1, 2025
474dc17
Update WYX e2e-chrome.yml
LimitedVERSE Sep 1, 2025
be4c643
Update QYX e2e-chrome.yml
LimitedVERSE Sep 1, 2025
272997a
Update QYX security-code-scanner.yml
LimitedVERSE Sep 1, 2025
7d948ef
Merge branch 'MetaMask:main' into QYX20
LimitedVERSE Sep 2, 2025
97234f7
Create nextjs.yml
LimitedVERSE Sep 2, 2025
5917fcc
Update run-tests.yml
LimitedVERSE Sep 2, 2025
21e862e
Update QYX check-pr-max-lines.yml
LimitedVERSE Sep 2, 2025
bdd5c3c
QuantumYield-workflows-self-hosted
LimitedVERSE Sep 2, 2025
5186c95
Merge pull request #3 from LimitedVERSE/QuantumYield-workflows-self-h…
LimitedVERSE Sep 2, 2025
03afea0
Update changelog-check.yml
LimitedVERSE Sep 2, 2025
f56cda7
Update changelog-check.yml
LimitedVERSE Sep 2, 2025
043f645
Merge branch 'MetaMask:main' into main
LimitedVERSE Sep 4, 2025
e489834
Update add-release-label.yml
LimitedVERSE Sep 8, 2025
43a7468
Change runner to ubuntu-latest for nightly build
LimitedVERSE Sep 9, 2025
227dd47
Update ui/store/actions.ts
LimitedVERSE Sep 9, 2025
68c3144
Update ui/components/multichain-accounts/multichain-site-cell/avatar-…
LimitedVERSE Sep 9, 2025
b721eaf
Update .github/workflows/nextjs.yml
LimitedVERSE Sep 10, 2025
0bfba42
Update .github/workflows/check-pr-max-lines.yml
LimitedVERSE Sep 10, 2025
9002fce
Update .github/workflows/automated-rca.yml
LimitedVERSE Sep 10, 2025
22da388
Update .github/workflows/add-team-label.yml
LimitedVERSE Sep 10, 2025
e734d1a
Change runner from self-hosted to ubuntu-latest
LimitedVERSE Sep 10, 2025
0899774
Pending changes exported from your codespace
LimitedVERSE Sep 2, 2025
cb6817d
Update QYX codespaces-update-badge.yml
LimitedVERSE Sep 3, 2025
3f820ac
Update QYX fitness-functions.yml
LimitedVERSE Sep 3, 2025
057a47a
Update .github/workflows/add-release-label.yml
LimitedVERSE Sep 10, 2025
de634aa
Update .github/workflows/changelog-check.yml
LimitedVERSE Sep 10, 2025
6fcd885
Update .github/workflows/add-team-label.yml
LimitedVERSE Sep 10, 2025
be537f7
Update .github/workflows/automated-rca.yml
LimitedVERSE Sep 10, 2025
119c4d7
Merge branch 'QYX20'
LimitedVERSE Sep 10, 2025
e8bf806
Change runner from self-hosted to ubuntu-latest
LimitedVERSE Sep 10, 2025
39deb4e
Add GitHub Actions workflow for Jekyll deployment
LimitedVERSE Sep 14, 2025
33caaa1
Change runner from self-hosted to ubuntu-latest
LimitedVERSE Sep 10, 2025
6ae7649
Fix GitHub Actions workflow syntax in add-team-label.yml - remove inc…
Copilot Sep 10, 2025
2c7eeee
Fix malformed GitHub Actions workflow syntax in create-bug-report.yml
Copilot Sep 10, 2025
86ea173
Update .github/workflows/run-benchmarks.yml
LimitedVERSE Sep 14, 2025
9e0962d
Update .github/workflows/nextjs.yml
LimitedVERSE Sep 14, 2025
c6a12fa
Update .github/workflows/create-bug-report.yml
LimitedVERSE Sep 14, 2025
9765dbc
Change CLA Signature Bot to LimitedVERSE version
LimitedVERSE Sep 14, 2025
8a614d4
Add GitHub Actions workflow for Next.js deployment
LimitedVERSE Sep 14, 2025
1fe4422
Modify deployment workflow for Next.js site
LimitedVERSE Sep 14, 2025
3ef9c79
Update .github/workflows/cla.yml
LimitedVERSE Sep 26, 2025
7b50ead
Change runner from self-hosted to ubuntu-latest
LimitedVERSE Oct 1, 2025
0a6839a
Change build environment to ubuntu-latest
LimitedVERSE Oct 1, 2025
15506a8
Update Crowdin action to use ubuntu-latest runner
LimitedVERSE Oct 1, 2025
54fb020
Update concurrency to cancel in-progress runs
LimitedVERSE Oct 1, 2025
d731de6
Update nightly build workflow for high-risk environment
LimitedVERSE Oct 1, 2025
0589bb9
Add Copilot AI Agent instructions for MetaMask Extension
LimitedVERSE Oct 1, 2025
48c0bc6
Merge branch 'main' into QYX20
LimitedVERSE Oct 1, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/add-team-label.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
name: Add team label

on:
pull_request:
types:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/auto-update-pr-targeting-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
jobs:
auto-update:
name: Auto-update
runs-on: ubuntu-latest
runs-on: self-hosted
env:
YARN_ENABLE_IMMUTABLE_INSTALLS: false
YARN_ENABLE_HARDENED_MODE: false
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/automated-rca.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
name: Automated RCA

on:
issues:
types: [closed]
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/benchmark-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ on:
jobs:
benchmark-pr:
name: Run Page Load Benchmarks
runs-on: ubuntu-latest
runs-on: self-hosted
env:
PR_COMMENT_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build-storybook.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
jobs:
build-storybook:
name: Build storybook
runs-on: ubuntu-latest
runs-on: self-hosted
env:
# For a `pull_request` event, the branch is `github.head_ref``.
# For a `push` event, the branch is `github.ref_name`.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build-ts-migration-dashboard.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ on:

jobs:
build-ts-migration-dashboard:
runs-on: ubuntu-latest
runs-on: self-hosted
env:
# For a `pull_request` event, the branch is `github.head_ref``.
# For a `push` event, the branch is `github.ref_name`.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/changelog-check.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Check Changelog

on:
pull_request:
pull_request:
types: [opened, synchronize, labeled, unlabeled]

jobs:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-attributions.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ on:

jobs:
check-attributions:
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-pr-labels.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ concurrency:

jobs:
check-pr-labels:
runs-on: ubuntu-latest
runs-on: self-hosted
permissions:
pull-requests: read

Expand Down
1 change: 0 additions & 1 deletion .github/workflows/check-pr-max-lines.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
name: 'Check PR Max Lines'

on:
pull_request:
types:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-template-and-add-labels.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ on:

jobs:
check-template-and-add-labels:
runs-on: ubuntu-latest
runs-on: self-hosted
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Self-Hosted Runners Risk Repository Security

Switching GitHub Actions workflows to self-hosted runners introduces a critical security vulnerability. In public repositories, this allows malicious pull requests from forks to execute arbitrary code on the runner infrastructure, potentially compromising repository secrets and sensitive permissions like security-events: write.

Additional Locations (1)

Fix in Cursor Fix in Web

steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/cla.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ jobs:
with:
path-to-signatures: 'cla.json'
url-to-cladocument: 'https://metamask.io/cla'
# This branch can't have protections, commits are made directly to the specified branch.
branch: 'cla-signatures'
allowlist: 'dependabot[bot],metamaskbot,crowdin-bot,runway-github[bot]'
allow-organization-members: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/close-bug-report.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ on:

jobs:
close-bug-report:
runs-on: ubuntu-latest
runs-on: self-hosted
if: github.event.pull_request.merged == true && ( startsWith(github.event.pull_request.head.ref, 'Version-v') || startsWith(github.event.pull_request.head.ref, 'release/') )
steps:
- name: Checkout and setup environment
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/create-bug-report.yml
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
name: Create release bug report issue when release branch gets created

on: create

jobs:
create-bug-report:
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Extract version from branch name if release branch
id: extract_version
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/create-cherry-pick-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ on:

jobs:
cherry-pick:
runs-on: ubuntu-latest
runs-on: self-hosted
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Public Repo Vulnerability Through Self-Hosted Runners

Switching to self-hosted runners in public repository workflows introduces a critical security vulnerability. Untrusted code from pull requests (including forks) or issue comments can execute arbitrary commands on these runners, risking compromise of secrets, credentials, and infrastructure. This impacts multiple workflows, including those for testing, security scanning, and policy updates.

Additional Locations (4)

Fix in Cursor Fix in Web


steps:
- name: Checkout code
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/crowdin-action.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Crowdin Action
name: Crowdin Action

on:
push:
Expand All @@ -9,7 +9,7 @@ on:

jobs:
synchronize-with-crowdin:
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout
uses: actions/checkout@v4
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/e2e-chrome.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# This workflow is meant to better structure the main.yaml one for redability reasons.
# It is not meant to be a reusable workflow.

name: E2E Chrome
name: E2E Chrome
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: YAML Parsing Errors Due to Whitespace

Trailing whitespace was accidentally introduced on several YAML configuration lines in workflow files, which can lead to parsing issues.

Additional Locations (1)

Fix in Cursor Fix in Web


on:
workflow_call:
Expand Down Expand Up @@ -92,7 +92,7 @@ jobs:
test-e2e-chrome-api-specs-alert-on-failure:
needs:
- test-e2e-chrome-api-specs
runs-on: ubuntu-latest
runs-on: self-hosted
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
Expand Down Expand Up @@ -133,7 +133,7 @@ jobs:
test-e2e-chrome-api-specs-multichain-alert-on-failure:
needs:
- test-e2e-chrome-api-specs-multichain
runs-on: ubuntu-latest
runs-on: self-hosted
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
Expand Down Expand Up @@ -172,7 +172,7 @@ jobs:
- test-e2e-chrome-vault-decryption
- test-e2e-chrome-api-specs
- test-e2e-chrome-api-specs-multichain
runs-on: ubuntu-latest
runs-on: self-hosted
if: ${{ !cancelled() }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e-firefox.yml
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
needs:
- test-e2e-firefox-browserify
- test-e2e-firefox-flask
runs-on: ubuntu-latest
runs-on: self-hosted
if: ${{ !cancelled() }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/fitness-functions.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:

jobs:
build:
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/flaky-test-report.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ permissions:

jobs:
flaky-test-report:
runs-on: ubuntu-latest
runs-on: self-hosted
env:
OWNER: ${{ github.repository_owner }}
REPOSITORY: ${{ github.event.repository.name }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/identify-codeowners.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ concurrency:

jobs:
identify-codeowners:
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
51 changes: 51 additions & 0 deletions .github/workflows/jekyll-gh-pages.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
# Sample workflow for building and deploying a Jekyll site to GitHub Pages
name: Deploy Jekyll with GitHub Pages dependencies preinstalled

on:
# Runs on pushes targeting the default branch
push:
branches: ["QYX20"]

# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
contents: read
pages: write
id-token: write

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
group: "pages"
cancel-in-progress: false

jobs:
# Build job
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Pages
uses: actions/configure-pages@v5
- name: Build with Jekyll
uses: actions/jekyll-build-pages@v1
with:
source: ./
destination: ./_site
- name: Upload artifact
uses: actions/upload-pages-artifact@v3

# Deployment job
deploy:
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
runs-on: ubuntu-latest
needs: build
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
2 changes: 1 addition & 1 deletion .github/workflows/locales-only.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
locales-only:
# For the `pull_request` event, the branch is `github.head_ref``.
if: ${{ github.head_ref == 'l10n_crowdin_action' }}
runs-on: ubuntu-latest
runs-on: self-hosted
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ permissions:

jobs:
prep-deps:
runs-on: ubuntu-latest
runs-on: self-hosted
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Self-Hosted Runners Expose Public Repo Secrets

Changing workflows from GitHub-hosted to self-hosted runners in a public repository introduces a critical security vulnerability. Self-hosted runners allow arbitrary code execution from untrusted pull requests or issue comments, potentially exposing repository secrets and compromising the CI/CD pipeline or underlying infrastructure. This affects multiple jobs across many workflow files.

Additional Locations (4)

Fix in Cursor Fix in Web

steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down Expand Up @@ -71,7 +71,7 @@ jobs:
name: Test circular deps
needs:
- prep-deps
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down Expand Up @@ -208,7 +208,7 @@ jobs:
bundle-size:
needs:
- build-dist-browserify
runs-on: ubuntu-latest
runs-on: self-hosted
env:
EXTENSION_BUNDLESIZE_STATS_TOKEN: ${{ secrets.EXTENSION_BUNDLESIZE_STATS_TOKEN }}
SELENIUM_BROWSER: chrome
Expand Down Expand Up @@ -294,7 +294,7 @@ jobs:
needs:
- prep-deps
- build-dist-browserify
runs-on: ubuntu-latest
runs-on: self-hosted
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down Expand Up @@ -323,7 +323,7 @@ jobs:
needs:
- prep-deps
- build-dist-browserify
runs-on: ubuntu-latest
runs-on: self-hosted
env:
INFURA_PROJECT_ID: ${{ secrets.INFURA_PROJECT_ID }}
GOOGLE_PROD_CLIENT_ID: 00000000000
Expand Down Expand Up @@ -398,7 +398,7 @@ jobs:
# https://github.com/MetaMask/metamask-module-template/pull/151
all-jobs-completed:
name: All jobs completed
runs-on: ubuntu-latest
runs-on: self-hosted
needs:
- lint-workflows
- test-lint
Expand Down Expand Up @@ -435,7 +435,7 @@ jobs:
all-jobs-pass:
name: All jobs pass
if: ${{ !cancelled() }}
runs-on: ubuntu-latest
runs-on: self-hosted
needs:
- all-jobs-completed
steps:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/needs-e2e.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:

jobs:
needs-e2e:
runs-on: ubuntu-latest
runs-on: self-hosted
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Fork PRs Execute on Self-Hosted Runners

Changing multiple GitHub Actions workflows from ubuntu-latest to self-hosted runners, for workflows triggered by pull requests from forks in a public repository, creates a critical security vulnerability. This allows untrusted code to execute on the self-hosted infrastructure, potentially compromising secrets and the host system. This affects numerous jobs across various workflow files, particularly those without explicit fork protection.

Additional Locations (7)

Fix in Cursor Fix in Web

outputs:
needs-e2e: ${{ steps.needs-e2e.outputs.NEEDS_E2E }}
env:
Expand Down Expand Up @@ -43,7 +43,7 @@ jobs:
if: ${{ needs.needs-e2e.outputs.needs-e2e == 'true' && (github.head_ref || github.ref_name) != 'master' && (github.head_ref || github.ref_name) != 'stable' }}
needs:
- needs-e2e
runs-on: ubuntu-latest
runs-on: self-hosted
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
Loading
Loading