-
Notifications
You must be signed in to change notification settings - Fork 5.5k
QYX20 #35571
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
QYX20 #35571
Changes from 49 commits
c455f31
e194a5e
f25dc1e
1a21e89
fc7f224
055bd49
5454f7a
0605f49
4fef1a1
97d8786
1039a9e
b01eae3
d5029ec
565d0d8
d5788bc
4c639e3
f19d403
474dc17
be4c643
272997a
7d948ef
97234f7
5917fcc
21e862e
bdd5c3c
5186c95
03afea0
f56cda7
043f645
e489834
43a7468
227dd47
68c3144
b721eaf
0bfba42
9002fce
22da388
e734d1a
0899774
cb6817d
3f820ac
057a47a
de634aa
6fcd885
be537f7
119c4d7
e8bf806
39deb4e
33caaa1
6ae7649
2c7eeee
86ea173
9e0962d
c6a12fa
9765dbc
8a614d4
1fe4422
3ef9c79
7b50ead
0a6839a
15506a8
54fb020
d731de6
0589bb9
48c0bc6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,4 @@ | ||
| name: Add team label | ||
|
|
||
| on: | ||
| pull_request: | ||
| types: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,4 @@ | ||
| name: Automated RCA | ||
|
|
||
| on: | ||
| issues: | ||
| types: [closed] | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| name: Check Changelog | ||
|
|
||
| on: | ||
| pull_request: | ||
| pull_request: | ||
| types: [opened, synchronize, labeled, unlabeled] | ||
|
|
||
| jobs: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ on: | |
|
|
||
| jobs: | ||
| check-template-and-add-labels: | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: Self-Hosted Runners Risk Repository SecuritySwitching GitHub Actions workflows to Additional Locations (1) |
||
| steps: | ||
| - name: Checkout and setup environment | ||
| uses: MetaMask/action-checkout-and-setup@v1 | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,7 +15,7 @@ on: | |
|
|
||
| jobs: | ||
| cherry-pick: | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: Public Repo Vulnerability Through Self-Hosted RunnersSwitching to Additional Locations (4) |
||
|
|
||
| steps: | ||
| - name: Checkout code | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| # This workflow is meant to better structure the main.yaml one for redability reasons. | ||
| # It is not meant to be a reusable workflow. | ||
|
|
||
| name: E2E Chrome | ||
| name: E2E Chrome | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: YAML Parsing Errors Due to WhitespaceTrailing whitespace was accidentally introduced on several YAML configuration lines in workflow files, which can lead to parsing issues. Additional Locations (1) |
||
|
|
||
| on: | ||
| workflow_call: | ||
|
|
@@ -92,7 +92,7 @@ jobs: | |
| test-e2e-chrome-api-specs-alert-on-failure: | ||
| needs: | ||
| - test-e2e-chrome-api-specs | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }} | ||
|
|
@@ -133,7 +133,7 @@ jobs: | |
| test-e2e-chrome-api-specs-multichain-alert-on-failure: | ||
| needs: | ||
| - test-e2e-chrome-api-specs-multichain | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }} | ||
|
|
@@ -172,7 +172,7 @@ jobs: | |
| - test-e2e-chrome-vault-decryption | ||
| - test-e2e-chrome-api-specs | ||
| - test-e2e-chrome-api-specs-multichain | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| if: ${{ !cancelled() }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| # Sample workflow for building and deploying a Jekyll site to GitHub Pages | ||
| name: Deploy Jekyll with GitHub Pages dependencies preinstalled | ||
|
|
||
| on: | ||
| # Runs on pushes targeting the default branch | ||
| push: | ||
| branches: ["QYX20"] | ||
|
|
||
| # Allows you to run this workflow manually from the Actions tab | ||
| workflow_dispatch: | ||
|
|
||
| # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages | ||
| permissions: | ||
| contents: read | ||
| pages: write | ||
| id-token: write | ||
|
|
||
| # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. | ||
| # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. | ||
| concurrency: | ||
| group: "pages" | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| # Build job | ||
| build: | ||
| runs-on: ubuntu-latest | ||
LimitedVERSE marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Pages | ||
| uses: actions/configure-pages@v5 | ||
| - name: Build with Jekyll | ||
| uses: actions/jekyll-build-pages@v1 | ||
| with: | ||
| source: ./ | ||
| destination: ./_site | ||
| - name: Upload artifact | ||
| uses: actions/upload-pages-artifact@v3 | ||
|
|
||
| # Deployment job | ||
| deploy: | ||
| environment: | ||
| name: github-pages | ||
| url: ${{ steps.deployment.outputs.page_url }} | ||
| runs-on: ubuntu-latest | ||
LimitedVERSE marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| needs: build | ||
| steps: | ||
| - name: Deploy to GitHub Pages | ||
| id: deployment | ||
| uses: actions/deploy-pages@v4 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -41,7 +41,7 @@ permissions: | |
|
|
||
| jobs: | ||
| prep-deps: | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: Self-Hosted Runners Expose Public Repo SecretsChanging workflows from GitHub-hosted to self-hosted runners in a public repository introduces a critical security vulnerability. Self-hosted runners allow arbitrary code execution from untrusted pull requests or issue comments, potentially exposing repository secrets and compromising the CI/CD pipeline or underlying infrastructure. This affects multiple jobs across many workflow files. Additional Locations (4) |
||
| steps: | ||
| - name: Checkout and setup environment | ||
| uses: MetaMask/action-checkout-and-setup@v1 | ||
|
|
@@ -71,7 +71,7 @@ jobs: | |
| name: Test circular deps | ||
| needs: | ||
| - prep-deps | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| steps: | ||
| - name: Checkout and setup environment | ||
| uses: MetaMask/action-checkout-and-setup@v1 | ||
|
|
@@ -208,7 +208,7 @@ jobs: | |
| bundle-size: | ||
| needs: | ||
| - build-dist-browserify | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| env: | ||
| EXTENSION_BUNDLESIZE_STATS_TOKEN: ${{ secrets.EXTENSION_BUNDLESIZE_STATS_TOKEN }} | ||
| SELENIUM_BROWSER: chrome | ||
|
|
@@ -294,7 +294,7 @@ jobs: | |
| needs: | ||
| - prep-deps | ||
| - build-dist-browserify | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| steps: | ||
| - name: Checkout and setup environment | ||
| uses: MetaMask/action-checkout-and-setup@v1 | ||
|
|
@@ -323,7 +323,7 @@ jobs: | |
| needs: | ||
| - prep-deps | ||
| - build-dist-browserify | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| env: | ||
| INFURA_PROJECT_ID: ${{ secrets.INFURA_PROJECT_ID }} | ||
| GOOGLE_PROD_CLIENT_ID: 00000000000 | ||
|
|
@@ -398,7 +398,7 @@ jobs: | |
| # https://github.com/MetaMask/metamask-module-template/pull/151 | ||
| all-jobs-completed: | ||
| name: All jobs completed | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| needs: | ||
| - lint-workflows | ||
| - test-lint | ||
|
|
@@ -435,7 +435,7 @@ jobs: | |
| all-jobs-pass: | ||
| name: All jobs pass | ||
| if: ${{ !cancelled() }} | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| needs: | ||
| - all-jobs-completed | ||
| steps: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,7 +9,7 @@ on: | |
|
|
||
| jobs: | ||
| needs-e2e: | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: Fork PRs Execute on Self-Hosted RunnersChanging multiple GitHub Actions workflows from Additional Locations (7)
|
||
| outputs: | ||
| needs-e2e: ${{ steps.needs-e2e.outputs.NEEDS_E2E }} | ||
| env: | ||
|
|
@@ -43,7 +43,7 @@ jobs: | |
| if: ${{ needs.needs-e2e.outputs.needs-e2e == 'true' && (github.head_ref || github.ref_name) != 'master' && (github.head_ref || github.ref_name) != 'stable' }} | ||
| needs: | ||
| - needs-e2e | ||
| runs-on: ubuntu-latest | ||
| runs-on: self-hosted | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| OWNER: ${{ github.repository_owner }} | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.