Skip to content

Commit 5dfde70

Browse files
NathanWalkerNathanWalker
authored
Merge branch 'main' into dependabot/npm_and_yarn/test-app/build-tools/android-metadata-generator/grunt-contrib-clean-0.7.0
2 parents dc2af0c + 769ccd7 commit 5dfde70

File tree

4 files changed

+126
-27
lines changed

4 files changed

+126
-27
lines changed

‎.github/workflows/npm_release.yml‎

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ env:
1313
ANDROID_ABI: x86_64
1414
NDK_ARCH: darwin
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
build:
1821
name: Build
@@ -21,21 +24,26 @@ jobs:
2124
npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
2225
npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
2326
steps:
24-
- uses: actions/checkout@v3
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
29+
with:
30+
egress-policy: audit
31+
32+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2533
with:
2634
fetch-depth: 0
2735
submodules: true
28-
- uses: actions/setup-node@v3
36+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
2937
with:
3038
node-version: 22
3139
registry-url: "https://registry.npmjs.org"
32-
- uses: actions/setup-java@v3
40+
- uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
3341
with:
3442
distribution: "temurin"
3543
java-version: "21"
3644
cache: gradle
3745
- name: Setup Android SDK
38-
uses: android-actions/setup-android@v2
46+
uses: android-actions/setup-android@7c5672355aaa8fde5f97a91aa9a99616d1ace6bc # v2.0.10
3947
- name: Homebrew dependencies
4048
run: |
4149
brew install wget
@@ -73,12 +81,12 @@ jobs:
7381
- name: Build npm package
7482
run: ./gradlew -PgitCommitVersion=${{ github.sha }} -PnoCCache --stacktrace
7583
- name: Upload npm package artifact
76-
uses: actions/upload-artifact@v4
84+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7785
with:
7886
name: npm-package
7987
path: dist/nativescript-android-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
8088
- name: Upload debug symbols
81-
uses: actions/upload-artifact@v4
89+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8290
with:
8391
name: debug-symbols
8492
path: test-app/runtime/build/intermediates/merged_native_libs/release/mergeReleaseNativeLibs/out/lib/*
@@ -88,20 +96,25 @@ jobs:
8896
runs-on: macos-13
8997
needs: build
9098
steps:
91-
- uses: actions/checkout@v3
99+
- name: Harden the runner (Audit all outbound calls)
100+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
101+
with:
102+
egress-policy: audit
103+
104+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
92105
with:
93106
submodules: true
94-
- uses: actions/setup-node@v3
107+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
95108
with:
96109
node-version: 22
97110
registry-url: "https://registry.npmjs.org"
98-
- uses: actions/setup-java@v3
111+
- uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
99112
with:
100113
distribution: "temurin"
101114
java-version: "21"
102115
cache: gradle
103116
- name: Setup Android SDK
104-
uses: android-actions/setup-android@v2
117+
uses: android-actions/setup-android@7c5672355aaa8fde5f97a91aa9a99616d1ace6bc # v2.0.10
105118
- name: Homebrew dependencies
106119
run: |
107120
brew install wget
@@ -123,7 +136,7 @@ jobs:
123136
- name: SBG tests
124137
run: ./gradlew runSbgTests --stacktrace
125138
- name: Run unit tests
126-
uses: ReactiveCircus/android-emulator-runner@v2
139+
uses: ReactiveCircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # v2.34.0
127140
with:
128141
api-level: ${{env.ANDROID_API}}
129142
# this is needed on API 30+
@@ -142,7 +155,12 @@ jobs:
142155
NPM_VERSION: ${{needs.build.outputs.npm_version}}
143156
NPM_TAG: ${{needs.build.outputs.npm_tag}}
144157
steps:
145-
- uses: actions/setup-node@v3
158+
- name: Harden the runner (Audit all outbound calls)
159+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
160+
with:
161+
egress-policy: audit
162+
163+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
146164
with:
147165
node-version: 22
148166
registry-url: "https://registry.npmjs.org"
@@ -168,10 +186,15 @@ jobs:
168186
env:
169187
NPM_VERSION: ${{needs.build.outputs.npm_version}}
170188
steps:
171-
- uses: actions/checkout@v3
189+
- name: Harden the runner (Audit all outbound calls)
190+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
191+
with:
192+
egress-policy: audit
193+
194+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
172195
with:
173196
fetch-depth: 0
174-
- uses: actions/setup-node@v3
197+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
175198
with:
176199
node-version: 22
177200
- name: Setup
@@ -189,7 +212,7 @@ jobs:
189212
run: zip -r debug-symbols.zip .
190213
- name: Partial Changelog
191214
run: npx conventional-changelog -p angular -r2 > body.md
192-
- uses: ncipollo/release-action@v1
215+
- uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
193216
with:
194217
artifacts: "dist/nativescript-android-*.tgz,dist/debug-symbols/debug-symbols.zip"
195218
bodyFile: "body.md"

‎.github/workflows/pull_request.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ env:
1010
NDK_ARCH: darwin
1111

1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
build:
1518
name: Build
@@ -18,21 +21,21 @@ jobs:
1821
npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
1922
npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
2023
steps:
21-
- uses: actions/checkout@v3
24+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2225
with:
2326
fetch-depth: 0
2427
submodules: true
25-
- uses: actions/setup-node@v3
28+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
2629
with:
2730
node-version: 22
2831
registry-url: "https://registry.npmjs.org"
29-
- uses: actions/setup-java@v3
32+
- uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
3033
with:
3134
distribution: "temurin"
3235
java-version: "21"
3336
cache: gradle
3437
- name: Setup Android SDK
35-
uses: android-actions/setup-android@v2
38+
uses: android-actions/setup-android@7c5672355aaa8fde5f97a91aa9a99616d1ace6bc # v2.0.10
3639
- name: Homebrew dependencies
3740
run: |
3841
brew install wget
@@ -70,12 +73,12 @@ jobs:
7073
- name: Build npm package
7174
run: ./gradlew -PgitCommitVersion=${{ github.sha }} -PnoCCache --stacktrace
7275
- name: Upload npm package artifact
73-
uses: actions/upload-artifact@v4
76+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7477
with:
7578
name: npm-package
7679
path: dist/nativescript-android-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
7780
- name: Upload debug symbols
78-
uses: actions/upload-artifact@v4
81+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7982
with:
8083
name: debug-symbols
8184
path: test-app/runtime/build/intermediates/merged_native_libs/release/mergeReleaseNativeLibs/out/lib/*
@@ -84,20 +87,20 @@ jobs:
8487
runs-on: macos-13
8588
needs: build
8689
steps:
87-
- uses: actions/checkout@v3
90+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
8891
with:
8992
submodules: true
90-
- uses: actions/setup-node@v3
93+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
9194
with:
9295
node-version: 22
9396
registry-url: "https://registry.npmjs.org"
94-
- uses: actions/setup-java@v3
97+
- uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
9598
with:
9699
distribution: "temurin"
97100
java-version: "21"
98101
cache: gradle
99102
- name: Setup Android SDK
100-
uses: android-actions/setup-android@v2
103+
uses: android-actions/setup-android@7c5672355aaa8fde5f97a91aa9a99616d1ace6bc # v2.0.10
101104
- name: Homebrew dependencies
102105
run: |
103106
brew install wget
@@ -119,7 +122,7 @@ jobs:
119122
- name: SBG tests
120123
run: ./gradlew runSbgTests --stacktrace
121124
- name: Run unit tests
122-
uses: ReactiveCircus/android-emulator-runner@v2
125+
uses: ReactiveCircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # v2.34.0
123126
with:
124127
api-level: ${{env.ANDROID_API}}
125128
# this is needed on API 30+

‎.github/workflows/scorecards.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
# For Branch-Protection check. Only the default branch is supported. See
4+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
5+
branch_protection_rule:
6+
# To guarantee Maintained check is occasionally updated. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
8+
schedule:
9+
- cron: '20 7 * * 2'
10+
push:
11+
branches: ["main"]
12+
13+
# Declare default permissions as read only.
14+
permissions: read-all
15+
16+
jobs:
17+
analysis:
18+
name: Scorecard analysis
19+
runs-on: ubuntu-latest
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Needed to publish results and get a badge (see publish_results below).
24+
id-token: write
25+
contents: read
26+
actions: read
27+
# To allow GraphQL ListCommits to work
28+
issues: read
29+
pull-requests: read
30+
# To detect SAST tools
31+
checks: read
32+
33+
steps:
34+
35+
- name: "Checkout code"
36+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
37+
with:
38+
persist-credentials: false
39+
40+
- name: "Run analysis"
41+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
42+
with:
43+
results_file: results.sarif
44+
results_format: sarif
45+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
46+
# - you want to enable the Branch-Protection check on a *public* repository, or
47+
# - you are installing Scorecards on a *private* repository
48+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
49+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
50+
51+
# Public repositories:
52+
# - Publish results to OpenSSF REST API for easy access by consumers
53+
# - Allows the repository to include the Scorecard badge.
54+
# - See https://github.com/ossf/scorecard-action#publishing-results.
55+
# For private repositories:
56+
# - `publish_results` will always be set to `false`, regardless
57+
# of the value entered here.
58+
publish_results: true
59+
60+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
61+
# format to the repository Actions tab.
62+
- name: "Upload artifact"
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
64+
with:
65+
name: SARIF file
66+
path: results.sarif
67+
retention-days: 5
68+
69+
# Upload the results to GitHub's code scanning dashboard.
70+
- name: "Upload to code-scanning"
71+
uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.30.0
72+
with:
73+
sarif_file: results.sarif

‎test-app/build-tools/android-metadata-generator/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"devDependencies": {
1515
"grunt": "0.4.5",
1616
"grunt-contrib-clean": "0.7.0",
17-
"grunt-contrib-copy": "0.5.0",
17+
"grunt-contrib-copy": "0.8.2",
1818
"grunt-exec": "0.4.6",
1919
"node-fs" : "0.1.7"
2020
}

0 commit comments

Comments
 (0)