Skip to content

Commit f31591f

Browse files
cnoble-mayjackie-linz
cnoble-may
and
jackie-linz
authored
feat: SSB-2967 - Implement setup-node action with safe-chain (#1)
* Implement setup-node action with safe-chain * Assert in CI * Add node files for CI, update readme to reference new action * Update readme * Update README.md Co-authored-by: Jackie Weng <120340761+jackie-linz@users.noreply.github.com> * Move CI test file to test dir * Remove node_modules * Remove npm cache and required files * check outputs --------- Co-authored-by: Jackie Weng <120340761+jackie-linz@users.noreply.github.com>
1 parent f1ce10e commit f31591f

File tree

9 files changed

+182
-270
lines changed

9 files changed

+182
-270
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1 @@
1-
# CHANGE_ME - set correct code owner
2-
* @linz/step-enablement
1+
* @linz/step-security

‎.github/dependabot.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
# To get started with Dependabot version updates, you'll need to specify which
2-
# package ecosystems to update and where the package manifests are located.
3-
# Please see the documentation for all configuration options:
4-
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5-
6-
version: 2
7-
8-
updates:
9-
- package-ecosystem: "github-actions"
10-
directory: "/"
11-
schedule:
12-
interval: weekly
13-
commit-message:
14-
prefix: "fix(deps)"
15-
cooldown:
16-
default-days: 15
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
8+
updates:
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: weekly
13+
commit-message:
14+
prefix: "fix(deps)"
15+
cooldown:
16+
default-days: 15

‎.github/workflows/ci.yml‎

Lines changed: 41 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,41 @@
1-
name: CI
2-
on:
3-
pull_request:
4-
branches: [master]
5-
6-
jobs:
7-
test:
8-
runs-on: ubuntu-latest
9-
permissions:
10-
contents: write
11-
steps:
12-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
13-
14-
# CHANGE_ME - implement automation test for the actual action
15-
- name: invoke action
16-
uses: ./
17-
with:
18-
input1: foo
19-
input2: bar
20-
21-
- name: Verify the result
22-
run: |
23-
source assert.sh
24-
assert_eq "foo" "$DUMMY_INPUT1"
25-
assert_eq "bar" "$DUMMY_INPUT2"
1+
name: CI
2+
on:
3+
pull_request:
4+
branches: [master]
5+
6+
jobs:
7+
build:
8+
9+
runs-on: ubuntu-latest
10+
11+
defaults:
12+
run:
13+
shell: bash
14+
15+
strategy:
16+
matrix:
17+
node-version: [18.x, 20.x, 22.x]
18+
# See supported Node.js release schedule at https://nodejs.org/en/about/releases/
19+
20+
steps:
21+
- uses: actions/checkout@v4
22+
- name: Use Node.js ${{ matrix.node-version }}
23+
id: setup-node
24+
uses: ./
25+
with:
26+
node-version: ${{ matrix.node-version }}
27+
28+
- name: Check outputs
29+
run: |
30+
source assert.sh
31+
assert_eq "$(node -v)" "${{ steps.setup-node.outputs.node-version }}"
32+
33+
- name: Test Safe Chains
34+
run: |
35+
source assert.sh
36+
set +e
37+
npm install -g safe-chain-test
38+
exitCode=$?
39+
assert_eq "1" "$exitCode"
40+
exit 0
41+
continue-on-error: true

‎.github/workflows/dependabot-automation.yml‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
name: Dependabot automation
2-
3-
on: pull_request
4-
5-
permissions:
6-
contents: write
7-
pull-requests: write
8-
9-
jobs:
10-
dependabot:
11-
runs-on: ubuntu-latest
12-
if: github.actor == 'dependabot[bot]'
13-
steps:
14-
- name: Dependabot metadata
15-
id: metadata
16-
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
17-
with:
18-
github-token: "${{ secrets.GITHUB_TOKEN }}"
19-
- name: Approve PR
20-
run: gh pr review --approve "$PR_URL"
21-
env:
22-
PR_URL: ${{ github.event.pull_request.html_url }}
23-
GITHUB_TOKEN: ${{ secrets.STEP_GITHUB_ACTION_TOKEN }}
24-
- name: Enable auto-merge for Dependabot PRs that doesn't include major version update
25-
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
26-
run: gh pr merge --auto --squash "$PR_URL"
27-
env:
28-
PR_URL: ${{ github.event.pull_request.html_url }}
29-
GITHUB_TOKEN: ${{ secrets.STEP_GITHUB_ACTION_TOKEN }}
30-
1+
name: Dependabot automation
2+
3+
on: pull_request
4+
5+
permissions:
6+
contents: write
7+
pull-requests: write
8+
9+
jobs:
10+
dependabot:
11+
runs-on: ubuntu-latest
12+
if: github.actor == 'dependabot[bot]'
13+
steps:
14+
- name: Dependabot metadata
15+
id: metadata
16+
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
17+
with:
18+
github-token: "${{ secrets.GITHUB_TOKEN }}"
19+
- name: Approve PR
20+
run: gh pr review --approve "$PR_URL"
21+
env:
22+
PR_URL: ${{ github.event.pull_request.html_url }}
23+
GITHUB_TOKEN: ${{ secrets.STEP_GITHUB_ACTION_TOKEN }}
24+
- name: Enable auto-merge for Dependabot PRs that doesn't include major version update
25+
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
26+
run: gh pr merge --auto --squash "$PR_URL"
27+
env:
28+
PR_URL: ${{ github.event.pull_request.html_url }}
29+
GITHUB_TOKEN: ${{ secrets.STEP_GITHUB_ACTION_TOKEN }}
30+

‎.github/workflows/lint-pr.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
name: "Lint PR"
2-
3-
on:
4-
pull_request:
5-
types: ["opened", "edited", "reopened", "synchronize"]
6-
7-
jobs:
8-
pr-lint:
9-
runs-on: ubuntu-latest
10-
steps:
1+
name: "Lint PR"
2+
3+
on:
4+
pull_request:
5+
types: ["opened", "edited", "reopened", "synchronize"]
6+
7+
jobs:
8+
pr-lint:
9+
runs-on: ubuntu-latest
10+
steps:
1111
- uses: linz/action-pull-request-lint@7adb4bc59b59dc6e097de831c29a17c2c1338826 # v1.2.0

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
name: release-please
2-
3-
on:
4-
push:
5-
branches:
6-
- master
7-
8-
permissions:
9-
contents: write
10-
pull-requests: write
11-
12-
jobs:
13-
release-please:
14-
runs-on: ubuntu-latest
15-
steps:
16-
- uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
17-
with:
18-
release-type: simple
1+
name: release-please
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
12+
jobs:
13+
release-please:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
17+
with:
18+
release-type: simple
1919
token: ${{ secrets.STEP_GITHUB_ACTION_TOKEN }}

‎README.md‎

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,2 @@
1-
# template-github-action
2-
3-
Template repo to kick start a composite Github action, providing the following features and configurations
4-
5-
1. [Sample composite action](action.yaml)
6-
2. [Sample CI workflow](.github/workflows/ci.yml) to test the sample action
7-
- provided [assert.sh](assert.sh) to perform simple assertions in shell
8-
3. [Repo setup script](setup_repo.sh) to configure the new repo
9-
4. PR title linting to enforce that the PR titles follows [conventional commit standard](https://www.conventionalcommits.org/)
10-
5. Configures dependabot to update any Github action dependencies
11-
6. Dependabot automation workflow to automatically approve and squash merge dependabot PRs
12-
7. Automated release with [release-please](https://github.com/googleapis/release-please-action)
13-
8. Sample [CODEOWNERS](.github/CODEOWNERS) file
14-
15-
## Template usage
16-
17-
1. When creating a new repo
18-
1. Recommend to prefix the repo name with `action-`, e.g. `action-setup-playwright`
19-
2. Use the `Start with a template` option and select this repo as the template.
20-
3. Clone the new repo
21-
4. Make sure you have [Github CLI](https://github.com/cli/cli#installation) installed
22-
5. Open a bash terminal to the repo folder
23-
6. Run `./setup_repo.sh` to configure the repo settings. Note - this script self-deletes after successful run, commit
24-
the deletion as the script would be no longer required.
25-
2. Search for word `CHANGE_ME` and modify the code as needed.
26-
3. Replace this README file with documentation for the new action.
27-
4. Implement the new action and release it with release-please
28-
5. Ask in Slack channel `#team-step-enablement` or `#help-github` to grant dependabot access to this new repo
29-
1. so that consumers of your new action can receive automated upgrades when new version is released
30-
2. this setting is at the bottom of this page https://github.com/organizations/linz/settings/security_analysis
1+
# action-setup-node
2+
This action wraps the [actions/setup-node](https://github.com/actions/setup-node) action and implements [Aikido Safe-Chain](https://github.com/AikidoSec/safe-chain) to fail install upon an attempt to install a malicious node package. Please refer to the [actions/setup-node](https://github.com/actions/setup-node) documentation as this action is a like-for-like replacement, however, in all instances please use `linz/action-setup-node` rather than `actions/setup-node`.

‎action.yaml‎

Lines changed: 64 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,64 @@
1-
# CHANGE_ME - implement the actual action
2-
name: dummy composite action
3-
4-
inputs:
5-
input1:
6-
description: value to set to DUMMY_INPUT1 environment variable
7-
input2:
8-
description: value to set to DUMMY_INPUT2 environment variable
9-
10-
runs:
11-
using: composite
12-
steps:
13-
- name: Dummy step 1
14-
shell: bash
15-
env:
16-
INPUT1: ${{ inputs.input1 }}
17-
INPUT2: ${{ inputs.input2 }}
18-
run: |
19-
echo "DUMMY_INPUT1=$INPUT1" >> $GITHUB_ENV
20-
echo "DUMMY_INPUT2=$INPUT2" >> $GITHUB_ENV
1+
name: Setup node build environment
2+
description: |
3+
Configure Aikido Safe-Chain and Node environment
4+
inputs:
5+
node-version:
6+
description: 'Version Spec of the version to use. Examples: 12.x, 10.15.1, >=10.15.0.'
7+
node-version-file:
8+
description: 'File containing the version Spec of the version to use. Examples: package.json, .nvmrc, .node-version, .tool-versions.'
9+
architecture:
10+
description: 'Target architecture for Node to use. Examples: x86, x64. Will use system architecture by default.'
11+
check-latest:
12+
description: 'Set this option if you want the action to check for the latest available version that satisfies the version spec.'
13+
default: false
14+
registry-url:
15+
description: 'Optional registry to set up for auth. Will set the registry in a project level .npmrc and .yarnrc file, and set up auth to read in from env.NODE_AUTH_TOKEN.'
16+
scope:
17+
description: 'Optional scope for authenticating against scoped registries. Will fall back to the repository owner when using the GitHub Packages registry (https://npm.pkg.github.com/).'
18+
token:
19+
description: Used to pull node distributions from node-versions. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
20+
default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
21+
cache:
22+
description: 'Used to specify a package manager for caching in the default directory. Supported values: npm, yarn, pnpm.'
23+
package-manager-cache:
24+
description: 'Set to false to disable automatic caching. By default, caching is enabled when either devEngines.packageManager or the top-level packageManager field in package.json specifies npm as the package manager.'
25+
default: true
26+
cache-dependency-path:
27+
description: 'Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc. Supports wildcards or a list of file names for caching multiple dependencies.'
28+
mirror:
29+
description: 'Used to specify an alternative mirror to downlooad Node.js binaries from'
30+
mirror-token:
31+
description: 'The token used as Authorization header when fetching from the mirror'
32+
outputs:
33+
cache-hit:
34+
description: 'A boolean value to indicate if a cache was hit.'
35+
value: ${{ steps.setup-node.outputs.cache-hit }}
36+
node-version:
37+
description: 'The installed node version.'
38+
value: ${{ steps.setup-node.outputs.node-version }}
39+
40+
41+
runs:
42+
using: composite
43+
steps:
44+
- name: Setup Node.js
45+
id: setup-node
46+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
47+
with:
48+
node-version: ${{ inputs.node-version }}
49+
node-version-file: ${{ inputs.node-version-file }}
50+
architecture: ${{ inputs.architecture }}
51+
check-latest: ${{ inputs.check-latest }}
52+
registry-url: ${{ inputs.registry-url }}
53+
scope: ${{ inputs.scope }}
54+
token: ${{ inputs.token }}
55+
cache: ${{ inputs.cache }}
56+
package-manager-cache: ${{ inputs.package-manager-cache }}
57+
cache-dependency-path: ${{ inputs.cache-dependency-path }}
58+
mirror: ${{ inputs.mirror }}
59+
mirror-token: ${{ inputs.mirror-token }}
60+
- name: Setup Aikido Safe-Chain
61+
shell: bash
62+
run: |
63+
npm i -g @aikidosec/safe-chain
64+
safe-chain setup-ci

0 commit comments

Comments
 (0)