Skip to content

Commit df3a1e5

Browse files
mnrendramnrendra
committed
ci: fix all workflows
1 parent f854dd2 commit df3a1e5

File tree

5 files changed

+124
-16
lines changed

5 files changed

+124
-16
lines changed

‎.github/workflows/release.yml‎

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,46 @@ jobs:
1717
name: Release
1818
runs-on: ubuntu-latest
1919
permissions:
20+
actions: read
21+
checks: read
2022
contents: write
23+
id-token: write
2124
issues: write
25+
pull-requests: read
26+
security-events: write
27+
strategy:
28+
fail-fast: false
29+
matrix:
30+
language: [javascript, typescript]
2231
steps:
2332

33+
- name: Harden Runner # Audit all outbound calls
34+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
35+
with:
36+
egress-policy: audit
37+
2438
- name: Checkout
25-
uses: actions/checkout@v4
39+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2640
with:
2741
fetch-depth: 0
2842
persist-credentials: false
2943
token: ${{ secrets.TOKEN }}
3044

3145
- name: Import GPG
32-
uses: crazy-max/ghaction-import-gpg@v6
46+
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
3347
with:
3448
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
3549
passphrase: ${{ secrets.PASSPHRASE }}
3650
git_user_signingkey: true
3751
git_commit_gpgsign: true
3852

53+
- name: Initialize CodeQL
54+
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
55+
with:
56+
languages: ${{ matrix.language }}
57+
3958
- name: Setup Node
40-
uses: actions/setup-node@v4
59+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
4160
with:
4261
node-version: "lts/*"
4362

@@ -47,6 +66,39 @@ jobs:
4766
- name: Build Source Code
4867
run: npm run build
4968

69+
- name: Run Test and Generate Coverage
70+
run: npm test
71+
72+
- name: Upload Coverage Reports to Codecov
73+
uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
74+
with:
75+
token: ${{ secrets.CODECOV_TOKEN }}
76+
77+
- name: Analyze CodeQL
78+
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
79+
with:
80+
category: /language:${{ matrix.language }}
81+
82+
- name: Analyze OSSF Scorecard
83+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
84+
with:
85+
results_file: ossf_scorecard.sarif
86+
results_format: sarif
87+
publish_results: true
88+
repo_token: ${{ secrets.TOKEN }}
89+
90+
- name: Upload to GitHub Actions Artifact
91+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
92+
with:
93+
name: OSSF Scorecard
94+
path: ossf_scorecard.sarif
95+
overwrite: true
96+
97+
- name: Upload to GitHub Code Scanning
98+
uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
99+
with:
100+
sarif_file: ossf_scorecard.sarif
101+
50102
- name: Release and Publish to NPM
51103
env:
52104
GIT_AUTHOR_NAME: ${{ vars.GIT_AUTHOR_NAME }}
@@ -61,4 +113,4 @@ jobs:
61113
run: |
62114
git checkout dev
63115
git pull --rebase origin main
64-
git push --force origin dev
116+
git push --force origin dev

‎.github/workflows/review.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Review
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
review:
11+
name: Review
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
steps:
16+
17+
- name: Harden Runner # Audit all outbound calls
18+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
19+
with:
20+
egress-policy: audit
21+
22+
- name: Checkout
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24+
with:
25+
persist-credentials: false
26+
token: ${{ secrets.TOKEN }}
27+
28+
- name: Dependency Review
29+
uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0

‎.github/workflows/security.yml‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,45 +9,66 @@ jobs:
99
runs-on: ubuntu-latest
1010
permissions:
1111
actions: read
12+
checks: read
1213
contents: read
1314
id-token: write
15+
issues: read
16+
pull-requests: read
1417
security-events: write
1518
strategy:
1619
fail-fast: false
1720
matrix:
1821
language: [javascript, typescript]
1922
steps:
2023

24+
- name: Harden Runner # Audit all outbound calls
25+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
26+
with:
27+
egress-policy: audit
28+
2129
- name: Checkout
22-
uses: actions/checkout@v4
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2331
with:
2432
persist-credentials: false
2533
token: ${{ secrets.TOKEN }}
2634

2735
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@v3
36+
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
2937
with:
3038
languages: ${{ matrix.language }}
3139

40+
- name: Setup Node
41+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
42+
with:
43+
node-version: "lts/*"
44+
45+
- name: Install Dependencies
46+
run: npm ci
47+
48+
- name: Build Source Code
49+
run: npm run build
50+
3251
- name: Analyze CodeQL
33-
uses: github/codeql-action/analyze@v3
52+
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
53+
with:
54+
category: /language:${{ matrix.language }}
3455

3556
- name: Analyze OSSF Scorecard
36-
uses: ossf/[email protected]
57+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
3758
with:
3859
results_file: ossf_scorecard.sarif
3960
results_format: sarif
40-
repo_token: ${{ secrets.TOKEN }}
4161
publish_results: true
62+
repo_token: ${{ secrets.TOKEN }}
4263

4364
- name: Upload to GitHub Actions Artifact
44-
uses: actions/upload-artifact@v4
65+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4566
with:
4667
name: OSSF Scorecard
4768
path: ossf_scorecard.sarif
4869
overwrite: true
4970

5071
- name: Upload to GitHub Code Scanning
51-
uses: github/codeql-action/upload-sarif@v3
72+
uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
5273
with:
53-
sarif_file: ossf_scorecard.sarif
74+
sarif_file: ossf_scorecard.sarif

‎.github/workflows/test.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,13 @@ jobs:
1010
steps:
1111

1212
- name: Checkout
13-
uses: actions/checkout@v4
13+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1414
with:
1515
fetch-depth: 2 # At least fetch the last two commits for comparison
1616
persist-credentials: false
1717

1818
- name: Setup Node
19-
uses: actions/setup-node@v4
19+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2020
with:
2121
node-version: "lts/*"
2222

@@ -30,6 +30,6 @@ jobs:
3030
run: npm test
3131

3232
- name: Upload Coverage Reports to Codecov
33-
uses: codecov/codecov-action@v5
33+
uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
3434
with:
35-
token: ${{ secrets.CODECOV_TOKEN }}
35+
token: ${{ secrets.CODECOV_TOKEN }}

‎.pre-commit-config.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
repos:
2+
3+
- repo: https://github.com/gitleaks/gitleaks
4+
rev: v8.16.3
5+
hooks:
6+
- id: gitleaks

0 commit comments

Comments
 (0)