Skip to content

Commit 46f2a34

Browse files
nirinchevnirinchev
committed
Fix codeql alerts
1 parent ab424fa commit 46f2a34

File tree

7 files changed

+68
-48
lines changed

7 files changed

+68
-48
lines changed

‎.github/workflows/bump-auxiliary-packages.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Bump Auxiliary Packages
22
on:
33
workflow_dispatch:
44

5+
permissions:
6+
contents: none # We use the github app to checkout and create PR
7+
58
jobs:
69
update_generated_files:
710
name: Bump packages
@@ -11,7 +14,7 @@ jobs:
1114
id: app-token
1215
with:
1316
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
14-
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
17+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
1518
- uses: actions/checkout@v4
1619
with:
1720
# don't checkout a detatched HEAD

‎.github/workflows/check-pr-title.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,25 @@ on:
33
pull_request:
44
types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, converted_to_draft, edited]
55

6+
permissions:
7+
pull-requests: read # to read PR title and labels
8+
69
jobs:
710
check-pr-title:
811
name: Check PR Title
912
runs-on: ubuntu-latest
1013
steps:
1114
- name: Enforce conventional commit style
12-
uses: realm/ci-actions/title-checker@main
15+
uses: realm/ci-actions/title-checker@d6cc8f067474759d38e6d24e272027b4c88bc0a9
1316
with:
1417
regex: '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test|ops){1}(\([\w\-\.]+\))?(!)?: .*'
1518
error-hint: 'Invalid PR title. Make sure it follows the conventional commit specification (i.e. "<type>(<optional scope>): <description>") or add the no-title-validation label'
16-
ignore-labels: 'no-title-validation'
19+
ignore-labels: "no-title-validation"
1720
- name: Enforce JIRA ticket in title
18-
uses: realm/ci-actions/title-checker@main
21+
uses: realm/ci-actions/title-checker@d6cc8f067474759d38e6d24e272027b4c88bc0a9
1922
# Skip the JIRA ticket check for PRs opened by bots
2023
if: ${{ !contains(github.event.pull_request.user.login, '[bot]') }}
2124
with:
22-
regex: '[A-Z]{4,10}-[0-9]{1,5}$'
23-
error-hint: 'Invalid PR title. Make sure it ends with a JIRA ticket - i.e. MONGOSH-1234 or add the no-title-validation label'
24-
ignore-labels: 'no-title-validation'
25+
regex: "[A-Z]{4,10}-[0-9]{1,5}$"
26+
error-hint: "Invalid PR title. Make sure it ends with a JIRA ticket - i.e. MONGOSH-1234 or add the no-title-validation label"
27+
ignore-labels: "no-title-validation"

‎.github/workflows/cron-tasks.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
branches:
99
- main
1010

11+
permissions:
12+
contents: none # We use the github app to checkout and push changes
13+
1114
jobs:
1215
update_generated_files:
1316
name: Update automatically generated files

‎.github/workflows/homebrew.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
schedule:
55
- cron: "0 0 * * *"
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
smoke-test-homebrew:
912
name: Test on ${{ matrix.runner }}
@@ -21,10 +24,7 @@ jobs:
2124

2225
- name: Report failure
2326
if: ${{ failure() }}
24-
env:
25-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_MONGOSH_DEVEL_WEBHOOK_URL }}
26-
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
27-
uses: slackapi/[email protected]
27+
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # 2.0.0
2828
with:
2929
payload: |
3030
{
@@ -39,3 +39,5 @@ jobs:
3939
}
4040
]
4141
}
42+
webhook: ${{ secrets.SLACK_MONGOSH_DEVEL_WEBHOOK_URL }}
43+
webhook-type: incoming-webhook

‎.github/workflows/publish-auxiliary-packages.yml‎

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
branches:
1010
- main
1111

12+
permissions:
13+
contents: none # We use the github app to checkout and push tags
14+
1215
jobs:
1316
publish:
1417
if: |
@@ -18,40 +21,39 @@ jobs:
1821
runs-on: ubuntu-latest
1922

2023
steps:
21-
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
22-
id: app-token
23-
with:
24-
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
25-
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
26-
27-
- uses: actions/checkout@v4
28-
with:
29-
# don't checkout a detatched HEAD
30-
ref: ${{ github.head_ref }}
31-
32-
# this is important so git log can pick up on
33-
# the whole history to generate the list of AUTHORS
34-
fetch-depth: "0"
35-
token: ${{ steps.app-token.outputs.token }}
36-
37-
- name: "Use Node.js 20"
38-
uses: actions/setup-node@v4
39-
with:
40-
node-version: 20.16.0
41-
42-
- name: Install [email protected]
43-
run: npm install -g [email protected]
44-
45-
- name: Install Dependencies
46-
run: |
47-
npm ci
48-
49-
- name: "Publish what is not already in NPM"
50-
env:
51-
NPM_TOKEN: ${{ secrets.DEVTOOLSBOT_NPM_TOKEN }}
52-
run: |
53-
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
54-
npm config list
55-
echo "Publishing packages as $(npm whoami)"
56-
npm run publish-auxiliary
57-
24+
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
25+
id: app-token
26+
with:
27+
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
28+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
29+
30+
- uses: actions/checkout@v4
31+
with:
32+
# don't checkout a detatched HEAD
33+
ref: ${{ github.head_ref }}
34+
35+
# this is important so git log can pick up on
36+
# the whole history to generate the list of AUTHORS
37+
fetch-depth: "0"
38+
token: ${{ steps.app-token.outputs.token }}
39+
40+
- name: "Use Node.js 20"
41+
uses: actions/setup-node@v4
42+
with:
43+
node-version: 20.16.0
44+
45+
- name: Install [email protected]
46+
run: npm install -g [email protected]
47+
48+
- name: Install Dependencies
49+
run: |
50+
npm ci
51+
52+
- name: "Publish what is not already in NPM"
53+
env:
54+
NPM_TOKEN: ${{ secrets.DEVTOOLSBOT_NPM_TOKEN }}
55+
run: |
56+
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
57+
npm config list
58+
echo "Publishing packages as $(npm whoami)"
59+
npm run publish-auxiliary

‎.github/workflows/smoke-tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
- main
66
pull_request:
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
smoke-tests:
1013
name: "OS: ${{ matrix.runner }}, node@${{ matrix.node }}"

‎.github/workflows/update-node-js.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
schedule:
77
- cron: "0 0 * * *"
88

9+
permissions:
10+
contents: none # We use the github app to open a PR
11+
912
jobs:
1013
update_generated_files:
1114
name: Update Node.js versions
@@ -21,6 +24,7 @@ jobs:
2124
with:
2225
# don't checkout a detatched HEAD
2326
ref: ${{ github.head_ref }}
27+
token: ${{ steps.app-token.outputs.token }}
2428

2529
- uses: actions/setup-node@v4
2630
with:

0 commit comments

Comments
 (0)