Skip to content

Commit e3b20d7

Browse files
STRMLSTRML
authored
chore(github): add workflows from react-grid-layout (#217)
gh-pages auto-deploy, lint, test, packj
1 parent b34743f commit e3b20d7

File tree

6 files changed

+263
-0
lines changed

6 files changed

+263
-0
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1+
<!--
12
Thanks for submitting a pull request to React-Resizable!
23
34
Please reference an open issue. If one has not been created, please create one along with a failing example or test case.
45
56
Please do not commit built files (`/dist`) to pull requests. They are built only at release.
7+
-->

‎.github/workflows/gh-pages.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Build and Deploy to GitHub Pages
2+
on:
3+
push:
4+
tags:
5+
- "*"
6+
jobs:
7+
build-and-deploy:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout 🛎️
11+
uses: actions/[email protected]
12+
13+
- name: Install and Build
14+
run: |
15+
yarn
16+
yarn build-example
17+
18+
- name: Deploy 🚀
19+
uses: JamesIves/[email protected]
20+
with:
21+
branch: gh-pages # The branch the action should deploy to.
22+
folder: examples # The folder the action should deploy.
23+
target-folder: examples # The destination. Shouldn't touch other folders.

‎.github/workflows/lint.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Lint
2+
3+
on:
4+
# Trigger the workflow on push or pull request,
5+
# but only for the master branch
6+
push:
7+
branches:
8+
- master
9+
pull_request:
10+
branches:
11+
- master
12+
13+
jobs:
14+
run-linters:
15+
name: Run linters
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Check out Git repository
20+
uses: actions/checkout@v2
21+
22+
- name: Set up Node.js
23+
uses: actions/setup-node@v2
24+
with:
25+
node-version: 14
26+
27+
- name: Install Node.js dependencies
28+
run: yarn
29+
30+
- name: Run ESLint/Flow
31+
run: yarn lint

‎.github/workflows/packj.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Packj Security Audit
2+
3+
# Controls when the workflow will run
4+
on:
5+
pull_request:
6+
branches:
7+
- master
8+
9+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
10+
jobs:
11+
12+
# This workflow contains a single job called "packj-audit"
13+
packj-security-audit:
14+
15+
# The type of runner that the job will run on
16+
runs-on: ubuntu-latest
17+
18+
# Steps represent a sequence of tasks that will be executed as part of the job
19+
steps:
20+
21+
# Audit
22+
- name: Audit dependencies
23+
uses: ossillate-inc/[email protected]
24+
25+
with:
26+
DEPENDENCY_FILES: npm:package.json
27+
REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/test.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: CI
2+
on:
3+
# Trigger the workflow on push or pull request,
4+
# but only for the master branch
5+
push:
6+
branches:
7+
- master
8+
pull_request:
9+
branches:
10+
- master
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Check out Git repository
16+
uses: actions/checkout@v2
17+
18+
- name: Set up Node.js
19+
uses: actions/setup-node@v2
20+
with:
21+
node-version: 14
22+
23+
- name: Install Node.js dependencies
24+
run: yarn
25+
26+
- name: Run tests
27+
run: yarn test

‎.packj.yaml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
#
2+
# Audit policies
3+
#
4+
audit:
5+
alerts:
6+
#
7+
# category: malicious packages (publicly known and unknown)
8+
#
9+
malicious:
10+
contains known malware:
11+
- reason: package is known to contain a dangerous malware
12+
- enabled: true
13+
typo-squatting or repo-jacking package:
14+
- reason: package impersonates another popular package to propagate malware
15+
- enabled: true
16+
17+
#
18+
# alert category: suspicious packages (potentially malicious)
19+
#
20+
suspicious:
21+
inconsistent with repo source:
22+
- reason: package code inconsistent with the public repo source code
23+
- enabled: false # WIP
24+
overwrites system binaries:
25+
- reason: package code inconsistent with the public repo source code
26+
- enabled: false # WIP
27+
28+
#
29+
# alert category: packages vulnerable to code exploits
30+
#
31+
vulnerable:
32+
contains known vulnerabilities:
33+
- reason: known vulnerabilities (CVEs) in package code could be exploited
34+
- enabled: true
35+
insecure network communication:
36+
- reason: package code uses insecure network communication (not https)
37+
- enabled: false # WIP
38+
39+
#
40+
# packages with undesirable or "risky" attributes
41+
#
42+
undesirable:
43+
package is old or abandoned:
44+
- reason: old or abandoned packages receive no security updates and are risky
45+
- enabled: true
46+
47+
invalid or no author email:
48+
- reason: a package with lack of or invalid author email suggests 2FA not enabled
49+
- enabled: true
50+
51+
invalid or no homepage:
52+
- reason: a package with no or invalid homepage may not be preferable
53+
- enabled: false
54+
55+
no source repo:
56+
- reason: lack of public source repo may suggest malicious intention
57+
- enabled: true
58+
59+
fewer downloads:
60+
- reason: a package with few downloads may not be preferable
61+
- enabled: true
62+
63+
no or insufficient readme:
64+
- reason: a package with lack of documentation may not be preferable
65+
- enabled: false
66+
67+
fewer versions or releases:
68+
- reason: few versions suggest unstable or inactive project
69+
- enabled: true
70+
71+
too many dependencies:
72+
- reason: too many dependencies increase attack surface
73+
- enabled: false
74+
75+
version release after a long gap:
76+
- reason: a release after a long time may indicate account hijacking
77+
- enabled: false
78+
79+
contains custom installation hooks:
80+
- reason: custom installation hooks may download or execute malicious code
81+
- enabled: false # WIP
82+
83+
#
84+
# type: repo stats
85+
#
86+
few source repo stars:
87+
- reason: a package with few repo stars may not be preferable
88+
- enabled: false
89+
90+
few source repo forks:
91+
- reason: a package with few repo forks may not be preferable
92+
- enabled: false
93+
94+
forked source repo:
95+
- reason: a forked copy of a popular package may contain malicious code
96+
- enabled: true
97+
98+
#
99+
# type: APIs and permissions
100+
#
101+
generates new code:
102+
- reason: package generates new code at runtime, which could be malicious
103+
- enabled: false
104+
forks or exits OS processes:
105+
- reason: package spawns new operating system processes, which could be malicious
106+
- enabled: false
107+
accesses obfuscated (hidden) code:
108+
- enabled: true
109+
accesses environment variables:
110+
- enabled: false
111+
changes system/environment variables:
112+
- enabled: false
113+
accesses files and dirs:
114+
- enabled: false
115+
communicates with external network:
116+
- enabled: false
117+
reads user input:
118+
- enabled: false
119+
120+
#
121+
# Sandboxing policies
122+
#
123+
sandbox:
124+
rules:
125+
#
126+
# File system (allow or block accesses to file/dirs)
127+
#
128+
# ~/ represents home dir
129+
# . represents cwd dir
130+
#
131+
# NOTE: only ONE 'allow' and 'block' lines are allowed
132+
#
133+
fs:
134+
# TODO: customize as per your threat model
135+
136+
# block access to home dir and all other locations (except the ones below)
137+
block: ~/, /
138+
allow: ., ~/.cache, ~/.npm, ~/.local, ~/.ruby, /tmp, /proc, /etc, /var, /bin, /usr/include, /usr/local, /usr/bin, /usr/lib, /usr/share, /lib
139+
140+
#
141+
# Network (allow or block domains/ports)
142+
#
143+
# NOTE: only ONE 'allow' and 'block' lines are allowed
144+
#
145+
network:
146+
147+
# TODO: customize as per your threat model
148+
149+
# block all external network communication (except the ones below)
150+
block: 0.0.0.0
151+
152+
# For NPM packages
153+
allow: registry.yarnpkg.com:0, npmjs.org:0, npmjs.com:0

0 commit comments

Comments
 (0)