fix(security): harden CLI credential and auth handling (#71) #104
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| changesets: | |
| name: Changesets | |
| runs-on: ubuntu-latest | |
| outputs: | |
| hasChangesets: ${{ steps.changesets-action.outputs.hasChangesets }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install | |
| - name: Create Release Pull Request | |
| id: changesets-action | |
| uses: changesets/action@v1 | |
| with: | |
| version: bun run version | |
| title: "Release" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| version: | |
| name: Check versions | |
| runs-on: ubuntu-latest | |
| needs: changesets | |
| if: needs.changesets.outputs.hasChangesets == 'false' | |
| outputs: | |
| cli-version: ${{ steps.check-cli.outputs.version }} | |
| database-shell-version: ${{ steps.check-database-shell.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Check CLI version | |
| id: check-cli | |
| run: | | |
| VERSION=$(node -p "require('./packages/cli/package.json').version") | |
| PUBLISHED=$(npm view @bunny.net/cli version 2>/dev/null || echo "0.0.0") | |
| if [ "$VERSION" != "$PUBLISHED" ]; then | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "New version detected: $VERSION (published: $PUBLISHED)" | |
| else | |
| echo "No version change: $VERSION" | |
| fi | |
| - name: Check database-shell version | |
| id: check-database-shell | |
| run: | | |
| VERSION=$(node -p "require('./packages/database-shell/package.json').version") | |
| PUBLISHED=$(npm view @bunny.net/database-shell version 2>/dev/null || echo "0.0.0") | |
| if [ "$VERSION" != "$PUBLISHED" ]; then | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "New version detected: $VERSION (published: $PUBLISHED)" | |
| else | |
| echo "No version change: $VERSION" | |
| fi | |
| build-cli-binaries: | |
| name: Build ${{ matrix.npm-pkg }} | |
| needs: version | |
| if: needs.version.outputs.cli-version | |
| strategy: | |
| matrix: | |
| include: | |
| - target: bun-linux-x64 | |
| os: ubuntu-latest | |
| npm-pkg: cli-linux-x64 | |
| binary: bunny | |
| - target: bun-linux-arm64 | |
| os: ubuntu-latest | |
| npm-pkg: cli-linux-arm64 | |
| binary: bunny | |
| - target: bun-darwin-x64 | |
| os: macos-latest | |
| npm-pkg: cli-darwin-x64 | |
| binary: bunny | |
| - target: bun-darwin-arm64 | |
| os: macos-latest | |
| npm-pkg: cli-darwin-arm64 | |
| binary: bunny | |
| - target: bun-windows-x64 | |
| os: ubuntu-latest | |
| npm-pkg: cli-windows-x64 | |
| binary: bunny.exe | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.3.11" | |
| - run: bun install | |
| - name: Build database studio | |
| run: bun run --filter @bunny.net/database-studio build:client | |
| - name: Build binary | |
| run: bun build packages/cli/src/index.ts --compile --minify --sourcemap --target=${{ matrix.target }} --outfile ${{ matrix.binary }} | |
| - name: Prepare npm package | |
| run: cp ${{ matrix.binary }} packages/${{ matrix.npm-pkg }}/ | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.npm-pkg }} | |
| path: packages/${{ matrix.npm-pkg }}/ | |
| if-no-files-found: error | |
| build-database-shell-binaries: | |
| name: Build ${{ matrix.npm-pkg }} | |
| needs: version | |
| if: needs.version.outputs.database-shell-version | |
| strategy: | |
| matrix: | |
| include: | |
| - target: bun-linux-x64 | |
| os: ubuntu-latest | |
| npm-pkg: database-shell-linux-x64 | |
| binary: bsql | |
| - target: bun-linux-arm64 | |
| os: ubuntu-latest | |
| npm-pkg: database-shell-linux-arm64 | |
| binary: bsql | |
| - target: bun-darwin-x64 | |
| os: macos-latest | |
| npm-pkg: database-shell-darwin-x64 | |
| binary: bsql | |
| - target: bun-darwin-arm64 | |
| os: macos-latest | |
| npm-pkg: database-shell-darwin-arm64 | |
| binary: bsql | |
| - target: bun-windows-x64 | |
| os: ubuntu-latest | |
| npm-pkg: database-shell-windows-x64 | |
| binary: bsql.exe | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.3.11" | |
| - run: bun install | |
| - name: Build binary | |
| run: bun build packages/database-shell/src/cli.ts --compile --minify --sourcemap --target=${{ matrix.target }} --outfile ${{ matrix.binary }} | |
| - name: Prepare npm package | |
| run: cp ${{ matrix.binary }} packages/${{ matrix.npm-pkg }}/ | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.npm-pkg }} | |
| path: packages/${{ matrix.npm-pkg }}/ | |
| if-no-files-found: error | |
| publish-cli: | |
| name: Publish CLI | |
| runs-on: ubuntu-latest | |
| needs: | |
| - version | |
| - build-cli-binaries | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "20" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Download all platform artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: npm-artifacts | |
| - name: Copy binaries into npm packages | |
| run: | | |
| for pkg in cli-linux-x64 cli-linux-arm64 cli-darwin-x64 cli-darwin-arm64 cli-windows-x64; do | |
| cp -r npm-artifacts/$pkg/* packages/$pkg/ | |
| done | |
| - name: Set execute permissions | |
| run: | | |
| chmod +x packages/cli-linux-x64/bunny | |
| chmod +x packages/cli-linux-arm64/bunny | |
| chmod +x packages/cli-darwin-x64/bunny | |
| chmod +x packages/cli-darwin-arm64/bunny | |
| - name: Publish platform packages | |
| run: | | |
| for pkg in cli-linux-x64 cli-linux-arm64 cli-darwin-x64 cli-darwin-arm64 cli-windows-x64; do | |
| cd packages/$pkg | |
| npm publish --access public | |
| cd ../.. | |
| done | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @bunny.net/cli | |
| run: | | |
| cd packages/cli | |
| npm publish --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Rename binaries for release | |
| run: | | |
| mv npm-artifacts/cli-linux-x64/bunny npm-artifacts/cli-linux-x64/bunny-linux-x64 | |
| mv npm-artifacts/cli-linux-arm64/bunny npm-artifacts/cli-linux-arm64/bunny-linux-arm64 | |
| mv npm-artifacts/cli-darwin-x64/bunny npm-artifacts/cli-darwin-x64/bunny-darwin-x64 | |
| mv npm-artifacts/cli-darwin-arm64/bunny npm-artifacts/cli-darwin-arm64/bunny-darwin-arm64 | |
| mv npm-artifacts/cli-windows-x64/bunny.exe npm-artifacts/cli-windows-x64/bunny-windows-x64.exe | |
| - name: Create GitHub release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: v${{ needs.version.outputs.cli-version }} | |
| name: v${{ needs.version.outputs.cli-version }} | |
| generate_release_notes: true | |
| files: | | |
| npm-artifacts/cli-linux-x64/bunny-linux-x64 | |
| npm-artifacts/cli-linux-arm64/bunny-linux-arm64 | |
| npm-artifacts/cli-darwin-x64/bunny-darwin-x64 | |
| npm-artifacts/cli-darwin-arm64/bunny-darwin-arm64 | |
| npm-artifacts/cli-windows-x64/bunny-windows-x64.exe | |
| fail_on_unmatched_files: true | |
| publish-database-shell: | |
| name: Publish database-shell | |
| runs-on: ubuntu-latest | |
| needs: | |
| - version | |
| - build-database-shell-binaries | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "20" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Download all platform artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: npm-artifacts | |
| - name: Copy binaries into npm packages | |
| run: | | |
| for pkg in database-shell-linux-x64 database-shell-linux-arm64 database-shell-darwin-x64 database-shell-darwin-arm64 database-shell-windows-x64; do | |
| cp -r npm-artifacts/$pkg/* packages/$pkg/ | |
| done | |
| - name: Set execute permissions | |
| run: | | |
| chmod +x packages/database-shell-linux-x64/bsql | |
| chmod +x packages/database-shell-linux-arm64/bsql | |
| chmod +x packages/database-shell-darwin-x64/bsql | |
| chmod +x packages/database-shell-darwin-arm64/bsql | |
| - name: Publish platform packages | |
| run: | | |
| for pkg in database-shell-linux-x64 database-shell-linux-arm64 database-shell-darwin-x64 database-shell-darwin-arm64 database-shell-windows-x64; do | |
| cd packages/$pkg | |
| npm publish --access public | |
| cd ../.. | |
| done | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @bunny.net/database-shell | |
| run: | | |
| cd packages/database-shell | |
| npm publish --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |