Skip to content

Commit 73cd200

Browse files
rhyslbwrhyslbw
committed
ci: blocklist package installation in GitHub workflows
Create install action and update all workflows: ✅ Created .github/actions/install/action.yml - Centralized yarn install with security flags - Configurable install args and memory settings - Clean max-old-space-size input (MB only) - Mandatory yarn constraints verification - GitHub variable support via ignore-scripts input ✅ Updated 9 workflows to use centralized action: - continuous-integration-unit-tests.yaml - continuous-integration-e2e.yaml - continuous-integration-side-tests.yaml - continuous-integration-blockfrost-e2e.yaml - test-deploy-e2e.yaml - k6-web-socket.yaml - k6-wallets.yaml - release.yaml - post_integration.yml ✅ Added Yarn constraints infrastructure - Installed @yarnpkg/plugin-constraints - Configured in .yarnrc.yml - Created empty .yarn/constraints.pro for rules - Updated .gitignore to track constraints.pro - All workflows map vars.DISABLE_NPM_SCRIPTS to action 🎯 Benefits: - Single source of truth for install logic - Easy to add constraint checks later - Consistent security posture across all workflows - Reduced duplication and maintenance burden - Foundation ready for security policy enforcement
1 parent 53d2b35 commit 73cd200

14 files changed

+133
-24
lines changed

‎.github/actions/install/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 'Install Dependencies'
2+
description: 'Install dependencies with yarn and run security constraint checks'
3+
inputs:
4+
install-args:
5+
description: 'Additional arguments for yarn install'
6+
required: false
7+
default: '--inline-builds --mode=skip-build'
8+
max-old-space-size:
9+
description: 'Maximum old space size in MB for Node.js'
10+
required: false
11+
default: '8192'
12+
ignore-scripts:
13+
description: 'Whether to ignore npm scripts during install'
14+
required: false
15+
default: 'false'
16+
runs:
17+
using: 'composite'
18+
steps:
19+
- name: 🔨 Install
20+
shell: bash
21+
run: yarn install --immutable --immutable-cache ${{ inputs.install-args }}
22+
env:
23+
NODE_OPTIONS: '--max_old_space_size=${{ inputs.max-old-space-size }}'
24+
npm_config_ignore_scripts: ${{ inputs.ignore-scripts }}
25+
26+
- name: 🛡️ Security Constraints Check
27+
shell: bash
28+
run: yarn constraints

‎.github/workflows/continuous-integration-blockfrost-e2e.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,18 @@ jobs:
5353
with:
5454
node-version: 18.12.0
5555

56+
- name: 🔨 Install
57+
uses: ./.github/actions/install
58+
with:
59+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
60+
5661
- name: 🔨 Build
5762
run: |
58-
yarn install --immutable --inline-builds --mode=skip-build
5963
yarn workspace @cardano-sdk/cardano-services-client build:cjs
6064
yarn workspace @cardano-sdk/cardano-services build:cjs
6165
yarn workspace @cardano-sdk/e2e build:cjs
6266
yarn workspace @cardano-sdk/util-dev build:cjs
6367
docker build --no-cache .
64-
env:
65-
NODE_OPTIONS: '--max_old_space_size=8192'
6668
6769
- name: 🌐 Setup local test network
6870
working-directory: packages/e2e

‎.github/workflows/continuous-integration-e2e.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,13 @@ jobs:
5353
with:
5454
node-version: 18.12.0
5555

56+
- name: 🔨 Install
57+
uses: ./.github/actions/install
58+
with:
59+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
60+
5661
- name: 🔨 Build
5762
run: |
58-
yarn install --immutable --inline-builds --mode=skip-build
5963
yarn workspace @cardano-sdk/cardano-services-client build:cjs
6064
yarn workspace @cardano-sdk/cardano-services build:cjs
6165
yarn workspace @cardano-sdk/e2e build:cjs

‎.github/workflows/continuous-integration-side-tests.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,13 @@ jobs:
2525
with:
2626
node-version: 18.12.0
2727

28+
- name: 🔨 Install
29+
uses: ./.github/actions/install
30+
with:
31+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
32+
2833
- name: 🔨 Build
29-
run: |
30-
yarn install --immutable --inline-builds --mode=skip-build
31-
yarn build
34+
run: yarn build
3235
env:
3336
NODE_OPTIONS: '--max_old_space_size=8192'
3437

‎.github/workflows/continuous-integration-unit-tests.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,13 @@ jobs:
2525
with:
2626
node-version: 18.12.0
2727

28+
- name: 🔨 Install
29+
uses: ./.github/actions/install
30+
with:
31+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
32+
2833
- name: 🔨 Build
29-
run: |
30-
yarn install --immutable --inline-builds --mode=skip-build
31-
yarn build
34+
run: yarn build
3235
env:
3336
NODE_OPTIONS: '--max_old_space_size=8192'
3437

‎.github/workflows/k6-wallets.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,13 @@ jobs:
6767
uses: actions/setup-node@v3
6868
with:
6969
node-version: 18.12.0
70+
- name: 🔨 Install
71+
uses: ./.github/actions/install
72+
with:
73+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
74+
7075
- name: 🔨 Build
71-
run: |
72-
yarn install --immutable --inline-builds --mode=skip-build
73-
yarn workspace @cardano-sdk/util-dev build:cjs
76+
run: yarn workspace @cardano-sdk/util-dev build:cjs
7477
env:
7578
NODE_OPTIONS: '--max_old_space_size=8192'
7679
- name: Run k6 cloud test

‎.github/workflows/k6-web-socket.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,13 @@ jobs:
5959
uses: actions/setup-node@v3
6060
with:
6161
node-version: 18.12.0
62+
- name: 🔨 Install
63+
uses: ./.github/actions/install
64+
with:
65+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
66+
6267
- name: 🔨 Build
63-
run: |
64-
yarn install --immutable --inline-builds --mode=skip-build
65-
yarn workspace @cardano-sdk/util-dev build:cjs
68+
run: yarn workspace @cardano-sdk/util-dev build:cjs
6669
env:
6770
NODE_OPTIONS: '--max_old_space_size=8192'
6871
- name: Run k6 cloud test

‎.github/workflows/post_integration.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,14 @@ jobs:
1717
with:
1818
node-version: 18.12.0
1919

20+
- name: 🔨 Install
21+
uses: ./.github/actions/install
22+
with:
23+
max-old-space-size: '10240'
24+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
25+
2026
- name: 🔨 Build Docs
21-
env:
22-
NODE_OPTIONS: '--max-old-space-size=10240'
2327
run: |
24-
yarn install --immutable --inline-builds
2528
yarn build
2629
yarn docs
2730

‎.github/workflows/release.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,9 @@ jobs:
3434
git_commit_gpgsign: true
3535

3636
- name: 💽 Install dependencies
37-
run: |
38-
yarn install --immutable --inline-builds --mode=skip-build
37+
uses: ./.github/actions/install
38+
with:
39+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
3940
env:
4041
YARN_ENABLE_IMMUTABLE_INSTALLS: false
4142

‎.github/workflows/test-deploy-e2e.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,15 @@ jobs:
6565
with:
6666
node-version: 18.12.0
6767

68+
- name: 🔨 Install
69+
uses: ./.github/actions/install
70+
with:
71+
ignore-scripts: ${{ vars.DISABLE_NPM_SCRIPTS || 'false' }}
72+
6873
- name: 🔨 Build
6974
run: |
70-
yarn install --immutable --inline-builds --mode=skip-build
7175
yarn build:cjs
7276
docker build --no-cache .
73-
env:
74-
NODE_OPTIONS: '--max_old_space_size=8192'
7577
7678
- name: 🔬 Test - e2e - wallet
7779
env:

0 commit comments

Comments
 (0)