Skip to content

Commit ad9abbc

Browse files
wswebcreationwswebcreation
authored
Ws/security-fixes (#1002)
* fix: fix test.yml * fix: update permissions * fix: fix alpha.release.yml * fix: fix update.yml * chore: fix versions for pnpm * chore: proper fix for version * chore: use env * chore: remove extra check * chore: fix exact version
1 parent ebe3315 commit ad9abbc

File tree

5 files changed

+72
-71
lines changed

5 files changed

+72
-71
lines changed

‎.github/workflows/alpha.release.yml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,18 @@ jobs:
2525
alpha-release:
2626
name: Alpha Release
2727
runs-on: ubuntu-latest
28-
permissions: write-all
28+
permissions:
29+
contents: write
30+
packages: write
31+
id-token: write
2932

3033
strategy:
3134
matrix:
3235
node-version: [20.x]
3336

3437
steps:
3538
- name: ⬇️ Checkout Repository
36-
uses: actions/checkout@v3
39+
uses: actions/checkout@v4
3740
with:
3841
fetch-depth: 0
3942

@@ -44,6 +47,8 @@ jobs:
4447
4548
- name: 🔧 Setup pnpm
4649
uses: pnpm/action-setup@v4
50+
with:
51+
version: 9.15.9
4752

4853
- name: 🔧 Setup NPM
4954
run: |
@@ -52,14 +57,25 @@ jobs:
5257
npm whoami
5358
5459
- name: 🔧 Setup Node.js ${{ matrix.node-version }}
55-
uses: actions/setup-node@v3
60+
uses: actions/setup-node@v4
5661
with:
5762
node-version: ${{ matrix.node-version }}
5863
cache: pnpm
5964

6065
- name: 🧩 Install Dependencies
6166
run: pnpm pnpm.install.workaround
6267

68+
- name: 🔄 Validate Package Directory
69+
run: |
70+
if [[ ! "${{ github.event.inputs.package_dir }}" =~ ^packages/[a-zA-Z0-9_-]+$ ]]; then
71+
echo "Invalid package directory: ${{ github.event.inputs.package_dir }}"
72+
exit 1
73+
fi
74+
if [[ ! -d "${{ github.event.inputs.package_dir }}" ]]; then
75+
echo "Package directory does not exist: ${{ github.event.inputs.package_dir }}"
76+
exit 1
77+
fi
78+
6379
- name: 🔄 Navigate to Package Directory
6480
run: |
6581
cd ${{ github.event.inputs.package_dir }}

‎.github/workflows/deploy-visual-reporter.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,28 +26,36 @@ jobs:
2626
steps:
2727
- name: ⬇️ Checkout Repository
2828
uses: actions/checkout@v4
29+
2930
- name: 📦 Setup pnpm
3031
uses: pnpm/action-setup@v4
32+
with:
33+
version: 9.15.9
34+
3135
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
3236
uses: actions/setup-node@v3
3337
with:
3438
node-version: ${{ matrix.node-version }}
3539
cache: pnpm
3640
- name: 🧩 Install Dependencies
3741
run: pnpm pnpm.install.workaround
42+
3843
- name: 🏗️ Build
3944
working-directory: packages/visual-reporter
4045
run: |
4146
pnpm build
4247
pnpm script:prepare.report
4348
env:
4449
GITHUB_PAGES: "/visual-testing/"
50+
4551
- name: ⚙️ Setup Pages
4652
uses: actions/configure-pages@v5
53+
4754
- name: 📤 Upload artifact
4855
uses: actions/upload-pages-artifact@v3
4956
with:
5057
path: "packages/visual-reporter/build/client"
58+
5159
- name: 🚀 Deploy to GitHub Pages
5260
id: deployment
5361
uses: actions/deploy-pages@v4

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,18 @@ jobs:
1313
release:
1414
name: Release
1515
runs-on: ubuntu-latest
16-
permissions: write-all
16+
permissions:
17+
contents: write
18+
packages: write
19+
id-token: write
1720

1821
strategy:
1922
matrix:
2023
node-version: [20.x]
2124

2225
steps:
2326
- name: ⬇️ Checkout Repository
24-
uses: actions/checkout@v3
27+
uses: actions/checkout@v4
2528

2629
- name: 🔧 Setup Git
2730
run: |
@@ -30,6 +33,8 @@ jobs:
3033
3134
- name: 🔧 Setup pnpm
3235
uses: pnpm/action-setup@v4
36+
with:
37+
version: 9.15.9
3338

3439
- name: 🔧 Setup NPM
3540
run: |
@@ -38,7 +43,7 @@ jobs:
3843
npm whoami
3944
4045
- name: 🔧 Setup Node.js ${{ matrix.node-version }}
41-
uses: actions/setup-node@v3
46+
uses: actions/setup-node@v4
4247
with:
4348
node-version: ${{ matrix.node-version }}
4449
cache: pnpm

‎.github/workflows/tests.yml‎

Lines changed: 35 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@ on:
55
branches:
66
- main
77
pull_request:
8-
pull_request_target:
8+
9+
permissions:
10+
contents: read
11+
pull-requests: read
12+
13+
env:
14+
PNPM_VERSION: 9.15.9+sha256.cf86a7ad764406395d4286a6d09d730711720acc6d93e9dce9ac7ac4dc4a28a7
915

1016
jobs:
1117
dependency-check:
@@ -40,18 +46,15 @@ jobs:
4046

4147
steps:
4248
- name: ⬇️ Checkout Repository
43-
uses: actions/checkout@v3
44-
45-
- name: ⬇️ Checkout PR Repository
46-
uses: actions/checkout@v3
47-
with:
48-
ref: ${{ github.event.pull_request.head.sha }}
49+
uses: actions/checkout@v4
4950

5051
- name: 📦 Setup pnpm
5152
uses: pnpm/action-setup@v4
53+
with:
54+
version: ${{ env.PNPM_VERSION }}
5255

5356
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
54-
uses: actions/setup-node@v3
57+
uses: actions/setup-node@v4
5558
with:
5659
node-version: ${{ matrix.node-version }}
5760
cache: pnpm
@@ -78,20 +81,15 @@ jobs:
7881

7982
steps:
8083
- name: ⬇️ Checkout Repository
81-
if: ${{ github.event_name != 'pull_request_target' }}
82-
uses: actions/checkout@v3
83-
84-
- name: ⬇️ Checkout PR Repository
85-
if: ${{ github.event_name == 'pull_request_target' }}
86-
uses: actions/checkout@v3
87-
with:
88-
ref: ${{ github.event.pull_request.head.sha }}
84+
uses: actions/checkout@v4
8985

9086
- name: 📦 Setup pnpm
9187
uses: pnpm/action-setup@v4
88+
with:
89+
version: ${{ env.PNPM_VERSION }}
9290

9391
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
94-
uses: actions/setup-node@v3
92+
uses: actions/setup-node@v4
9593
with:
9694
node-version: ${{ matrix.node-version }}
9795
cache: pnpm
@@ -141,20 +139,15 @@ jobs:
141139

142140
steps:
143141
- name: ⬇️ Checkout Repository
144-
if: ${{ github.event_name != 'pull_request_target' }}
145-
uses: actions/checkout@v3
146-
147-
- name: ⬇️ Checkout PR Repository
148-
if: ${{ github.event_name == 'pull_request_target' }}
149-
uses: actions/checkout@v3
150-
with:
151-
ref: ${{ github.event.pull_request.head.sha }}
142+
uses: actions/checkout@v4
152143

153144
- name: 📦 Setup pnpm
154145
uses: pnpm/action-setup@v4
146+
with:
147+
version: ${{ env.PNPM_VERSION }}
155148

156149
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
157-
uses: actions/setup-node@v3
150+
uses: actions/setup-node@v4
158151
with:
159152
node-version: ${{ matrix.node-version }}
160153
cache: pnpm
@@ -204,20 +197,15 @@ jobs:
204197

205198
steps:
206199
- name: ⬇️ Checkout Repository
207-
if: ${{ github.event_name != 'pull_request_target' }}
208-
uses: actions/checkout@v3
209-
210-
- name: ⬇️ Checkout PR Repository
211-
if: ${{ github.event_name == 'pull_request_target' }}
212-
uses: actions/checkout@v3
213-
with:
214-
ref: ${{ github.event.pull_request.head.sha }}
200+
uses: actions/checkout@v4
215201

216202
- name: 📦 Setup pnpm
217203
uses: pnpm/action-setup@v4
204+
with:
205+
version: ${{ env.PNPM_VERSION }}
218206

219207
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
220-
uses: actions/setup-node@v3
208+
uses: actions/setup-node@v4
221209
with:
222210
node-version: ${{ matrix.node-version }}
223211
cache: pnpm
@@ -267,20 +255,15 @@ jobs:
267255

268256
steps:
269257
- name: ⬇️ Checkout Repository
270-
if: ${{ github.event_name != 'pull_request_target' }}
271-
uses: actions/checkout@v3
272-
273-
- name: ⬇️ Checkout PR Repository
274-
if: ${{ github.event_name == 'pull_request_target' }}
275-
uses: actions/checkout@v3
276-
with:
277-
ref: ${{ github.event.pull_request.head.sha }}
258+
uses: actions/checkout@v4
278259

279260
- name: 📦 Setup pnpm
280261
uses: pnpm/action-setup@v4
262+
with:
263+
version: ${{ env.PNPM_VERSION }}
281264

282265
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
283-
uses: actions/setup-node@v3
266+
uses: actions/setup-node@v4
284267
with:
285268
node-version: ${{ matrix.node-version }}
286269
cache: pnpm
@@ -330,20 +313,15 @@ jobs:
330313

331314
steps:
332315
- name: ⬇️ Checkout Repository
333-
if: ${{ github.event_name != 'pull_request_target' }}
334-
uses: actions/checkout@v3
335-
336-
- name: ⬇️ Checkout PR Repository
337-
if: ${{ github.event_name == 'pull_request_target' }}
338-
uses: actions/checkout@v3
339-
with:
340-
ref: ${{ github.event.pull_request.head.sha }}
316+
uses: actions/checkout@v4
341317

342318
- name: 📦 Setup pnpm
343319
uses: pnpm/action-setup@v4
320+
with:
321+
version: ${{ env.PNPM_VERSION }}
344322

345323
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
346-
uses: actions/setup-node@v3
324+
uses: actions/setup-node@v4
347325
with:
348326
node-version: ${{ matrix.node-version }}
349327
cache: pnpm
@@ -393,20 +371,15 @@ jobs:
393371

394372
steps:
395373
- name: ⬇️ Checkout Repository
396-
if: ${{ github.event_name != 'pull_request_target' }}
397-
uses: actions/checkout@v3
398-
399-
- name: ⬇️ Checkout PR Repository
400-
if: ${{ github.event_name == 'pull_request_target' }}
401-
uses: actions/checkout@v3
402-
with:
403-
ref: ${{ github.event.pull_request.head.sha }}
374+
uses: actions/checkout@v4
404375

405376
- name: 📦 Setup pnpm
406377
uses: pnpm/action-setup@v4
378+
with:
379+
version: ${{ env.PNPM_VERSION }}
407380

408381
- name: 🟢 Setup Node.js ${{ matrix.node-version }}
409-
uses: actions/setup-node@v3
382+
uses: actions/setup-node@v4
410383
with:
411384
node-version: ${{ matrix.node-version }}
412385
cache: pnpm

‎.github/workflows/update.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33
# Ref: https://github.com/dependabot/fetch-metadata
44
name: Auto-merge
55

6-
# `pull_request_target` means this uses code in the base branch, not the PR.
7-
on: pull_request_target
6+
on: pull_request
87

98
# Dependabot PRs' tokens have read permissions by default and thus we must enable write permissions.
109
permissions:
@@ -20,7 +19,7 @@ jobs:
2019
# Fetch PR metadata
2120
- name: Fetch PR metadata
2221
id: metadata
23-
uses: dependabot/fetch-metadata@v1.6.0
22+
uses: dependabot/fetch-metadata@v2.0.0
2423
with:
2524
github-token: ${{ secrets.GITHUB_TOKEN }}
2625

0 commit comments

Comments
 (0)