fix(EC-24260): Update CI workflows (#27)

* Update GitHub Actions workflows

* fix: address Copilot security findings

- Add permissions block to build.yml (contents: read)
- Pin creyD/prettier_action to commit hash for supply chain safety

* fix: add write permissions to prettier workflow

* Prettified Code!

---------

Co-authored-by: yasinghasmi <yasinghasmi@users.noreply.github.com>

Author: yasinghasmi

.github/workflows/build-dist.yml

@@ -2,27 +2,20 @@ name: Build dist
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Build
-        run: npm run build
-
+          node-version: '24.x'
+      - run: npm install
+      - run: npm run build
       - name: Push dist to main-dist branch
         run: |
           git config user.name "github-actions[bot]"

.github/workflows/build.yml

@@ -0,0 +1,22 @@
+name: Build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24.x'
+      - run: npm install
+      - run: npm run build
+      - run: npm test

.github/workflows/jest-tests.yml

@@ -2,21 +2,24 @@ name: Prettier
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: write
 
 jobs:
   prettier:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         ref: ${{ github.head_ref }}
 
     - name: Prettify code
-      uses: creyD/prettier_action@v3.3
+      uses: creyD/prettier_action@31355f8eef017f8aeba2e0bc09d8502b13dbbad1 # v4.3
       with:
         prettier_options: --write **/*.{js,md}
       env:

.github/workflows/prettier.yml

@@ -3,23 +3,25 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   publish:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: '12.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
       - run: npm install
       - run: npm run build
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   updateDocs:
-    runs-on: ubuntu-20.04
-    if: success()
+    runs-on: ubuntu-24.04
+    needs: publish
     steps:
       - name: Call update docs
         env:
@@ -28,4 +30,3 @@ jobs:
           WORKFLOW_ID: 90722302
         run: |
           curl -fL --retry 3 -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token ${{ secrets.TOKEN }}" https://api.github.com/repos/${{ env.REPO }}/actions/workflows/${{ env.WORKFLOW_ID }}/dispatches -d '{"ref":"main", "inputs": {}}'
-

.github/workflows/publish-to-npm.yml .github/workflows/publish.yml.github/workflows/publish-to-npm.yml renamed to .github/workflows/publish.yml

@@ -4,15 +4,15 @@ on:
 
 jobs:
   update-docs:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
           path: 'authentication'
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '24.x'
       - name: Clone docs
         run: |
           cd $GITHUB_WORKSPACE/

.github/workflows/update-docs.yml

@@ -63,8 +63,7 @@ const authenticationContext = new AuthenticationContext({
       method: "POST",
       body: JSON.stringify({ token }),
     }).then(() => {}),
-  refreshAccessToken: () =>
-    fetch("/auth/refresh").then((r) => r.json()),
+  refreshAccessToken: () => fetch("/auth/refresh").then((r) => r.json()),
   revokeRefreshToken: () =>
     fetch("/auth/revoke", { method: "POST" }).then(() => {}),
 });