Skip to content

Commit cd70a3f

Browse files
sserrataclaude
sserrata
and
claude
committed
ci: harden GitHub Actions workflows
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 33e84cd commit cd70a3f

File tree

9 files changed

+65
-57
lines changed

9 files changed

+65
-57
lines changed

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ updates:
44
directory: /
55
schedule:
66
interval: weekly
7+
cooldown:
8+
days: 3
79
groups:
810
react:
911
patterns:
@@ -14,3 +16,5 @@ updates:
1416
directory: /
1517
schedule:
1618
interval: weekly
19+
cooldown:
20+
days: 3

‎.github/workflows/build-perf.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ on:
77
paths-ignore:
88
- demo/docs/**
99

10+
permissions: {}
11+
1012
jobs:
1113
build-size:
1214
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
@@ -20,7 +22,7 @@ jobs:
2022
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
2123
with:
2224
persist-credentials: false
23-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
25+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2426
with:
2527
node-version: "22"
2628
cache: yarn
@@ -45,7 +47,7 @@ jobs:
4547
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
4648
with:
4749
persist-credentials: false
48-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
50+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4951
with:
5052
node-version: "22"
5153
cache: yarn

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
schedule:
77
- cron: "0 6 * * 1" # weekly Monday 6am UTC
88

9+
permissions: {}
10+
911
jobs:
1012
analyze:
1113
if: github.repository_owner == 'PaloAltoNetworks'

‎.github/workflows/deploy-live.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
push:
55
branches: [main]
66

7+
permissions: {}
8+
79
concurrency:
810
group: deploy-live
911
cancel-in-progress: false
@@ -23,7 +25,7 @@ jobs:
2325
persist-credentials: false
2426

2527
- name: Setup node
26-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
28+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2729
with:
2830
node-version: "22"
2931
cache: "yarn"
@@ -62,14 +64,14 @@ jobs:
6264
persist-credentials: false
6365

6466
- name: Setup node
65-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
67+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
6668
with:
6769
node-version: "22"
6870
cache: "yarn"
6971

7072
- name: Authenticate to Google Cloud
7173
id: auth
72-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
74+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
7375
with:
7476
workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
7577
service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
@@ -115,7 +117,7 @@ jobs:
115117
persist-credentials: false
116118

117119
- name: Setup node
118-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
120+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
119121
with:
120122
node-version: "22"
121123
cache: "yarn"

‎.github/workflows/deploy-preview.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ on:
44
pull_request_target:
55
branches: [main]
66

7+
permissions: {}
8+
9+
concurrency:
10+
group: deploy-preview-${{ github.event.number }}
11+
cancel-in-progress: true
12+
713
jobs:
814
precheck:
915
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
@@ -110,7 +116,7 @@ jobs:
110116
persist-credentials: false
111117

112118
- name: Setup node
113-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
119+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
114120
with:
115121
node-version: "22"
116122
cache: "yarn"
@@ -153,14 +159,14 @@ jobs:
153159
persist-credentials: false
154160

155161
- name: Setup node
156-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
162+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
157163
with:
158164
node-version: "22"
159165
cache: "yarn"
160166

161167
- name: Authenticate to Google Cloud
162168
id: auth
163-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
169+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
164170
with:
165171
workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
166172
service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}
@@ -208,7 +214,7 @@ jobs:
208214
persist-credentials: false
209215

210216
- name: Setup node
211-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
217+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
212218
with:
213219
node-version: "22"
214220
cache: "yarn"

‎.github/workflows/pr-title-check.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,20 @@ on:
1212
- reopened
1313
- edited
1414

15+
permissions: {}
16+
1517
jobs:
1618
check:
1719
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
1820
name: Check
1921
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
2024
steps:
2125
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
2226
with:
2327
fetch-depth: 0
28+
persist-credentials: false
2429
- name: Check
2530
run: npx ts-node --transpile-only scripts/check-pr-title.ts "$PR_TITLE"
2631
env:

‎.github/workflows/release-beta.yaml‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎.github/workflows/release.yaml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,24 @@ on:
1010
env:
1111
FORCE_COLOR: true
1212

13-
permissions:
14-
contents: write
15-
id-token: write
13+
permissions: {}
14+
15+
concurrency:
16+
group: release
17+
cancel-in-progress: false
1618

1719
jobs:
1820
release:
1921
name: Release
2022
runs-on: ubuntu-latest
2123
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
24+
permissions:
25+
contents: write
2226
steps:
2327
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
2428
with:
2529
fetch-depth: 0
30+
persist-credentials: false
2631
- run: |
2732
git config user.name "github-actions[bot]"
2833
git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -39,11 +44,14 @@ jobs:
3944
name: Publish Canary
4045
runs-on: ubuntu-latest
4146
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' && github.ref == 'refs/heads/main' }}
47+
permissions:
48+
contents: read
4249
steps:
4350
- name: Checkout
4451
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
4552
with:
4653
fetch-depth: 0
54+
persist-credentials: false
4755
- name: Check if packages changed
4856
id: packages_changed
4957
run: |
@@ -54,7 +62,7 @@ jobs:
5462
fi
5563
- name: Set up Node
5664
if: steps.packages_changed.outputs.changed == 'true'
57-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
65+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
5866
with:
5967
node-version: "22"
6068
registry-url: "https://registry.npmjs.org"

‎.github/workflows/validate.yaml‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
env:
1010
FORCE_COLOR: true
1111

12+
permissions: {}
13+
1214
jobs:
1315
prepare-yarn-cache:
1416
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
@@ -18,18 +20,20 @@ jobs:
1820
contents: read
1921
steps:
2022
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
21-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
23+
with:
24+
persist-credentials: false
25+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2226
with:
2327
node-version: "22"
24-
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v3
28+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
2529
with:
2630
path: |
2731
node_modules
2832
*/*/node_modules
2933
/home/runner/.cache/Cypress
3034
key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
3135
- name: Install
32-
run: yarn install --frozen-lockfile
36+
run: yarn install --frozen-lockfile --ignore-scripts
3337

3438
lint:
3539
if: ${{ github.repository == 'PaloAltoNetworks/docusaurus-openapi-docs' }}
@@ -40,17 +44,19 @@ jobs:
4044
contents: read
4145
steps:
4246
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
43-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
47+
with:
48+
persist-credentials: false
49+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4450
with:
4551
node-version: "22"
46-
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v3
52+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
4753
with:
4854
path: |
4955
node_modules
5056
*/*/node_modules
5157
key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
5258
- name: Install
53-
run: yarn install --frozen-lockfile
59+
run: yarn install --frozen-lockfile --ignore-scripts
5460
- name: Check format
5561
run: yarn format
5662
- name: Lint
@@ -65,17 +71,19 @@ jobs:
6571
contents: read
6672
steps:
6773
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
68-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
74+
with:
75+
persist-credentials: false
76+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
6977
with:
7078
node-version: "22"
71-
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v4
79+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
7280
with:
7381
path: |
7482
node_modules
7583
*/*/node_modules
7684
key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
7785
- name: Install
78-
run: yarn install --frozen-lockfile
86+
run: yarn install --frozen-lockfile --ignore-scripts
7987
- name: Test
8088
run: yarn test
8189

@@ -88,18 +96,20 @@ jobs:
8896
contents: read
8997
steps:
9098
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
91-
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
99+
with:
100+
persist-credentials: false
101+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
92102
with:
93103
node-version: "22"
94-
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v4
104+
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
95105
with:
96106
path: |
97107
node_modules
98108
*/*/node_modules
99109
/home/runner/.cache/Cypress
100110
key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
101111
- name: Install
102-
run: yarn install --frozen-lockfile
112+
run: yarn install --frozen-lockfile --ignore-scripts
103113
- name: Build
104114
run: yarn build
105115
- name: Cypress

0 commit comments

Comments
 (0)