Skip to content

Commit 727f78b

Browse files
codeismyidcodeismyid
authored
ci: update ci.yaml, codeql.yaml, and release.yaml (#31)
1 parent 0748dd5 commit 727f78b

3 files changed

Lines changed: 54 additions & 52 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 41 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@ name: CI
33
on:
44
push:
55
branches:
6-
- "*"
6+
- main
77
pull_request:
88
branches:
9-
- "*"
9+
- "**"
1010

1111
concurrency:
12-
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
12+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
1313
cancel-in-progress: true
1414

1515
permissions:
@@ -21,47 +21,47 @@ jobs:
2121
runs-on: ubuntu-24.04
2222
steps:
2323
- name: Harden runner
24-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
2525
with:
2626
disable-sudo: true
2727
egress-policy: block
2828
allowed-endpoints: >
29+
api.github.com:443
2930
bun.sh:443
3031
github.com:443
3132
objects.githubusercontent.com:443
3233
registry.npmjs.org:443
34+
release-assets.githubusercontent.com:443
3335
3436
- name: Git checkout
3537
if: github.event_name == 'push'
36-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3739
with:
3840
fetch-depth: 1
39-
sparse-checkout: .
4041
persist-credentials: false
4142

4243
- name: Git checkout (full-history)
4344
if: github.event_name == 'pull_request'
44-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4546
with:
4647
fetch-depth: 0
47-
sparse-checkout: .
4848
ref: ${{ github.head_ref }}
4949
repository: ${{ github.event.pull_request.head.repo.full_name }}
5050
persist-credentials: false
5151

5252
- name: Set up bun@latest
53-
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
53+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
5454

5555
- name: Install dependencies
5656
run: bun ci
5757

5858
- name: Run check (push)
5959
if: github.event_name == 'push'
60-
run: bunx commitlint --last --verbose
60+
run: bunx --bun commitlint --last --verbose
6161

6262
- name: Run check (pull_request)
6363
if: github.event_name == 'pull_request'
64-
run: bunx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
64+
run: bunx --bun commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
6565

6666
dependency:
6767
name: Dependency check
@@ -70,7 +70,7 @@ jobs:
7070
pull-requests: write
7171
steps:
7272
- name: Harden runner
73-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
73+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
7474
with:
7575
disable-sudo: true
7676
egress-policy: block
@@ -80,55 +80,46 @@ jobs:
8080
github.com:443
8181
8282
- name: Git checkout
83-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8484
with:
85-
fetch-depth: ${{ github.event_name == 'pull_request' && 1 || 2 }}
86-
repository: ${{ github.event.pull_request.head.repo.full_name }}
85+
fetch-depth: 1
8786
persist-credentials: false
8887

89-
- name: Run check (push)
90-
if: github.event_name == 'push'
91-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 #v4.5.0
92-
with:
93-
allow-licenses: MIT, ISC, CC0-1.0, Apache-2.0, BSD-3-Clause, Unlicense
94-
head-ref: ${{ github.sha }}
95-
base-ref: ${{ github.event.before }}
96-
fail-on-severity: low
97-
comment-summary-in-pr: never
98-
warn-on-openssf-scorecard-level: 3
99-
100-
- name: Run check (pull_request)
101-
if: github.event_name == 'pull_request'
102-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 #v4.5.0
88+
- name: Run dependency review
89+
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
10390
with:
10491
allow-licenses: MIT, ISC, CC0-1.0, Apache-2.0, BSD-3-Clause, Unlicense
105-
fail-on-severity: low
106-
comment-summary-in-pr: on-failure
92+
head-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
93+
base-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.repository.default_branch }}
94+
fail-on-severity: moderate
95+
comment-summary-in-pr: ${{ github.event_name == 'pull_request' && 'on-failure' || 'never' }}
10796
warn-on-openssf-scorecard-level: 3
10897

10998
format:
11099
name: Format check
111100
runs-on: ubuntu-24.04
112101
steps:
113102
- name: Harden runner
114-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
103+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
115104
with:
116105
disable-sudo: true
117106
egress-policy: block
118107
allowed-endpoints: >
108+
api.github.com:443
119109
bun.sh:443
120110
github.com:443
121111
objects.githubusercontent.com:443
122112
raw.githubusercontent.com:443
123113
registry.npmjs.org:443
114+
release-assets.githubusercontent.com:443
124115
125116
- name: Git checkout
126-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
127118
with:
128119
persist-credentials: false
129120

130121
- name: Set up bun@latest
131-
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
122+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
132123

133124
- name: Install dependencies
134125
run: bun ci
@@ -141,11 +132,12 @@ jobs:
141132
runs-on: ubuntu-24.04
142133
steps:
143134
- name: Harden runner
144-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
135+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
145136
with:
146137
disable-sudo: true
147138
egress-policy: block
148139
allowed-endpoints: >
140+
api.github.com:443
149141
bun.sh:443
150142
cli.codecov.io:443
151143
github.com:443
@@ -154,37 +146,42 @@ jobs:
154146
objects.githubusercontent.com:443
155147
registry.npmjs.org:443
156148
storage.googleapis.com:443
149+
release-assets.githubusercontent.com:443
157150
158151
- name: Git checkout
159-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
152+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
160153
with:
161154
persist-credentials: false
162155

163156
- name: Set up bun@latest
164-
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
157+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
165158

166159
- name: Install dependencies
167160
run: bun ci
168161

169162
- name: Run check
163+
env:
164+
FORCE_COLOR: 3
170165
run: bun test --coverage --coverage-reporter=lcov --coverage-reporter=text --reporter=junit --reporter-outfile=junit.xml
171166

172167
- name: Upload lcov
173-
uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
168+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
174169
with:
175170
fail_ci_if_error: true
171+
verbose: true
176172

177173
- name: Upload test result
178-
uses: codecov/test-results-action@f2dba722c67b86c6caa034178c6e4d35335f6706 # v1.1.0
174+
uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
179175
with:
180176
fail_ci_if_error: true
177+
verbose: true
181178

182179
type:
183180
name: Type check
184181
runs-on: ubuntu-24.04
185182
steps:
186183
- name: Harden runner
187-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
184+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
188185
with:
189186
disable-sudo: true
190187
egress-policy: block
@@ -195,18 +192,19 @@ jobs:
195192
objects.githubusercontent.com:443
196193
raw.githubusercontent.com:443
197194
registry.npmjs.org:443
195+
release-assets.githubusercontent.com:443
198196
199197
- name: Git checkout
200-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
198+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
201199
with:
202200
persist-credentials: false
203201

204202
- name: Set up bun@latest
205-
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
203+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
206204

207205
- name: Install dependencies
208206
run: bun ci
209-
207+
210208
- name: Run check
211209
run: |
212210
tsc_output=$(bunx tsc; bunx type-coverage)

‎.github/workflows/codeql.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
build-mode: none
3434
steps:
3535
- name: Harden runner
36-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
36+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
3737
with:
3838
disable-sudo: true
3939
egress-policy: block
@@ -42,19 +42,20 @@ jobs:
4242
github.com:443
4343
objects.githubusercontent.com
4444
uploads.github.com:443
45+
release-assets.githubusercontent.com:443
4546
4647
- name: Git checkout
47-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4849
with:
4950
persist-credentials: false
5051

5152
- name: Initialize CodeQL
52-
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
53+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
5354
with:
5455
languages: ${{ matrix.language }}
5556
build-mode: ${{ matrix.build-mode }}
5657

5758
- name: Perform CodeQL Analysis
58-
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
59+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
5960
with:
6061
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yaml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ permissions:
1414

1515
jobs:
1616
publish:
17-
name: Publish release
17+
name: Publish release (if needed)
1818
if: github.repository_owner == 'codeismyid'
1919
runs-on: ubuntu-24.04
2020
permissions:
@@ -24,7 +24,7 @@ jobs:
2424
id-token: write
2525
steps:
2626
- name: Harden runner
27-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
27+
uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
2828
with:
2929
disable-sudo: true
3030
egress-policy: block
@@ -38,20 +38,23 @@ jobs:
3838
rekor.sigstore.dev:443
3939
tuf-repo-cdn.sigstore.dev:443
4040
uploads.github.com:443
41+
release-assets.githubusercontent.com:443
4142
4243
- name: Git checkout (full-history)
43-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
44+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4445
with:
4546
fetch-depth: 0
4647
persist-credentials: true
4748

4849
- name: Set up bun@latest
49-
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
50+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
5051

5152
- name: Install dependencies
5253
run: bun ci
5354

5455
- name: Run check
56+
env:
57+
FORCE_COLOR: 3
5558
run: bun check
5659

5760
- name: Audit signatures
@@ -60,7 +63,7 @@ jobs:
6063
- name: Build dist
6164
run: bun dist
6265

63-
- name: Publish
66+
- name: Run release
6467
env:
6568
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6669
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

0 commit comments

Comments
 (0)