Skip to content

797 OpenSSF Branch Improvements #812

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonobr1 merged 2 commits into from
Apr 10, 2026
+7 −3
Merged

797 OpenSSF Branch Improvements #812

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
afc08a9
Use npm ci and pin npm in workflows
jonobr1 Apr 10, 2026
7da9ece
Add CODEOWNERS to require @jonobr1 review
jonobr1 Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# CODEOWNERS — all files require review from the project maintainer.
# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners

* @jonobr1
2 changes: 1 addition & 1 deletion .github/workflows/copilot-setup-steps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
cache: "npm"

- name: Install dependencies
run: npm install
run: npm ci

Copilot AI Apr 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the lint workflow: npm ci will fail without a committed lockfile. If the Copilot setup workflow is expected to run on contributions where a lockfile might be missing, consider enforcing the lockfile policy (preferred) or using npm install for that specific workflow.

Suggested change
run: npm ci
run: |
if [ -f package-lock.json ]; then
npm ci
else
npm install
fi

Copilot uses AI. Check for mistakes.

- name: Build
run: npm run build
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,6 @@ jobs:
# checkout@v5
- uses: jonobr1/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
- name: Install modules
run: npm install
run: npm ci

Copilot AI Apr 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm ci requires a committed lockfile (package-lock.json / npm-shrinkwrap.json) and will fail without one. If this repo doesn't always include a lockfile or it can be absent in some branches, this change can break the lint workflow; ensure the lockfile is checked in and kept in sync with package.json.

Suggested change
run: npm ci
run: |
if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
npm ci
else
npm install
fi

Copilot uses AI. Check for mistakes.
- name: Run ESLint
run: npm run lint
2 changes: 1 addition & 1 deletion .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:

# Ensure npm 11.5.1 or later is installed

Copilot AI Apr 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says 'npm 11.5.1 or later', but the command pins npm to exactly 11.5.1. Either update the comment to match the pin, or change the install to a range/major (e.g., a caret range) if the intent is to allow patch/minor updates. Pinning improves reproducibility, while allowing 'or later' improves getting security/bugfix updates automatically.

Suggested change
# Ensure npm 11.5.1 or later is installed
# Ensure npm 11.5.1 is installed

Copilot uses AI. Check for mistakes.
- name: Update npm
run: npm install -g npm@latest
run: npm install -g npm@11.5.1
- run: npm ci
- run: npm run build --if-present
# - run: npm test
Expand Down
Loading