Skip to content

Commit 125d9d6

Browse files
skyrpexskyrpex
authored
chore: harden repository security (#155)
1 parent 5e1e3b3 commit 125d9d6

11 files changed

Lines changed: 7577 additions & 12544 deletions

File tree

‎.github/actions/set-version/action.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
name: 'Set Version from Branch'
2-
description: 'Sets VERSION environment variable from the current branch name'
2+
description: 'Sets VERSION output from the current branch name'
3+
4+
outputs:
5+
version:
6+
description: 'The version extracted from the branch name'
7+
value: ${{ steps.set-version.outputs.version }}
38

49
runs:
510
using: composite
611
steps:
712
- name: Set version from branch name
13+
id: set-version
814
shell: bash
915
run: |
1016
# GITHUB_HEAD_REF contains the source branch for PRs (e.g., "v1.2.5"), but is empty for pushes
@@ -30,5 +36,5 @@ runs:
3036
exit 1
3137
fi
3238
33-
echo "VERSION=$VERSION" >> $GITHUB_ENV
39+
echo "version=$VERSION" >> $GITHUB_OUTPUT
3440
echo "Using version: $VERSION (from branch: $BRANCH_NAME)"

‎.github/dependabot.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,20 @@ updates:
1010
- dependency-name: "*"
1111
update-types:
1212
- "version-update:semver-major"
13+
cooldown:
14+
default-days: 7
1315
groups:
1416
minor-patch:
1517
update-types:
1618
- "minor"
1719
- "patch"
20+
21+
- package-ecosystem: "github-actions"
22+
directory: "/"
23+
schedule:
24+
interval: "weekly"
25+
day: "monday"
26+
cooldown:
27+
default-days: 7
28+
commit-message:
29+
prefix: "chore(ci)"

‎.github/workflows/build.yml‎

Lines changed: 41 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,78 +14,98 @@ jobs:
1414

1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v5
17+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
18+
with:
19+
persist-credentials: false
20+
21+
- name: Setup pnpm
22+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
1823

1924
- name: Setup Node
20-
uses: actions/setup-node@v4
25+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2126
with:
22-
cache: npm
27+
cache: pnpm
2328

2429
- name: Install dependencies
25-
run: npm ci
30+
run: pnpm install --frozen-lockfile
2631

2732
- name: Format
28-
run: npx biome ci .
33+
run: pnpm biome ci .
2934

3035
lint:
3136
name: Lint
3237
runs-on: ubuntu-latest
3338

3439
steps:
3540
- name: Checkout
36-
uses: actions/checkout@v5
41+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
42+
with:
43+
persist-credentials: false
44+
45+
- name: Setup pnpm
46+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
3747

3848
- name: Setup Node
39-
uses: actions/setup-node@v4
49+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
4050
with:
41-
cache: npm
51+
cache: pnpm
4252

4353
- name: Install dependencies
44-
run: npm ci
54+
run: pnpm install --frozen-lockfile
4555

4656
- name: Lint
47-
run: npx eslint
57+
run: pnpm eslint
4858

4959
type-check:
5060
name: Type Check
5161
runs-on: ubuntu-latest
5262

5363
steps:
5464
- name: Checkout
55-
uses: actions/checkout@v5
65+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
66+
with:
67+
persist-credentials: false
68+
69+
- name: Setup pnpm
70+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
5671

5772
- name: Setup Node
58-
uses: actions/setup-node@v4
73+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
5974
with:
60-
cache: npm
75+
cache: pnpm
6176

6277
- name: Install dependencies
63-
run: npm ci
78+
run: pnpm install --frozen-lockfile
6479

6580
- name: Type check
66-
run: npx tsc
81+
run: pnpm tsc
6782

6883
test:
6984
name: Test
7085
runs-on: ubuntu-latest
7186

7287
steps:
7388
- name: Checkout
74-
uses: actions/checkout@v5
89+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
90+
with:
91+
persist-credentials: false
92+
93+
- name: Setup pnpm
94+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
7595

7696
- name: Setup Node
77-
uses: actions/setup-node@v4
97+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
7898
with:
79-
cache: npm
99+
cache: pnpm
80100

81101
- name: Install dependencies
82-
run: npm ci
102+
run: pnpm install --frozen-lockfile
83103

84104
- name: Compile
85-
run: npx vsce package
105+
run: pnpm vsce package
86106
env:
87107
LOCALSTACK_WEB_AUTH_REDIRECT: https://app.localstack.cloud/redirect
88108
NODE_ENV: ci
89109

90110
- name: Test
91-
run: xvfb-run -a npx vscode-test
111+
run: xvfb-run -a pnpm vscode-test

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Auto merge Dependabot pull requests
22

33
on:
4-
pull_request_target:
4+
pull_request:
55
types:
66
- labeled
77
- opened
@@ -17,11 +17,8 @@ jobs:
1717
auto-merge:
1818
name: Auto merge Dependabot pull requests
1919
runs-on: ubuntu-latest
20-
if: github.actor == 'dependabot[bot]'
20+
if: github.event.pull_request.user.login == 'dependabot[bot]'
2121
steps:
22-
- name: Checkout
23-
uses: actions/checkout@v5
24-
2522
- name: Approve
2623
run: gh pr review "$PR_NUMBER" --approve
2724
env:

‎.github/workflows/pull-request-lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
permissions:
1111
pull-requests: read
1212
steps:
13-
- uses: amannn/action-semantic-pull-request@v6
13+
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
1414
env:
1515
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1616
with:

‎.github/workflows/release.yml‎

Lines changed: 49 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@ on:
55
branches:
66
- main
77

8-
permissions:
9-
contents: write
10-
issues: write
11-
pull-requests: write
8+
permissions: {}
129

1310
concurrency:
1411
group: release
@@ -18,37 +15,48 @@ jobs:
1815
test:
1916
name: Test
2017
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
2120
steps:
2221
- name: Checkout
23-
uses: actions/checkout@v5
22+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
23+
with:
24+
persist-credentials: false
25+
26+
- name: Setup pnpm
27+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
2428

2529
- name: Setup Node
26-
uses: actions/setup-node@v4
30+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2731
with:
28-
cache: npm
32+
cache: pnpm
2933

3034
- name: Install dependencies
31-
run: npm ci
35+
run: pnpm install --frozen-lockfile
3236

3337
- name: Compile
34-
run: npx vsce package
38+
run: pnpm vsce package
3539
env:
3640
LOCALSTACK_WEB_AUTH_REDIRECT: https://app.localstack.cloud/redirect
3741
NODE_ENV: ci
3842

3943
- name: Test
40-
run: xvfb-run -a npx vscode-test
44+
run: xvfb-run -a pnpm vscode-test
4145

4246
release:
4347
name: Release
4448
runs-on: ubuntu-latest
4549
needs: test
50+
permissions:
51+
contents: write
52+
issues: write
53+
pull-requests: write
4654
outputs:
4755
release_created: ${{ steps.release.outputs.release_created }}
4856
tag_name: ${{ steps.release.outputs.tag_name }}
4957
version: ${{ steps.release.outputs.version }}
5058
steps:
51-
- uses: googleapis/release-please-action@v4
59+
- uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
5260
id: release
5361
with:
5462
release-type: node
@@ -58,27 +66,34 @@ jobs:
5866
runs-on: ubuntu-latest
5967
needs: release
6068
if: ${{ needs.release.outputs.release_created == 'true' }}
69+
permissions:
70+
contents: read
6171
steps:
6272
- name: Checkout
63-
uses: actions/checkout@v5
73+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
74+
with:
75+
persist-credentials: false
76+
77+
- name: Setup pnpm
78+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
6479

6580
- name: Setup Node
66-
uses: actions/setup-node@v4
81+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
6782
with:
68-
cache: npm
83+
cache: pnpm
6984

7085
- name: Install dependencies
71-
run: npm ci
86+
run: pnpm install --frozen-lockfile
7287

7388
- name: Build VSIX
74-
run: npx vsce package
89+
run: pnpm vsce package
7590
env:
7691
LOCALSTACK_WEB_AUTH_REDIRECT: https://app.localstack.cloud/redirect
7792
NODE_ENV: production
7893
ANALYTICS_API_URL: https://analytics.localstack.cloud/v1/events
7994

8095
- name: Upload VSIX artifact
81-
uses: actions/upload-artifact@v4
96+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8297
with:
8398
name: vsix
8499
path: "*.vsix"
@@ -88,39 +103,45 @@ jobs:
88103
runs-on: ubuntu-latest
89104
needs: [build, release]
90105
if: ${{ needs.release.outputs.release_created == 'true' }}
106+
permissions:
107+
contents: write
91108
steps:
92109
- name: Checkout
93-
uses: actions/checkout@v5
110+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
111+
with:
112+
persist-credentials: false
94113

95114
- name: Download VSIX
96-
uses: actions/download-artifact@v4
115+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
97116
with:
98117
name: vsix
99118

100119
- name: Setup Node
101-
uses: actions/setup-node@v4
120+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
102121

103122
- name: Upload Release Artifact
104123
env:
105124
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
106-
run: gh release upload ${{ needs.release.outputs.tag_name }} *.vsix
125+
NEEDS_RELEASE_OUTPUTS_TAG_NAME: ${{ needs.release.outputs.tag_name }}
126+
run: gh release upload ${NEEDS_RELEASE_OUTPUTS_TAG_NAME} *.vsix
107127

108128
publish-vscode-marketplace:
109129
name: Publish to VS Marketplace
110130
runs-on: ubuntu-latest
111131
needs: [build, release]
112132
if: ${{ needs.release.outputs.release_created == 'true' }}
133+
permissions: {}
113134
steps:
114135
- name: Download VSIX
115-
uses: actions/download-artifact@v4
136+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
116137
with:
117138
name: vsix
118139

119140
- name: Setup Node
120-
uses: actions/setup-node@v4
141+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
121142

122143
- name: Publish to VS Marketplace
123-
run: npx @vscode/vsce publish --packagePath *.vsix
144+
run: pnpm dlx @vscode/vsce publish --packagePath *.vsix
124145
env:
125146
VSCE_PAT: ${{ secrets.VSCE_PAT }}
126147

@@ -129,16 +150,17 @@ jobs:
129150
runs-on: ubuntu-latest
130151
needs: [build, release]
131152
if: ${{ needs.release.outputs.release_created == 'true' }}
153+
permissions: {}
132154
steps:
133155
- name: Download VSIX
134-
uses: actions/download-artifact@v4
156+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
135157
with:
136158
name: vsix
137159

138160
- name: Setup Node
139-
uses: actions/setup-node@v4
161+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
140162

141163
- name: Publish to Open VSX
142-
run: npx ovsx publish *.vsix -p $OVSX_PAT
164+
run: pnpm dlx ovsx publish *.vsix -p $OVSX_PAT
143165
env:
144166
OVSX_PAT: ${{ secrets.OVSX_PAT }}

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
## Installation
44

55
```sh
6-
npm install
6+
pnpm install
77
```
88

99
## Configuration
@@ -26,7 +26,7 @@ To update the extension after making code changes, you need to regenerate the VS
2626
Run the following command in your project directory:
2727

2828
```sh
29-
npx vsce package
29+
pnpm vsce package
3030
```
3131

3232
This will build a new `.vsix` file in the directory (localstack-x.x.1.vsix).

0 commit comments

Comments
 (0)