setup(ci): update + clean

Author: AugustinMauroy

.github/workflows/code-quality.yml

@@ -37,40 +37,18 @@ permissions:
   contents: read
 
 jobs:
-  get-matrix:
-    name: Get Node + OS matrix
-    runs-on: ubuntu-latest
+  lint-and-types:
+    name: Lint & types
+    runs-on: ubuntu-slim
 
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
 
-    outputs:
-      latest: ${{ steps.set-matrix.outputs.requireds }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
-      - uses: ljharb/actions/node/matrix@7f214d8efdbdcefc96ad9689663ef387a195deec # main
-        id: set-matrix
-        with:
-          versionsAsRoot: true
-          type: majors
-          preset: ">= 22" # glob is not backported below 22.x
-
-  lint-and-types:
-    name: Lint & types
-    runs-on: ubuntu-slim
-
-    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
-
-    steps:
-      # FIXME https://github.com/step-security/harden-runner/issues/627
-      # - name: Harden the runner (Audit all outbound calls)
-      #   uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-      #   with:
-      #     egress-policy: audit
-
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
@@ -91,7 +69,7 @@ jobs:
       matrix:
         os:
           - macos-latest
-          - ubuntu-latest
+          - ubuntu-slim
           - windows-latest
 
     steps:
@@ -106,7 +84,9 @@ jobs:
           persist-credentials: false
           show-progress: false
 
+      # ubuntu-slim already include lts node so we don't need to setup node on ubuntu-slim runner
       - name: Set up Node.js
+        if: ${{ matrix.os != 'ubuntu-slim' }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           cache: "npm"

.github/workflows/codemod_publish.yml

@@ -32,9 +32,16 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            app.codemod.com:443
+            github.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+            us.i.posthog.com:443
 
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/dir-organisation.yml

@@ -27,11 +27,10 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
 
     steps:
-      # FIXME https://github.com/step-security/harden-runner/issues/627
-      # - name: Harden the runner (Audit all outbound calls)
-      #   uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-      #   with:
-      #     egress-policy: audit
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/lint-workflows.yml

@@ -25,13 +25,12 @@ permissions:
   contents: read
 
 jobs:
-
   validate-yaml:
     name: Validate YAML files
 
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     steps:
       - name: Harden the runner (Audit all outbound calls)

.github/workflows/pr.yml

@@ -23,11 +23,10 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
 
     steps:
-      # FIXME https://github.com/step-security/harden-runner/issues/627
-      # - name: Harden Runner
-      #   uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-      #   with:
-      #     egress-policy: audit
+      - name: Harden Runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
 
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/workflow-tests.yml

@@ -25,19 +25,17 @@ permissions:
   contents: read
 
 jobs:
-
   run-workflow-script-tests:
     name: Test scripts
     runs-on: ubuntu-slim
 
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
 
     steps:
-      # FIXME https://github.com/step-security/harden-runner/issues/627
-      # - name: Harden the runner (Audit all outbound calls)
-      #   uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-      #   with:
-      #     egress-policy: audit
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.nvmrc

@@ -1 +1 @@
-24
+lts/*