From 293f5457c21020dcaa4a7b72f3459661c3915bb2 Mon Sep 17 00:00:00 2001 From: Robin Malfait Date: Thu, 14 May 2026 12:12:13 +0200 Subject: [PATCH 1/3] use a frozen lockfile during `pnpm install` --- .github/workflows/ci.yml | 2 +- .github/workflows/prepare-release.yml | 6 +++--- .github/workflows/release.yml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 79007ded29f5..2d61b91e9385 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -88,7 +88,7 @@ jobs: run: rustup target add wasm32-wasip1-threads - name: Install dependencies - run: pnpm install + run: pnpm install --frozen-lockfile - name: Build run: pnpm run build diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 474b5995628c..28fa5a79daca 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -146,7 +146,7 @@ jobs: run: rustup target add ${{ matrix.target }} - name: Install dependencies - run: pnpm install --ignore-scripts --filter=!./playgrounds/* + run: pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/* - name: Build release run: pnpm run --filter ${{ env.OXIDE_LOCATION }} build:platform --target=${{ matrix.target }} ${{ matrix.build-flags }} @@ -204,7 +204,7 @@ jobs: chmod +x rustup-init ./rustup-init -y --profile minimal source "$HOME/.cargo/env" - pnpm install --ignore-scripts --filter=!./playgrounds/* || true + pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/* || true echo "~~~~ rustc --version ~~~~" rustc --version echo "~~~~ node -v ~~~~" @@ -289,7 +289,7 @@ jobs: run: rustup target add wasm32-wasip1-threads - name: Install dependencies - run: pnpm --filter=!./playgrounds/* install + run: pnpm --filter=!./playgrounds/* install --frozen-lockfile - name: Download artifacts uses: actions/download-artifact@v7 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 71c934220655..a0c0ca07ffd3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -150,7 +150,7 @@ jobs: run: rustup target add ${{ matrix.target }} - name: Install dependencies - run: pnpm install --ignore-scripts --filter=!./playgrounds/* + run: pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/* - name: Build release run: pnpm run --filter ${{ env.OXIDE_LOCATION }} build:platform --target=${{ matrix.target }} ${{ matrix.build-flags }} @@ -214,7 +214,7 @@ jobs: node -v echo "~~~~ pnpm --version ~~~~" pnpm --version - pnpm install --ignore-scripts --filter=!./playgrounds/* || true + pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/* || true pnpm run --filter ${{ env.OXIDE_LOCATION }} build:platform strip -x ${{ env.OXIDE_LOCATION }}/*.node ls -la ${{ env.OXIDE_LOCATION }} @@ -307,7 +307,7 @@ jobs: run: rustup target add wasm32-wasip1-threads - name: Install dependencies - run: pnpm --filter=!./playgrounds/* install + run: pnpm --filter=!./playgrounds/* install --frozen-lockfile - name: Download artifacts uses: actions/download-artifact@v7 From c2fe87ca039685ad52fc26f3d11ae09085fa7be0 Mon Sep 17 00:00:00 2001 From: Robin Malfait Date: Thu, 14 May 2026 12:14:03 +0200 Subject: [PATCH 2/3] cleanup permissions - No need to be able to mint an ID-token during the prepare release worfklow - No need for write permissions during the relase, we're not _creating_ a GitHub release in this case --- .github/workflows/prepare-release.yml | 2 -- .github/workflows/release.yml | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 28fa5a79daca..5611e2e810ec 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -227,8 +227,6 @@ jobs: permissions: contents: write # for softprops/action-gh-release to create GitHub release - # https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions - id-token: write needs: - build diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a0c0ca07ffd3..2bf3bf7e4a6b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -230,7 +230,7 @@ jobs: name: Build and publish Tailwind CSS permissions: - contents: write # for softprops/action-gh-release to create GitHub release + contents: read # https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions id-token: write From 3fa9a005122235525ec746997d8db353d3a9cfe3 Mon Sep 17 00:00:00 2001 From: Robin Malfait Date: Thu, 14 May 2026 12:23:06 +0200 Subject: [PATCH 3/3] do not cache `~/.cargo/bin/` --- .github/workflows/ci.yml | 1 - .github/workflows/integration-tests.yml | 1 - .github/workflows/prepare-release.yml | 2 -- .github/workflows/release.yml | 2 -- 4 files changed, 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2d61b91e9385..b55173e3c7d9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 3336cfced474..99e77c1d72e2 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -73,7 +73,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 5611e2e810ec..0c675d6e96f1 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -104,7 +104,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ @@ -260,7 +259,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2bf3bf7e4a6b..772d1af46ab6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -108,7 +108,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ @@ -280,7 +279,6 @@ jobs: uses: actions/cache@v5 with: path: | - ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/