Skip to content

Commit 0b1a425

Browse files
decofedecofe
authored
Harden supply chain settings (#757)
1 parent 99a490c commit 0b1a425

10 files changed

Lines changed: 377 additions & 593 deletions

‎.github/workflows/ci.yml‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,10 @@ jobs:
2626
name: Lint
2727
runs-on: ubuntu-latest
2828
steps:
29-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
30-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
29+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
30+
with:
31+
persist-credentials: false
32+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
3133
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3234
with:
3335
node-version: "24"
@@ -39,8 +41,10 @@ jobs:
3941
name: Typecheck
4042
runs-on: ubuntu-latest
4143
steps:
42-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
43-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
44+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
45+
with:
46+
persist-credentials: false
47+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
4448
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4549
with:
4650
node-version: "24"
@@ -53,8 +57,10 @@ jobs:
5357
name: Test
5458
runs-on: ubuntu-latest
5559
steps:
56-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
57-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
60+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
61+
with:
62+
persist-credentials: false
63+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
5864
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
5965
with:
6066
node-version: "24"
@@ -67,8 +73,10 @@ jobs:
6773
name: MPP Discovery Service MCP Worker
6874
runs-on: ubuntu-latest
6975
steps:
70-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
71-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
76+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
77+
with:
78+
persist-credentials: false
79+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
7280
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
7381
with:
7482
node-version: "24"
@@ -80,8 +88,10 @@ jobs:
8088
name: Build
8189
runs-on: ubuntu-latest
8290
steps:
83-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
84-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
91+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
92+
with:
93+
persist-credentials: false
94+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
8595
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
8696
with:
8797
node-version: "24"
@@ -90,4 +100,4 @@ jobs:
90100
- run: pnpm check:generated
91101
- run: pnpm build
92102
env:
93-
MPP_SECRET_KEY: ${{ secrets.MPP_SECRET_KEY || 'ci-placeholder-key' }}
103+
MPP_SECRET_KEY: ci-placeholder-key-for-static-ci-builds

‎.github/workflows/links.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626

2727
steps:
2828
- name: Clone repository
29-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
29+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3030
with:
3131
persist-credentials: false
3232

‎.github/workflows/llms-token-count.yml‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,10 @@ jobs:
1919
permissions:
2020
issues: write
2121
steps:
22-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
23-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
22+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
23+
with:
24+
persist-credentials: false
25+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
2426
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2527
with:
2628
node-version: "22"
@@ -34,8 +36,10 @@ jobs:
3436
run: node scripts/count-tokens.ts
3537

3638
- name: Job summary
39+
env:
40+
TOKEN_COUNT: ${{ steps.count.outputs.token_count }}
3741
run: |
38-
COUNT=${{ steps.count.outputs.token_count }}
42+
COUNT=$TOKEN_COUNT
3943
THRESHOLD=$TOKEN_THRESHOLD
4044
STATUS=$( [ "$COUNT" -gt "$THRESHOLD" ] && echo "Over" || echo "Under" )
4145
echo "### llms-full.txt token count" >> "$GITHUB_STEP_SUMMARY"
@@ -49,10 +53,13 @@ jobs:
4953
- name: Create or update issue
5054
if: steps.count.outputs.over_threshold == 'true'
5155
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
56+
env:
57+
TOKEN_COUNT: ${{ steps.count.outputs.token_count }}
58+
TOKEN_THRESHOLD: ${{ env.TOKEN_THRESHOLD }}
5259
with:
5360
script: |
54-
const tokenCount = Number('${{ steps.count.outputs.token_count }}');
55-
const threshold = Number('${{ env.TOKEN_THRESHOLD }}');
61+
const tokenCount = Number(process.env.TOKEN_COUNT);
62+
const threshold = Number(process.env.TOKEN_THRESHOLD);
5663
const title = `llms-full.txt exceeds ${threshold.toLocaleString()} token threshold`;
5764
5865
const { data: issues } = await github.rest.issues.listForRepo({
@@ -91,10 +98,13 @@ jobs:
9198
- name: Close issue if back under threshold
9299
if: steps.count.outputs.over_threshold == 'false'
93100
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
101+
env:
102+
TOKEN_COUNT: ${{ steps.count.outputs.token_count }}
103+
TOKEN_THRESHOLD: ${{ env.TOKEN_THRESHOLD }}
94104
with:
95105
script: |
96-
const tokenCount = Number('${{ steps.count.outputs.token_count }}');
97-
const threshold = Number('${{ env.TOKEN_THRESHOLD }}');
106+
const tokenCount = Number(process.env.TOKEN_COUNT);
107+
const threshold = Number(process.env.TOKEN_THRESHOLD);
98108
99109
const { data: issues } = await github.rest.issues.listForRepo({
100110
owner: context.repo.owner,

‎.github/workflows/mcp-services-deploy.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@ jobs:
3232
CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
3333

3434
steps:
35-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
36-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
35+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
36+
with:
37+
persist-credentials: false
38+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
3739
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3840
with:
3941
node-version: "24"

‎.github/workflows/pr-label.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
contents: read
1414
pull-requests: write
1515
steps:
16-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
16+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717
with:
1818
persist-credentials: false
1919

‎.github/workflows/sdk-drift-check.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,12 @@ jobs:
2323
runs-on: ubuntu-latest
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
26+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
27+
with:
28+
persist-credentials: false
2729

2830
- name: Setup pnpm
29-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
31+
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
3032

3133
- name: Setup Node.js
3234
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

‎.github/workflows/sync-logos.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,12 @@ jobs:
1515
sync:
1616
name: Sync
1717
runs-on: ubuntu-latest
18+
environment: production
1819
steps:
19-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
20-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
20+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
21+
with:
22+
persist-credentials: false
23+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
2124
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2225
with:
2326
node-version: "24"
@@ -37,8 +40,10 @@ jobs:
3740
LOGODEV_PUBLIC_KEY: ${{ secrets.LOGODEV_PUBLIC_KEY }}
3841
- name: Post job summary
3942
if: always()
43+
env:
44+
SYNC_SUMMARY: ${{ steps.sync.outputs.summary }}
4045
run: |
41-
SUMMARY='${{ steps.sync.outputs.summary }}'
46+
SUMMARY=$SYNC_SUMMARY
4247
FAILED=$(echo "$SUMMARY" | jq -r '.failed // 0')
4348
SYNCED=$(echo "$SUMMARY" | jq -r '.synced // 0')
4449
TOTAL=$(echo "$SUMMARY" | jq -r '.total // 0')
@@ -53,8 +58,10 @@ jobs:
5358
echo "| ❌ Failed | $FAILED |" >> "$GITHUB_STEP_SUMMARY"
5459
- name: Fail if icons failed
5560
if: always()
61+
env:
62+
SYNC_SUMMARY: ${{ steps.sync.outputs.summary }}
5663
run: |
57-
SUMMARY='${{ steps.sync.outputs.summary }}'
64+
SUMMARY=$SYNC_SUMMARY
5865
FAILED=$(echo "$SUMMARY" | jq -r '.failed // 0')
5966
if [ "$FAILED" -gt 0 ]; then
6067
echo "::error::$FAILED icon(s) failed to sync"

‎package.json‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -71,17 +71,6 @@
7171
"engines": {
7272
"node": ">=24"
7373
},
74-
"pnpm": {
75-
"onlyBuiltDependencies": [
76-
"esbuild",
77-
"sharp",
78-
"workerd"
79-
],
80-
"ignoredBuiltDependencies": [
81-
"es5-ext",
82-
"simple-git-hooks"
83-
]
84-
},
8574
"simple-git-hooks": {
8675
"pre-commit": "pnpm check"
8776
}

0 commit comments

Comments
 (0)