Bump github/codeql-action from 3.25.8 to 3.25.10 #2193
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check | |
| on: | |
| pull_request: ~ | |
| push: | |
| branches: | |
| - main | |
| - v3 | |
| permissions: read-all | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Build | |
| run: npm run build | |
| - name: Upload build file for re-use | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| with: | |
| name: index-js | |
| path: index.js | |
| retention-days: 1 | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - build | |
| permissions: | |
| security-events: write # To upload CodeQL results | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| ghcr.io:443 | |
| github.com:443 | |
| objects.githubusercontent.com:443 | |
| pkg-containers.githubusercontent.com:443 | |
| uploads.github.com:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10 | |
| with: | |
| config-file: ./.github/codeql.yml | |
| languages: javascript | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10 | |
| formatting: | |
| name: Formatting | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Check formatting | |
| run: npm run format:check -- --log-level debug | |
| licenses: | |
| name: Licenses | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Check licenses | |
| run: npm run license-check | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install tooling | |
| uses: asdf-vm/actions/install@4f8f7939dd917fc656bb7c3575969a5988c28364 # v3.0.0 | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Lint CI | |
| if: ${{ failure() || success() }} | |
| run: npm run lint:ci -- -verbose | |
| - name: Lint JSON | |
| if: ${{ failure() || success() }} | |
| run: npm run lint:json -- --debug | |
| - name: Lint MarkDown | |
| if: ${{ failure() || success() }} | |
| run: | | |
| npm run lint:md:text | |
| npm run lint:md:code -- --debug | |
| - name: Lint TypeScript | |
| if: ${{ failure() || success() }} | |
| run: npm run lint:ts -- --debug | |
| - name: Lint YAML | |
| if: ${{ failure() || success() }} | |
| run: npm run lint:yml -- --debug | |
| reproducible: | |
| name: Reproducible build | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - build | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Simulate publish | |
| run: | | |
| # Dry run publish to trigger any hooks | |
| npm publish --dry-run --ignore-scripts=false | |
| # Pack to produce the archive that would be published | |
| npm pack | |
| - name: Compute checksum | |
| run: shasum -- *.tgz | tee checksums.txt | |
| - name: Reset to a clean state | |
| run: | | |
| npm run clean | |
| rm -- *.tgz | |
| - name: Simulate publish again | |
| run: | | |
| npm publish --dry-run --ignore-scripts=false | |
| npm pack | |
| - name: Verify checksum | |
| run: shasum --check checksums.txt --strict | |
| test: | |
| name: Test | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - build | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Run tests with coverage | |
| run: npm run coverage | |
| test-compat: | |
| name: Compatibility tests | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - test | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: | |
| - 18.0.0 | |
| - 20.0.0 | |
| - 22.0.0 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version: ${{ matrix.node-version }} | |
| - name: Install compatible npm version | |
| run: npm install --global npm@8.1.2 | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Download index.js | |
| uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7 | |
| with: | |
| name: index-js | |
| - name: Run compatibility tests | |
| run: npm run test:compat | |
| test-mutation: | |
| name: Mutation tests | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - test | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Cache Stryker incremental report | |
| uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1 | |
| with: | |
| path: .cache/stryker-incremental.json | |
| key: mutation-${{ github.run_number }} | |
| restore-keys: | | |
| mutation- | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Run mutation tests | |
| run: npm run test:mutation | |
| vet: | |
| name: Vet | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| artifactcache.actions.githubusercontent.com:443 | |
| github.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| - name: Install Node.js | |
| uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Vet imports | |
| if: ${{ failure() || success() }} | |
| run: npm run vet:imports | |
| - name: Vet package manifest | |
| if: ${{ failure() || success() }} | |
| run: npm run vet:package.json | |
| - name: Vet lockfile | |
| if: ${{ failure() || success() }} | |
| run: npm run vet:package-lock.json | |
| - name: Vet types | |
| if: ${{ failure() || success() }} | |
| run: npm run vet:types |