ci: Pin yarn lockfile for security & dependency scanning

pulumi · Sep 21, 2022 · 110dd76 · 110dd76
1 parent 5dbba0e
commit 110dd76
Show file tree

Hide file tree

Showing 6 changed files with 3,091 additions and 4 deletions.
diff --git a/.github/workflows/ci-build-sdks.yml b/.github/workflows/ci-build-sdks.yml
@@ -92,7 +92,7 @@ jobs:
         with:
           node-version: ${{ fromJson(inputs.version-set).nodejs }}
           cache: yarn
-          cache-dependency-path: sdk/nodejs/*.json
+          cache-dependency-path: sdk/nodejs/yarn.lock
       - name: Install yarn
         run: |
           npm install -g yarn

diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
@@ -73,7 +73,7 @@ jobs:
         with:
           node-version: ${{ fromJson(inputs.version-set).nodejs }}
           cache: yarn
-          cache-dependency-path: sdk/nodejs/package.json
+          cache-dependency-path: sdk/nodejs/yarn.lock
       - name: Install Python deps
         run: |
           python -m pip install --upgrade pip requests wheel urllib3 chardet

diff --git a/.github/workflows/ci-run-test.yml b/.github/workflows/ci-run-test.yml
@@ -157,7 +157,14 @@ jobs:
         with:
           node-version: ${{ fromJson(inputs.version-set).nodejs }}
           cache: yarn
-          cache-dependency-path: sdk/nodejs/*.json
+          cache-dependency-path: sdk/nodejs/yarn.lock
+      - name: Uninstall pre-installed Pulumi (windows)
+        if: inputs.platform == 'windows-latest'
+        run: |
+          if command -v pulumi.exe; then
+            echo "Deleting pulumi"
+            rm -rf "$(command -v pulumi.exe)/../pulumi*"
+          fi
       - name: Install yarn
         run: |
           npm install -g yarn

diff --git a/sdk/nodejs/.gitignore b/sdk/nodejs/.gitignore
@@ -5,3 +5,4 @@
 /custom_node/
 /runtime/native/node_dev/
 .nyc_output/
+!yarn.lock
diff --git a/sdk/nodejs/Makefile b/sdk/nodejs/Makefile
@@ -24,7 +24,7 @@ GO_TEST_FAST = $(PYTHON) ../../scripts/go-test.py $(GO_TEST_FAST_FLAGS)
 
 ensure:: yarn.ensure node.ensure .ensure.phony
 .ensure.phony: package.json
-	yarn install
+	yarn install --frozen-lockfile
 	@touch .ensure.phony
 
 lint:: ensure