diff --git a/.github/workflows/auto-review.yml b/.github/workflows/auto-review.yml index 0daa0ed8..f4e1dd88 100644 --- a/.github/workflows/auto-review.yml +++ b/.github/workflows/auto-review.yml @@ -20,7 +20,7 @@ jobs: if: github.event.pull_request.state == 'open' && github.event.pull_request.draft == false runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: # pull_request_target runs on base; checkout base securely, not fork code. # We fetch diff via gh API, never execute fork files. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68e7106f..9242be7c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,18 +26,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json - name: Cache downloaded packages - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.bun/install/cache key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }} @@ -63,11 +63,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} @@ -79,13 +79,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} @@ -108,18 +108,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json - name: Cache downloaded packages - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.bun/install/cache key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }} @@ -135,7 +135,7 @@ jobs: - name: Upload coverage report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: coverage path: coverage @@ -146,25 +146,25 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json - name: Cache downloaded packages - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.bun/install/cache key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }} restore-keys: bun-${{ runner.os }}- - name: Cache Next.js build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: .next/cache key: next-build-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }} @@ -186,18 +186,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json - name: Cache downloaded packages - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.bun/install/cache key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }} @@ -225,7 +225,7 @@ jobs: - name: Upload Playwright report if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: playwright-report path: playwright-report diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 8473d955..f1d515f6 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 with: diff --git a/.github/workflows/e2e-chain.yml b/.github/workflows/e2e-chain.yml index 7058af1d..207d8a0a 100644 --- a/.github/workflows/e2e-chain.yml +++ b/.github/workflows/e2e-chain.yml @@ -29,18 +29,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Start stellar/quickstart (local network, Soroban RPC + Horizon) run: | docker run -d --rm -p 8000:8000 --name stellar stellar/quickstart:latest \ --local --enable core,rpc,horizon --limits unlimited - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: package.json @@ -51,18 +51,18 @@ jobs: run: bunx playwright install --with-deps chromium - name: Install Rust (wasm32v1-none) - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: targets: wasm32v1-none - name: Check out Heliobond/contracts - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: Heliobond/contracts ref: ${{ env.CONTRACTS_REF }} path: ${{ env.CONTRACTS_DIR }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 with: workspaces: ${{ env.CONTRACTS_DIR }} @@ -83,7 +83,7 @@ jobs: - name: Upload Playwright traces and report if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: e2e-chain-playwright path: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ff2b99c9..adebf1f2 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -25,7 +25,7 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false diff --git a/.github/workflows/socket.yml b/.github/workflows/socket.yml new file mode 100644 index 00000000..fd553d9f --- /dev/null +++ b/.github/workflows/socket.yml @@ -0,0 +1,42 @@ +name: Package risk scan + +# Socket scores the packages a PR adds or changes for install scripts, +# obfuscated code, network access and new maintainers (#922). The scan needs the +# SOCKET_CLI_API_TOKEN repository secret. GitHub does not pass secrets to pull +# requests from forks, so the scan is skipped there. The skip is reported as a +# notice, not a pass. The scan's pass/fail thresholds are set in the Socket +# dashboard security policy, not in this file. +# +# This runs the `pull_request` event, not `pull_request_target`, so PR code +# never sees the secret. + +on: + pull_request: + +permissions: + contents: read + +jobs: + socket: + name: socket package risk + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false + + - name: Scan dependencies with Socket + env: + SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_CLI_API_TOKEN }} + SOCKET_ORG: ${{ vars.SOCKET_ORG }} + run: | + if [ -z "$SOCKET_CLI_API_TOKEN" ]; then + echo "::notice title=Socket scan skipped::SOCKET_CLI_API_TOKEN is not available to this run (fork PR or secret not set), so no package-risk scan ran." + exit 0 + fi + ORG_ARGS=() + if [ -n "$SOCKET_ORG" ]; then + ORG_ARGS=(--org "$SOCKET_ORG") + fi + npx --yes @socketsecurity/cli@1.10.0 ci "${ORG_ARGS[@]}" diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 0192993c..a841f4e1 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -32,7 +32,7 @@ jobs: PR_LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }} PR_ACTION: ${{ github.event.action }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ env.HEAD_SHA }} fetch-depth: 0 @@ -41,7 +41,7 @@ jobs: - name: Load the checker from the base branch run: git show "$BASE_SHA:scripts/check-supply-chain-changes.mjs" > "$RUNNER_TEMP/check-supply-chain-changes.mjs" - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 diff --git a/src/__tests__/repoHygiene.test.ts b/src/__tests__/repoHygiene.test.ts index 33dac4b4..9a342a50 100644 --- a/src/__tests__/repoHygiene.test.ts +++ b/src/__tests__/repoHygiene.test.ts @@ -191,13 +191,14 @@ describe('bun version parity (#790)', () => { expect(e2eChain).not.toMatch(/bun-version:\s*['"]?\d+\.\d+/i) // Every oven-sh/setup-bun step must specify bun-version-file: package.json - const ciSetupBunCount = (ci.match(/uses:\s*oven-sh\/setup-bun@v2/g) || []).length + const ciSetupBunCount = (ci.match(/uses:\s*oven-sh\/setup-bun@[0-9a-f]{40}/g) || []).length const ciVersionFileCount = (ci.match(/bun-version-file:\s*package\.json/g) || []).length // quality, supply-chain, test, build and e2e expect(ciSetupBunCount).toBe(5) expect(ciVersionFileCount).toBe(ciSetupBunCount) - const e2eSetupBunCount = (e2eChain.match(/uses:\s*oven-sh\/setup-bun@v2/g) || []).length + const e2eSetupBunCount = (e2eChain.match(/uses:\s*oven-sh\/setup-bun@[0-9a-f]{40}/g) || []) + .length const e2eVersionFileCount = (e2eChain.match(/bun-version-file:\s*package\.json/g) || []).length expect(e2eSetupBunCount).toBe(1) expect(e2eVersionFileCount).toBe(e2eSetupBunCount)