Skip to content

Commit 615b663

Browse files
kategenglerkategengler
authored
Merge pull request #21185 from emberjs/kg-action-lint
2 parents 4d73288 + d3abd61 commit 615b663

12 files changed

Lines changed: 95 additions & 40 deletions

‎.github/actions/setup/action.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,5 +24,7 @@ runs:
2424
registry-url: 'https://registry.npmjs.org'
2525
cache: pnpm
2626

27-
- run: pnpm install ${{ fromJSON('{"false":"--no-lockfile", "true":"--frozen-lockfile"}')[inputs.use_lockfile] }}
27+
- run: pnpm install ${INSTALL_OPTIONS}
28+
env:
29+
INSTALL_OPTIONS: ${{ fromJSON('{"false":"--no-lockfile", "true":"--frozen-lockfile"}')[inputs.use_lockfile] }}
2830
shell: bash

‎.github/dependabot.yml‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎.github/workflows/alpha-releases.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@ on:
55
- cron: '0 20 * * 3' # weekly (Wednesday)
66
workflow_dispatch:
77

8+
permissions:
9+
contents: read # PAT used for push
10+
811
jobs:
912
tests:
1013
uses: ./.github/workflows/ci-jobs.yml
1114

1215
release:
13-
permissions:
14-
contents: read # PAT used for push
15-
1616
name: Tag + Push
1717
runs-on: ubuntu-latest
1818
needs: [ tests ]
@@ -31,9 +31,9 @@ jobs:
3131
export NEXT_ALPHA=`node bin/next-alpha-version.js ${LATEST_ALPHA}`
3232
echo "NEXT_ALPHA=$NEXT_ALPHA" >> $GITHUB_ENV
3333
- name: bump version
34-
run: npm version ${{env.NEXT_ALPHA}} --allow-same-version --no-git-tag-version
34+
run: npm version ${NEXT_ALPHA} --allow-same-version --no-git-tag-version
3535
- name: create tag
36-
run: git tag v${{env.NEXT_ALPHA}}-ember-source
36+
run: git tag v${NEXT_ALPHA}-ember-source
3737
- name: push tag
3838
# Push in a way that WILL trigger other workflows
39-
run: git push https://${GITHUB_ACTOR}:${{ secrets.PERSONAL_TOKEN }}@github.com/${GITHUB_REPOSITORY} v${{env.NEXT_ALPHA}}-ember-source
39+
run: git push https://${GITHUB_ACTOR}:${{ secrets.PERSONAL_TOKEN }}@github.com/${GITHUB_REPOSITORY} v${NEXT_ALPHA}-ember-source

‎.github/workflows/ci-jobs.yml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ jobs:
1414
matrix: ${{ steps.set-matrix.outputs.matrix }}
1515
steps:
1616
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
persist-credentials: false
1719
- uses: ./.github/actions/setup
1820
- name: linting
1921
run: pnpm lint
@@ -28,6 +30,8 @@ jobs:
2830
runs-on: ubuntu-latest
2931
steps:
3032
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
33+
with:
34+
persist-credentials: false
3135
- uses: ./.github/actions/setup
3236
- name: build types
3337
run: pnpm build:types
@@ -47,6 +51,8 @@ jobs:
4751
ts-version: ["5.2", "5.3", "5.4", "5.5", "5.6", "5.7", "5.8", "5.9"]
4852
steps:
4953
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
54+
with:
55+
persist-credentials: false
5056
- uses: ./.github/actions/setup
5157
- name: build stable type definitions
5258
run: pnpm build:types
@@ -60,6 +66,8 @@ jobs:
6066
runs-on: ubuntu-latest
6167
steps:
6268
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
69+
with:
70+
persist-credentials: false
6371
- uses: ./.github/actions/setup
6472
- name: build
6573
run: pnpm vite build --mode=development
@@ -94,6 +102,8 @@ jobs:
94102

95103
steps:
96104
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105+
with:
106+
persist-credentials: false
97107
- uses: ./.github/actions/setup
98108
- name: build
99109
run: pnpm vite build --mode=${{ matrix.BUILD || 'development' }}
@@ -114,6 +124,8 @@ jobs:
114124
needs: [basic-test, lint, types]
115125
steps:
116126
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
127+
with:
128+
persist-credentials: false
117129
- uses: ./.github/actions/setup
118130
- name: build
119131
env:
@@ -144,6 +156,8 @@ jobs:
144156
matrix: ${{fromJson(needs.lint.outputs.matrix)}}
145157
steps:
146158
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
159+
with:
160+
persist-credentials: false
147161
- uses: ./.github/actions/setup
148162
with:
149163
use_lockfile: "false"
@@ -152,14 +166,18 @@ jobs:
152166
- name: test
153167
working-directory: smoke-tests/scenarios
154168
run: |
155-
${{ matrix.command }}
169+
${MATRIX_COMMAND}
170+
env:
171+
MATRIX_COMMAND: ${{ matrix.command }}
156172

157173
node-test:
158174
name: Node.js Tests
159175
runs-on: ubuntu-latest
160176
needs: [basic-test, lint, types]
161177
steps:
162178
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
179+
with:
180+
persist-credentials: false
163181
- uses: ./.github/actions/setup
164182
- name: build
165183
env:
@@ -174,6 +192,8 @@ jobs:
174192
needs: [lint]
175193
steps:
176194
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
195+
with:
196+
persist-credentials: false
177197
- uses: ./.github/actions/setup
178198
- name: test
179199
run: pnpm test:blueprints
@@ -184,6 +204,8 @@ jobs:
184204
needs: [basic-test, lint, types]
185205
steps:
186206
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
207+
with:
208+
persist-credentials: false
187209
- uses: ./.github/actions/setup
188210
- name: build
189211
run: pnpm vite build --mode=development
@@ -202,6 +224,7 @@ jobs:
202224
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
203225
with:
204226
fetch-depth: 0
227+
persist-credentials: false
205228
- uses: ./.github/actions/setup
206229
- name: Check that the perf script works, so we don't regress
207230
run: RUNS='2' pnpm bench

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
# Only run on pushes to branches that are not from the cron workflow
2929
if: github.event_name == 'push' && contains(github.ref, 'cron') != true
3030
steps:
31-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] creds are used for build-for-publishing.js
3232
- uses: ./.github/actions/setup
3333
- name: build for publish
3434
run: node bin/build-for-publishing.js
@@ -46,7 +46,7 @@ jobs:
4646
# Only run on pushes to main
4747
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
4848
steps:
49-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] creds are used for build-for-publishing.js
5050
- uses: ./.github/actions/setup
5151
- name: build for publish
5252
run: node bin/build-for-publishing.js

‎.github/workflows/docs.yml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
required: true
1111
description: Tag name or branch or ref to generate docs for
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
generate-and-pr:
1518
runs-on: ubuntu-latest
@@ -20,18 +23,21 @@ jobs:
2023
repository: emberjs/ember.js
2124
path: ember.js
2225
ref: ${{ inputs.ref || github.ref_name }}
26+
persist-credentials: false
2327

2428
- name: Checkout ember-jsonapi-docs
2529
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2630
with:
2731
repository: kategengler/ember-jsonapi-docs
2832
path: ember-jsonapi-docs
33+
persist-credentials: false
2934

3035
- name: Checkout ember-api-docs-data
3136
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3237
with:
3338
repository: ember-learn/ember-api-docs-data
3439
path: ember-api-docs-data
40+
persist-credentials: false
3541

3642
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
3743
name: Install pnpm
@@ -42,6 +48,7 @@ jobs:
4248
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4349
with:
4450
node-version: '20'
51+
package-manager-cache: false
4552

4653
- name: Install dependencies for ember-jsonapi-docs
4754
run: pnpm install
@@ -58,16 +65,20 @@ jobs:
5865
working-directory: ember.js
5966

6067
- name: Generate API docs
61-
run: pnpm run gen --project ember --version "${{ steps.pkg.outputs.version }}"
68+
run: pnpm run gen --project ember --version "${STEPS_PKG_OUTPUTS_VERSION}"
6269
working-directory: ember-jsonapi-docs
70+
env:
71+
STEPS_PKG_OUTPUTS_VERSION: ${{ steps.pkg.outputs.version }}
6372

6473
- name: Commit changes
6574
run: |
6675
git config user.name "github-actions[bot]"
6776
git config user.email "github-actions[bot]@users.noreply.github.com"
6877
git add .
69-
git commit -m "Add docs for Ember ${{ steps.pkg.outputs.version }}"
78+
git commit -m "Add docs for Ember ${STEPS_PKG_OUTPUTS_VERSION}"
7079
working-directory: ember-api-docs-data
80+
env:
81+
STEPS_PKG_OUTPUTS_VERSION: ${{ steps.pkg.outputs.version }}
7182

7283
- name: Fix docs, commit, push
7384
run: |

‎.github/workflows/night-ts.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
with:
13+
persist-credentials: false
1214
- uses: ./.github/actions/setup
1315
- run: pnpm build
1416
- run: pnpm add --save-dev typescript@latest --workspace-root

‎.github/workflows/package-size.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ jobs:
1515

1616
steps:
1717
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
1820
- uses: ./.github/actions/setup
1921
- uses: wyvox/pkg-size@4c68a40496b9dd2d228575f8738cdfa4ad277754
2022
with:

‎.github/workflows/pr-title-lint.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ on:
66

77
permissions:
88
contents: read
9-
issues: write
109
pull-requests: read
1110

1211
jobs:
@@ -61,6 +60,8 @@ jobs:
6160
comment-if-fix:
6261
name: Comment on PR if title includes "Fix" without a bracket tag
6362
runs-on: ubuntu-latest
63+
permissions:
64+
issues: write
6465
steps:
6566
- name: Validate title
6667
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

‎.github/workflows/publish-to-npm.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
tags:
66
- 'v*'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
tests:
1013
uses: ./.github/workflows/ci-jobs.yml
@@ -16,7 +19,7 @@ jobs:
1619
contents: read
1720
id-token: write
1821
steps:
19-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] creds are used for build-for-publishing.js
2023
- uses: ./.github/actions/setup
2124
with:
2225
node-version: 20

0 commit comments

Comments
 (0)