diff --git a/.cspell.json b/.cspell.json index 9658159..9e2fec0 100644 --- a/.cspell.json +++ b/.cspell.json @@ -113,6 +113,7 @@ "webextension", "workdir", "wscript", + "zizmor", "únete" ], "ignorePaths": [ diff --git a/.github/workflows/mega-linter.yml b/.github/workflows/mega-linter.yml index e3fdd36..9b1f7c8 100644 --- a/.github/workflows/mega-linter.yml +++ b/.github/workflows/mega-linter.yml @@ -18,20 +18,8 @@ on: # Comment env block if you do not want to apply fixes env: - # Apply linter fixes configuration - # - # When active, APPLY_FIXES must also be defined as environment variable - # (in github/workflows/mega-linter.yml or other CI tool) APPLY_FIXES: none - # Decide which event triggers application of fixes in a commit or a PR - # (pull_request, push, all) - APPLY_FIXES_EVENT: pull_request - - # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) - # or posted in a PR (pull_request) - APPLY_FIXES_MODE: commit - concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true @@ -51,19 +39,17 @@ jobs: (github.event_name == 'pull_request' && github.event.pull_request.draft == false) || (github.event_name == 'push' && github.ref == 'refs/heads/main') - # Give the default GITHUB_TOKEN write permission to commit and push, comment - # issues, and post new Pull Requests; remove the ones you do not need permissions: - contents: write + contents: read issues: write pull-requests: write steps: # Git Checkout - name: Checkout Code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: - token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} + persist-credentials: false # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to # improve performance @@ -74,7 +60,7 @@ jobs: # You can override MegaLinter flavor used to have faster performances # More info at https://megalinter.io/latest/flavors/ - uses: oxsecurity/megalinter/flavors/javascript@v8 + uses: oxsecurity/megalinter/flavors/javascript@15e5b45552097e318c93de385779ce3b1084052c # v10.0.0 id: ml @@ -101,94 +87,10 @@ jobs: # Upload MegaLinter artifacts - name: Archive production artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: success() || failure() with: name: MegaLinter reports path: | megalinter-reports mega-linter.log - - # Create pull request if applicable - # (for now works only on PR from same repository, not from forks) - - name: Create Pull Request with applied fixes - uses: peter-evans/create-pull-request@v8 - id: cpr - if: >- - steps.ml.outputs.has_updated_sources == 1 && - ( - env.APPLY_FIXES_EVENT == 'all' || - env.APPLY_FIXES_EVENT == github.event_name - ) && - env.APPLY_FIXES_MODE == 'pull_request' && - ( - github.event_name == 'push' || - github.event.pull_request.head.repo.full_name == github.repository - ) && - !contains(github.event.head_commit.message, 'skip fix') - with: - token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} - commit-message: '[MegaLinter] Apply linters automatic fixes' - title: '[MegaLinter] Apply linters automatic fixes' - labels: bot - - - name: Create PR output - if: >- - steps.ml.outputs.has_updated_sources == 1 && - ( - env.APPLY_FIXES_EVENT == 'all' || - env.APPLY_FIXES_EVENT == github.event_name - ) && - env.APPLY_FIXES_MODE == 'pull_request' && - ( - github.event_name == 'push' || - github.event.pull_request.head.repo.full_name == github.repository - ) && - !contains(github.event.head_commit.message, 'skip fix') - run: | - echo "PR Number - ${{ steps.cpr.outputs.pull-request-number }}" - echo "PR URL - ${{ steps.cpr.outputs.pull-request-url }}" - - # Push new commit if applicable - # (for now works only on PR from same repository, not from forks) - - name: Prepare commit - if: >- - steps.ml.outputs.has_updated_sources == 1 && - ( - env.APPLY_FIXES_EVENT == 'all' || - env.APPLY_FIXES_EVENT == github.event_name - ) && - env.APPLY_FIXES_MODE == 'commit' && - github.ref != 'refs/heads/main' && - ( - github.event_name == 'push' || - github.event.pull_request.head.repo.full_name == github.repository - ) && - !contains(github.event.head_commit.message, 'skip fix') - run: sudo chown -Rc $UID .git/ - - - name: Commit and push applied linter fixes - uses: stefanzweifel/git-auto-commit-action@v7 - if: >- - steps.ml.outputs.has_updated_sources == 1 && - ( - env.APPLY_FIXES_EVENT == 'all' || - env.APPLY_FIXES_EVENT == github.event_name - ) && - env.APPLY_FIXES_MODE == 'commit' && - github.ref != 'refs/heads/main' && - ( - github.event_name == 'push' || - github.event.pull_request.head.repo.full_name == github.repository - ) && - !contains(github.event.head_commit.message, 'skip fix') - with: - branch: >- - ${{ - github.event.pull_request.head.ref || - github.head_ref || - github.ref - }} - commit_message: '[MegaLinter] Apply linters fixes' - commit_user_name: megalinter-bot - commit_user_email: nicolas.vuillamy@ox.security diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 09d4c81..9cfcd89 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -26,9 +26,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version-file: .node-version diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 1f5355d..d281566 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -22,13 +22,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - name: Setup Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version-file: .node-version cache: pnpm diff --git a/.github/workflows/todo.yml b/.github/workflows/todo.yml index 7257713..62a3d0c 100644 --- a/.github/workflows/todo.yml +++ b/.github/workflows/todo.yml @@ -21,10 +21,12 @@ jobs: steps: - name: Begin CI... - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: TODO to Issue - uses: alstr/todo-to-issue-action@v5.1.15 + uses: alstr/todo-to-issue-action@37bb7b56e58569ef273b60678048030a7f0c261a # v5.1.15 id: todo with: INSERT_ISSUE_URLS: 'true' @@ -36,7 +38,10 @@ jobs: git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Commit and Push Changes + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | + gh auth setup-git git add -A if [[ $(git status --porcelain) ]]; then git commit -m "Automatically added GitHub issue links to TODOs" diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml index 99ae369..2061081 100644 --- a/.github/workflows/type-check.yml +++ b/.github/workflows/type-check.yml @@ -22,13 +22,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - name: Setup Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version-file: .node-version cache: pnpm diff --git a/.mega-linter.yml b/.mega-linter.yml index 913e584..f15cc01 100644 --- a/.mega-linter.yml +++ b/.mega-linter.yml @@ -8,6 +8,19 @@ PRINT_ALL_FILES: false VALIDATE_ALL_CODEBASE: true FILTER_REGEX_EXCLUDE: (pnpm-lock\.yaml|megalinter-reports/|node_modules/|\.next/|tools/danger/package-lock\.json) +# MegaLinter 10 ESLint uses ESM resolution, so run the project-local binary. +PRE_COMMANDS: + - command: CI=true npx --yes pnpm@10.32.0 install --frozen-lockfile --ignore-scripts + cwd: workspace + run_before_linters: true + continue_if_failed: false +JAVASCRIPT_ES_CLI_EXECUTABLE: node_modules/.bin/eslint +TSX_ESLINT_CLI_EXECUTABLE: node_modules/.bin/eslint + +# Allow Zizmor online reference audit to use the job read-capable token. +ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES: + - GITHUB_TOKEN + DISABLE_LINTERS: # SBOM generation is informational; keep trivy vuln scan as the gate. - REPOSITORY_TRIVY_SBOM @@ -18,7 +31,6 @@ DISABLE_LINTERS: - CSS_STYLELINT # External link checkers are flaky in CI (npmjs 403, cert/network noise). - SPELL_LYCHEE - - MARKDOWN_MARKDOWN_LINK_CHECK # Schema store has no checkov schema; empty assignees fail issue-form schemas. - YAML_V8R