mirror of
https://github.com/transloadit/uppy.git
synced 2026-07-17 16:50:22 +00:00
0e09bd2096
## Why Recent npm supply-chain compromises showed that dependency installs and shared CI caches can execute or preserve newly published malicious packages before advisories catch up. This PR reduces that exposure for this repo. ## What changed - Made eligible Yarn installs immutable and removed shared dependency caching from the manual CDN upload path; existing minimal age gate remains unchanged. ## Validation - Ran `git diff --check` across the prepared worktree. - Audited this PR set for `pull_request_target` and release/deploy/CDN cache reuse; patched actionable hits. - Did not run the full test suite; this is a workflow/config-only change.
107 lines
3 KiB
YAML
107 lines
3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- '**.md'
|
|
- 'assets/**'
|
|
- '.github/**'
|
|
- '!.github/workflows/ci.yml'
|
|
pull_request:
|
|
# We want all branches so we configure types to be the GH default again
|
|
types: [opened, synchronize, reopened]
|
|
paths-ignore:
|
|
- '**.md'
|
|
- '.github/**'
|
|
- '!.github/workflows/ci.yml'
|
|
|
|
env:
|
|
YARN_ENABLE_GLOBAL_CACHE: false
|
|
|
|
jobs:
|
|
unit_tests:
|
|
name: Tests
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
node-version: [lts/*]
|
|
steps:
|
|
- name: Checkout sources
|
|
uses: actions/checkout@v6
|
|
- name: Get yarn cache directory path
|
|
id: yarn-cache-dir-path
|
|
run:
|
|
echo "dir=$(corepack yarn config get cacheFolder)" >> $GITHUB_OUTPUT
|
|
|
|
- uses: actions/cache@v5
|
|
id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
|
|
with:
|
|
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
|
|
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-yarn-
|
|
- name: Install Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{matrix.node-version}}
|
|
- name: Install dependencies
|
|
run:
|
|
corepack yarn install --immutable
|
|
- name: Install Playwright Browsers
|
|
run: corepack yarn workspace @uppy/dashboard playwright install --with-deps
|
|
- name: Build
|
|
run: corepack yarn run build
|
|
- name: Run tests
|
|
run: corepack yarn run test
|
|
env:
|
|
COMPANION_DATADIR: ./output
|
|
COMPANION_DOMAIN: localhost:3020
|
|
COMPANION_PROTOCOL: http
|
|
COMPANION_REDIS_URL: redis://localhost:6379
|
|
|
|
types:
|
|
name: Types
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout sources
|
|
uses: actions/checkout@v6
|
|
- name: Get yarn cache directory path
|
|
id: yarn-cache-dir-path
|
|
run:
|
|
echo "dir=$(corepack yarn config get cacheFolder)" >> $GITHUB_OUTPUT
|
|
|
|
- uses: actions/cache@v5
|
|
id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
|
|
with:
|
|
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
|
|
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-yarn-
|
|
- name: Install Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: lts/*
|
|
- name: Install dependencies
|
|
run:
|
|
corepack yarn install --immutable
|
|
- run: corepack yarn run typecheck
|
|
|
|
lint_js:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
SKIP_YARN_COREPACK_CHECK: true
|
|
steps:
|
|
- name: Checkout sources
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Install Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: lts/*
|
|
- name: Install dependencies
|
|
run:
|
|
corepack yarn workspaces focus @uppy-dev/build
|
|
- name: Run linter
|
|
run: corepack yarn run check:ci
|