Skip to content

Commit c20006d

Browse files
achrinzaachrinza
committed
ci: align CI configuration
see: loopbackio/cicd#91 see: loopbackio/cicd#90 see: loopbackio/cicd#89 see: loopbackio/cicd#83 see: loopbackio/security#27 see: loopbackio/security#26 see: loopbackio/security#23 see: loopbackio/security#16 Signed-off-by: Rifa Achrinza <[email protected]>
1 parent 9f9baf3 commit c20006d

File tree

4 files changed

+1911
-31
lines changed

4 files changed

+1911
-31
lines changed

‎.github/workflows/continuous-integration.yml

+109-23
Original file line numberDiff line numberDiff line change
@@ -9,66 +9,152 @@ on:
99
schedule:
1010
- cron: '0 2 * * 1' # At 02:00 on Monday
1111

12-
env:
13-
NODE_OPTIONS: --max-old-space-size=4096
12+
permissions: {}
1413

1514
jobs:
1615
test:
1716
name: Test
18-
timeout-minutes: 15
17+
timeout-minutes: 5
1918
strategy:
2019
matrix:
2120
os: [ubuntu-latest]
22-
node-version: [16, 18]
21+
node-version:
22+
- 16
23+
- 18
24+
- 20
25+
- 21
2326
include:
2427
- os: macos-latest
25-
node-version: 16 # LTS
28+
node-version: 20 # LTS
29+
- os: windows-latest
30+
node-version: 20 # LTS
2631
fail-fast: false
2732
runs-on: ${{ matrix.os }}
2833
steps:
29-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
34+
- uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
35+
if: ${{ matrix.os == 'ubuntu-latest' }}
3036
with:
31-
fetch-depth: 0
37+
disable-sudo: true
38+
egress-policy: block
39+
allowed-endpoints: >
40+
api.github.com:443
41+
github.com:443
42+
nodejs.org:443
43+
registry.npmjs.org:443
44+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
45+
with:
46+
persist-credentials: false
3247
- name: Use Node.js ${{ matrix.node-version }}
33-
uses: actions/setup-node@v3
48+
uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
3449
with:
3550
node-version: ${{ matrix.node-version }}
51+
cache: npm
3652
- name: Bootstrap project
37-
run: |
38-
npm ci --ignore-scripts
39-
- uses: Yuri6037/[email protected]
53+
run: npm ci --ignore-scripts --prefer-offline
54+
- uses: Yuri6037/Action-FakeTTY@1abc69c7d530815855caedcd73842bae5687c1a6 # v1.1
4055
- name: Run tests
4156
run: faketty npm test --ignore-scripts
4257

4358
code-lint:
4459
name: Code Lint
4560
runs-on: ubuntu-latest
4661
steps:
47-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
48-
- name: Use Node.js 16
49-
uses: actions/setup-node@v3
62+
- uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
63+
with:
64+
disable-sudo: true
65+
egress-policy: block
66+
allowed-endpoints: >
67+
api.github.com:443
68+
github.com:443
69+
nodejs.org:443
70+
registry.npmjs.org:443
71+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
72+
with:
73+
persist-credentials: false
74+
- name: Use Node.js 20
75+
uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
5076
with:
51-
node-version: 16
77+
node-version: 20
78+
cache: 'npm'
5279
- name: Bootstrap project
5380
run: |
54-
npm ci --ignore-scripts
81+
npm ci \
82+
--ignore-scripts \
83+
--prefer-offline
5584
- name: Verify code linting
56-
run: npm run lint
85+
run: npm run lint --ignore-scripts
5786

5887
commit-lint:
5988
name: Commit Lint
6089
runs-on: ubuntu-latest
6190
if: ${{ github.event.pull_request }}
6291
steps:
63-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
92+
- uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
93+
with:
94+
disable-sudo: true
95+
egress-policy: block
96+
allowed-endpoints: >
97+
github.com:443
98+
registry.npmjs.org:443
99+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
64100
with:
65101
fetch-depth: 0
66-
- name: Use Node.js 16
67-
uses: actions/setup-node@v3
102+
persist-credentials: false
103+
- name: Use Node.js 20
104+
uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
105+
with:
106+
node-version: 20
107+
cache: npm
108+
- name: Bootstrap project
109+
run: |
110+
npm ci \
111+
--ignore-scripts \
112+
--prefer-offline
113+
- name: Verify commit linting
114+
run: |
115+
npm exec \
116+
--no-install \
117+
--package=@commitlint/cli \
118+
-- \
119+
commitlint \
120+
--from=origin/master \
121+
--to=HEAD \
122+
--verbose
123+
124+
lockfile-lint:
125+
name: Lockfile Lint
126+
runs-on: ubuntu-latest
127+
steps:
128+
- uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
68129
with:
69-
node-version: 16
130+
disable-sudo: true
131+
egress-policy: block
132+
allowed-endpoints: >
133+
github.com:443
134+
registry.npmjs.org:443
135+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
136+
with:
137+
persist-credentials: false
138+
- name: Use Node.js 20
139+
uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
140+
with:
141+
node-version: 20
142+
cache: npm
70143
- name: Bootstrap project
71144
run: |
72-
npm ci --ignore-scripts
145+
npm ci \
146+
--ignore-scripts \
147+
--prefer-offline
73148
- name: Verify commit linting
74-
run: npx commitlint --from origin/master --to HEAD --verbose
149+
run: |
150+
npm exec \
151+
--no-install \
152+
--package=lockfile-lint \
153+
-- \
154+
lockfile-lint \
155+
--path=package-lock.json \
156+
--allowed-hosts=npm \
157+
--validate-https \
158+
--validate-integrity \
159+
--validate-package-names
160+

‎.github/workflows/scorecards.yml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Based on `scorecard.yml` Github Actions starter workflow:
2+
# https://github.com/actions/starter-workflows/blob/b1df8a546ed4d0f27d46aaf2f8ac1118bc522638/code-scanning/scorecard.yml
3+
4+
# This is separate from the CI workflow due to certain restrictions imposed by the GitHub Action action:
5+
# https://github.com/ossf/scorecard-action/tree/99cc02c8ee27bab5f5f41e79066e0de91d313dec#workflow-restrictions
6+
# For consistency, we should keep it a separate workflow across all our Github repositories, regardless if it's actually needed.
7+
8+
name: OSSF Scorecard
9+
on:
10+
# For Branch-Protection check. Only the default branch is supported. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
12+
branch_protection_rule: {}
13+
# To guarantee Maintained check is occasionally updated. See
14+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
15+
schedule:
16+
- cron: '30 6 * * 5'
17+
push:
18+
branches: [master]
19+
# Added for testing the workflow, as PR triggers are currently not supported by the OSSF Scorecard Action.
20+
workflow_dispatch: {}
21+
22+
# Declare default permissions as read only.
23+
# permissions: read-all
24+
permissions: {}
25+
26+
jobs:
27+
analysis:
28+
name: Scorecard analysis
29+
runs-on: ubuntu-latest
30+
permissions:
31+
# Needed to upload the results to code-scanning dashboard.
32+
security-events: write
33+
# Needed to publish results and get a badge (see publish_results below).
34+
id-token: write
35+
36+
steps:
37+
- uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
38+
if: ${{ matrix.os == 'ubuntu-latest' }}
39+
with:
40+
disable-sudo: true
41+
egress-policy: audit
42+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
43+
with:
44+
persist-credentials: false
45+
46+
- uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
47+
with:
48+
results_file: results.sarif
49+
results_format: sarif
50+
# Public repositories:
51+
# - Publish results to OpenSSF REST API for easy access by consumers
52+
# - Allows the repository to include the Scorecard badge.
53+
# - See https://github.com/ossf/scorecard-action#publishing-results.
54+
# For private repositories:
55+
# - `publish_results` will always be set to `false`, regardless
56+
# of the value entered here.
57+
publish_results: true
58+
59+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
60+
# format to the repository Actions tab.
61+
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
62+
with:
63+
name: OSSF Scorecard SARIF file
64+
path: results.sarif
65+
retention-days: 90
66+
67+
# Upload the results to GitHub's code scanning dashboard.
68+
- uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
69+
with:
70+
sarif_file: results.sarif

0 commit comments

Comments
 (0)