mirror of
https://github.com/verdaccio/verdaccio.git
synced 2024-11-13 03:35:52 +01:00
1a605054a8
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
198 lines
5.6 KiB
YAML
198 lines
5.6 KiB
YAML
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches:
|
||
- master
|
||
- 'changeset-release/master'
|
||
pull_request:
|
||
paths:
|
||
- .changeset/**
|
||
- .github/workflows/ci.yml
|
||
- 'packages/**'
|
||
- 'docker-examples/**'
|
||
- 'jest/**'
|
||
- 'package.json'
|
||
- 'pnpm-workspace.yaml'
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
prepare:
|
||
runs-on: ubuntu-latest
|
||
name: setup verdaccio
|
||
services:
|
||
verdaccio:
|
||
image: verdaccio/verdaccio:nightly-master
|
||
ports:
|
||
- 4873:4873
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- name: Use Node 16
|
||
uses: actions/setup-node@v3
|
||
with:
|
||
node-version: 16
|
||
- name: Install pnpm
|
||
run: npm i pnpm@6.32.3 -g
|
||
- name: set store
|
||
run: |
|
||
mkdir ~/.pnpm-store
|
||
pnpm config set store-dir ~/.pnpm-store
|
||
- name: Install
|
||
run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
|
||
- name: Cache .pnpm-store
|
||
uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
restore-keys: |
|
||
pnpm-
|
||
lint:
|
||
runs-on: ubuntu-latest
|
||
name: Lint
|
||
needs: prepare
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- name: Use Node 16
|
||
uses: actions/setup-node@v3
|
||
with:
|
||
node-version: 16
|
||
- name: Install pnpm
|
||
run: npm i pnpm@6.32.3 -g
|
||
- uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
- name: Install
|
||
run: pnpm recursive install --frozen-lockfile --ignore-scripts
|
||
- name: Lint
|
||
run: pnpm lint
|
||
format:
|
||
runs-on: ubuntu-latest
|
||
name: Format
|
||
needs: prepare
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- name: Use Node 16
|
||
uses: actions/setup-node@v3
|
||
with:
|
||
node-version: 16
|
||
- name: Install pnpm
|
||
run: npm i pnpm@6.32.3 -g
|
||
- uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
- name: Install
|
||
run: pnpm recursive install --frozen-lockfile --ignore-scripts
|
||
- name: Lint
|
||
run: pnpm format:check
|
||
build:
|
||
needs: [format, lint]
|
||
strategy:
|
||
fail-fast: true
|
||
matrix:
|
||
os: [ubuntu-latest, windows-latest]
|
||
## Node 16 breaks UI test, jest issue
|
||
node_version: [16, 17]
|
||
name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
|
||
runs-on: ${{ matrix.os }}
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- name: Use Node ${{ matrix.node_version }}
|
||
uses: actions/setup-node@v3
|
||
with:
|
||
node-version: ${{ matrix.node_version }}
|
||
- name: Install pnpm
|
||
run: npm i pnpm@6.32.3 -g
|
||
- uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
- name: Install
|
||
run: pnpm recursive install --frozen-lockfile --ignore-scripts
|
||
- name: build
|
||
run: pnpm build
|
||
- name: Test
|
||
run: pnpm test
|
||
ci-e2e-ui:
|
||
needs: [format, lint]
|
||
runs-on: ubuntu-latest
|
||
name: UI Test E2E Node 16
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- uses: actions/setup-node@v3
|
||
with:
|
||
node-version: 16
|
||
- name: Install pnpm
|
||
run: npm i pnpm@latest -g
|
||
- uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
- name: Install
|
||
## we need scripts, pupetter downloads aditional content
|
||
run: pnpm recursive install --frozen-lockfile
|
||
- name: build
|
||
run: pnpm build
|
||
- name: Test UI
|
||
run: pnpm test:e2e:ui
|
||
# env:
|
||
# DEBUG: verdaccio:e2e*
|
||
# FIXME verify why fails on Node 16 (locally works fine)
|
||
# ci-e2e-cli:
|
||
# needs: [format, lint]
|
||
# runs-on: ubuntu-latest
|
||
# # TODO: fails on migrate to node 16, we need to check why
|
||
# name: CLI Test E2E Node 16
|
||
# steps:
|
||
# - uses: actions/checkout@v3
|
||
# - uses: actions/setup-node@v3
|
||
# with:
|
||
# node-version: 16
|
||
# - name: Install pnpm
|
||
# run: npm i pnpm@latest -g
|
||
# - uses: actions/cache@v3
|
||
# with:
|
||
# path: ~/.pnpm-store
|
||
# key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
# - name: Install
|
||
# ## we need scripts, pupetter downloads aditional content
|
||
# run: pnpm recursive install --frozen-lockfile
|
||
# - name: build
|
||
# run: pnpm build
|
||
# - name: Test CLI
|
||
# run: pnpm test:e2e:cli
|
||
# env:
|
||
# DEBUG: verdaccio*
|
||
sync-translations:
|
||
# needs: [ci-e2e-cli, ci-e2e-ui]
|
||
needs: [ci-e2e-ui]
|
||
runs-on: ubuntu-latest
|
||
name: synchronize translations
|
||
if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
|
||
steps:
|
||
- uses: actions/checkout@v3
|
||
- uses: actions/setup-node@v3
|
||
with:
|
||
node-version: 16
|
||
- name: Install pnpm
|
||
run: npm i pnpm@6.32.3 -g
|
||
- uses: actions/cache@v3
|
||
with:
|
||
path: ~/.pnpm-store
|
||
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
|
||
- name: Install
|
||
## we need scripts, pupetter downloads aditional content
|
||
run: pnpm recursive install --frozen-lockfile
|
||
- name: build
|
||
run: pnpm build
|
||
- name: generate website translations
|
||
run: pnpm write-translations --filter ...@verdaccio/website
|
||
- name: sync
|
||
env:
|
||
CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
|
||
CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
|
||
CONTEXT: production
|
||
run: pnpm crowdin:sync
|