1
0
mirror of https://github.com/verdaccio/verdaccio.git synced 2024-11-13 03:35:52 +01:00
verdaccio/.github/workflows/ci.yml
Naveen 1a605054a8
chore: Set permissions for GitHub actions (#3145)
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
2022-04-28 18:06:00 +02:00

198 lines
5.6 KiB
YAML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

name: CI
on:
push:
branches:
- master
- 'changeset-release/master'
pull_request:
paths:
- .changeset/**
- .github/workflows/ci.yml
- 'packages/**'
- 'docker-examples/**'
- 'jest/**'
- 'package.json'
- 'pnpm-workspace.yaml'
permissions:
contents: read
jobs:
prepare:
runs-on: ubuntu-latest
name: setup verdaccio
services:
verdaccio:
image: verdaccio/verdaccio:nightly-master
ports:
- 4873:4873
steps:
- uses: actions/checkout@v3
- name: Use Node 16
uses: actions/setup-node@v3
with:
node-version: 16
- name: Install pnpm
run: npm i pnpm@6.32.3 -g
- name: set store
run: |
mkdir ~/.pnpm-store
pnpm config set store-dir ~/.pnpm-store
- name: Install
run: pnpm recursive install --frozen-lockfile --registry http://localhost:4873
- name: Cache .pnpm-store
uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-
lint:
runs-on: ubuntu-latest
name: Lint
needs: prepare
steps:
- uses: actions/checkout@v3
- name: Use Node 16
uses: actions/setup-node@v3
with:
node-version: 16
- name: Install pnpm
run: npm i pnpm@6.32.3 -g
- uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
- name: Install
run: pnpm recursive install --frozen-lockfile --ignore-scripts
- name: Lint
run: pnpm lint
format:
runs-on: ubuntu-latest
name: Format
needs: prepare
steps:
- uses: actions/checkout@v3
- name: Use Node 16
uses: actions/setup-node@v3
with:
node-version: 16
- name: Install pnpm
run: npm i pnpm@6.32.3 -g
- uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
- name: Install
run: pnpm recursive install --frozen-lockfile --ignore-scripts
- name: Lint
run: pnpm format:check
build:
needs: [format, lint]
strategy:
fail-fast: true
matrix:
os: [ubuntu-latest, windows-latest]
## Node 16 breaks UI test, jest issue
node_version: [16, 17]
name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v3
- name: Use Node ${{ matrix.node_version }}
uses: actions/setup-node@v3
with:
node-version: ${{ matrix.node_version }}
- name: Install pnpm
run: npm i pnpm@6.32.3 -g
- uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
- name: Install
run: pnpm recursive install --frozen-lockfile --ignore-scripts
- name: build
run: pnpm build
- name: Test
run: pnpm test
ci-e2e-ui:
needs: [format, lint]
runs-on: ubuntu-latest
name: UI Test E2E Node 16
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: 16
- name: Install pnpm
run: npm i pnpm@latest -g
- uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
- name: Install
## we need scripts, pupetter downloads aditional content
run: pnpm recursive install --frozen-lockfile
- name: build
run: pnpm build
- name: Test UI
run: pnpm test:e2e:ui
# env:
# DEBUG: verdaccio:e2e*
# FIXME verify why fails on Node 16 (locally works fine)
# ci-e2e-cli:
# needs: [format, lint]
# runs-on: ubuntu-latest
# # TODO: fails on migrate to node 16, we need to check why
# name: CLI Test E2E Node 16
# steps:
# - uses: actions/checkout@v3
# - uses: actions/setup-node@v3
# with:
# node-version: 16
# - name: Install pnpm
# run: npm i pnpm@latest -g
# - uses: actions/cache@v3
# with:
# path: ~/.pnpm-store
# key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
# - name: Install
# ## we need scripts, pupetter downloads aditional content
# run: pnpm recursive install --frozen-lockfile
# - name: build
# run: pnpm build
# - name: Test CLI
# run: pnpm test:e2e:cli
# env:
# DEBUG: verdaccio*
sync-translations:
# needs: [ci-e2e-cli, ci-e2e-ui]
needs: [ci-e2e-ui]
runs-on: ubuntu-latest
name: synchronize translations
if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: 16
- name: Install pnpm
run: npm i pnpm@6.32.3 -g
- uses: actions/cache@v3
with:
path: ~/.pnpm-store
key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
- name: Install
## we need scripts, pupetter downloads aditional content
run: pnpm recursive install --frozen-lockfile
- name: build
run: pnpm build
- name: generate website translations
run: pnpm write-translations --filter ...@verdaccio/website
- name: sync
env:
CROWDIN_VERDACCIO_PROJECT_ID: ${{ secrets.CROWDIN_VERDACCIO_PROJECT_ID }}
CROWDIN_VERDACCIO_API_KEY: ${{ secrets.CROWDIN_VERDACCIO_API_KEY }}
CONTEXT: production
run: pnpm crowdin:sync