Skip to content

Commit 8cc361f

Browse files
Redtigercod4Redtigercod4
committed
Condensed workflow files and addressed issues from zizmor and other workflows
1 parent f6004e1 commit 8cc361f

19 files changed

Lines changed: 184 additions & 178 deletions

‎.github/actions/npm-setup/action.yml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,27 @@
1-
name: 'npm setup'
2-
description: 'Sets up NodeJS with npm caching and dependencies installed'
1+
name: npm setup
2+
description: Sets up NodeJS with npm caching and dependencies installed
33

44
inputs:
55
node-version:
6-
description: 'NodeJS version'
6+
description: NodeJS version
77
required: false
8-
default: '24'
8+
default: 24
99
install-command:
10-
description: 'Dependency installation command'
10+
description: Dependency installation command
1111
required: false
12-
default: 'npm clean-install'
12+
default: npm clean-install
1313

1414
runs:
15-
using: 'composite'
15+
using: composite
1616
steps:
17-
- name: 'Install node ${{ inputs.node-version }}'
17+
- name: Install node ${{ inputs.node-version }}
1818
uses: actions/setup-node@v7.1.0
1919
with:
2020
node-version: ${{ inputs.node-version }}
2121
cache: 'npm'
2222

23-
- name: 'Install dependencies'
23+
- name: Install dependencies
2424
shell: bash
25-
run: ${{ inputs.install-command }}
25+
env:
26+
INSTALL_COMMAND: ${{ inputs.install-command }}
27+
run: $INSTALL_COMMAND

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
version: 2
22
updates:
33
- package-ecosystem: 'npm'
4+
cooldown:
5+
default-days: 7
46
directory: '/'
57
schedule:
68
interval: 'weekly'
@@ -31,6 +33,8 @@ updates:
3133
- 'version-update:semver-major'
3234

3335
- package-ecosystem: 'github-actions'
36+
cooldown:
37+
default-days: 7
3438
directory: '/'
3539
schedule:
3640
interval: 'weekly'

.github/workflows/reusable-build.yml renamed to .github/workflows/_build.yml

File renamed without changes.

.github/workflows/reusable-dependency-review.yml renamed to .github/workflows/_dependency-review.yml

File renamed without changes.

.github/workflows/reusable-lint.yml renamed to .github/workflows/_lint.yml

File renamed without changes.

‎.github/workflows/_security-scans.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Security Scans
2+
on:
3+
workflow_call:
4+
5+
permissions:
6+
contents: read
7+
actions: read
8+
9+
jobs:
10+
secret-scanning:
11+
# TODO(#398): Currently blocked by pulp organisation actions allow-list - gitleaks-action isn't permitted.
12+
if: false
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout pulp-ui (${{ github.ref }})
16+
uses: actions/checkout@v7.0.1
17+
with:
18+
persist-credentials: false
19+
fetch-depth: 0
20+
21+
- name: Run Gitleaks
22+
uses: gitleaks/gitleaks-action@v3.0.0
23+
env:
24+
GITHUB_TOKEN: ${{ github.token }}
25+
26+
software-composition-analysis:
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout pulp-ui (${{ github.ref }})
30+
uses: actions/checkout@v7.0.1
31+
with:
32+
persist-credentials: false
33+
34+
- name: Run OSV-Scanner
35+
uses: google/osv-scanner-action/osv-scanner-action@v2.7.0
36+
with:
37+
scan-args: |-
38+
--lockfile=package-lock.json
39+
--format=sarif
40+
--output-file=osv-results.sarif
41+
42+
- name: Upload SARIF artifact
43+
if: always()
44+
uses: actions/upload-artifact@v7.0.2
45+
with:
46+
name: osv-results
47+
path: osv-results.sarif
48+
retention-days: 1
49+
50+
static-application-security-testing:
51+
runs-on: ubuntu-latest
52+
steps:
53+
- name: Checkout pulp-ui (${{ github.ref }})
54+
uses: actions/checkout@v7.0.1
55+
with:
56+
persist-credentials: false
57+
58+
- name: npm Setup
59+
uses: $/.github/actions/npm-setup
60+
61+
- name: Initialize CodeQL
62+
uses: github/codeql-action/init@v4.39.1
63+
with:
64+
languages: javascript-typescript
65+
66+
- name: Perform CodeQL Analysis
67+
uses: github/codeql-action/analyze@v4.39.1
68+
with:
69+
upload: never
70+
output: sarif-results
71+
72+
- name: Fail on findings
73+
run: |
74+
count=$(jq -s '[.[] | .runs[].results[]] | length' sarif-results/*.sarif)
75+
echo "CodeQL found $count issue(s)"
76+
[ "$count" -eq 0 ]
77+
78+
- name: Upload SARIF artifact
79+
if: always()
80+
uses: actions/upload-artifact@v7.0.2
81+
with:
82+
name: codeql-results
83+
path: sarif-results
84+
retention-days: 1

‎.github/workflows/_test.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Test
2+
on:
3+
workflow_call:
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
integration-tests:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout pulp-ui (${{ github.ref }})
13+
uses: actions/checkout@v7.0.1
14+
with:
15+
persist-credentials: false
16+
17+
- name: npm Setup
18+
uses: $/.github/actions/npm-setup
19+
20+
- name: Run tests
21+
run: npm run test:integration
22+
23+
unit-tests:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout pulp-ui (${{ github.ref }})
27+
uses: actions/checkout@v7.0.1
28+
with:
29+
persist-credentials: false
30+
31+
- name: npm Setup
32+
uses: $/.github/actions/npm-setup
33+
34+
- name: Run tests
35+
run: npm run test:unit

.github/workflows/reusable-workflow-lint.yml renamed to .github/workflows/_workflow-lint.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ permissions:
66
contents: read
77

88
jobs:
9-
workflow-lint:
9+
zizmor:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Checkout pulp-ui (${{ github.ref }})
@@ -39,6 +39,11 @@ jobs:
3939
actions-lock:
4040
runs-on: ubuntu-latest
4141
steps:
42+
- name: Checkout pulp-ui (${{ github.ref }})
43+
uses: actions/checkout@v7.0.1
44+
with:
45+
persist-credentials: false
46+
4247
- name: Install gh-actions-lock extension
4348
env:
4449
GH_TOKEN: ${{ github.token }}

‎.github/workflows/actions.lock‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,50 +3,45 @@
33
# Docs: https://gh.io/actions-lockfile
44
version: 'v0.0.3'
55
workflows:
6-
'.github/workflows/codeql-upload.yml':
7-
- 'actions/download-artifact@v8.0.2'
8-
- 'github/codeql-action@v4.39.1'
9-
'.github/workflows/cron-release.yml':
6+
'.github/workflows/_build.yml':
107
- 'actions/checkout@v7.0.1'
118
- 'actions/setup-node@v7.1.0'
12-
- 'actions/setup-python@v7.1.0'
13-
'.github/workflows/cypress.yml':
14-
- 'actions/cache@v6.1.0'
15-
- 'actions/checkout@v7.0.1'
16-
- 'actions/setup-node@v7.1.0'
17-
- 'actions/setup-python@v7.1.0'
18-
- 'actions/upload-artifact@v7.0.2'
19-
'.github/workflows/pull-request.yml':
20-
- 'actions/checkout@v7.0.1'
21-
'.github/workflows/reusable-build.yml':
22-
- 'actions/checkout@v7.0.1'
23-
- 'actions/setup-node@v7.1.0'
24-
'.github/workflows/reusable-dependency-review.yml':
9+
'.github/workflows/_dependency-review.yml':
2510
- 'actions/checkout@v7.0.1'
2611
- 'actions/dependency-review-action@v5.0.0'
27-
'.github/workflows/reusable-lint.yml':
12+
'.github/workflows/_lint.yml':
2813
- 'actions/checkout@v7.0.1'
2914
- 'actions/setup-node@v7.1.0'
3015
- 'actions/setup-python@v7.1.0'
31-
'.github/workflows/reusable-sast.yml':
16+
'.github/workflows/_security-scans.yml':
3217
- 'actions/checkout@v7.0.1'
3318
- 'actions/setup-node@v7.1.0'
3419
- 'actions/upload-artifact@v7.0.2'
3520
- 'github/codeql-action@v4.39.1'
36-
'.github/workflows/reusable-sca.yml':
37-
- 'actions/checkout@v7.0.1'
38-
- 'actions/upload-artifact@v7.0.2'
39-
- 'google/osv-scanner-action@v2.7.0'
40-
'.github/workflows/reusable-secrets-scan.yml':
41-
- 'actions/checkout@v7.0.1'
4221
- 'gitleaks/gitleaks-action@v3.0.0'
43-
'.github/workflows/reusable-test.yml':
22+
- 'google/osv-scanner-action@v2.7.0'
23+
'.github/workflows/_test.yml':
4424
- 'actions/checkout@v7.0.1'
4525
- 'actions/setup-node@v7.1.0'
46-
'.github/workflows/reusable-workflow-lint.yml':
26+
'.github/workflows/_workflow-lint.yml':
4727
- 'actions/checkout@v7.0.1'
4828
- 'actions/upload-artifact@v7.0.2'
4929
- 'astral-sh/setup-uv@v10.3.3'
30+
'.github/workflows/cron-release.yml':
31+
- 'actions/checkout@v7.0.1'
32+
- 'actions/setup-node@v7.1.0'
33+
- 'actions/setup-python@v7.1.0'
34+
'.github/workflows/cypress.yml':
35+
- 'actions/cache@v6.1.0'
36+
- 'actions/checkout@v7.0.1'
37+
- 'actions/setup-node@v7.1.0'
38+
- 'actions/setup-python@v7.1.0'
39+
- 'actions/upload-artifact@v7.0.2'
40+
'.github/workflows/pull-request.yml':
41+
- 'actions/checkout@v7.0.1'
42+
'.github/workflows/sarif-upload.yml':
43+
- 'actions/download-artifact@v8.0.2'
44+
- 'github/codeql-action@v4.39.1'
5045
'.github/workflows/stale.yml':
5146
- 'actions/stale@v11.0.0'
5247
dependencies:

‎.github/workflows/cron-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
permissions:
1414
contents: write
1515
steps:
16-
- name: 'Checkout pulp-ui (main)'
16+
- name: Checkout pulp-ui (${{ github.ref }})
1717
uses: actions/checkout@v7.0.1
1818
with:
1919
ref: 'main'

0 commit comments

Comments
 (0)