gsadmin/meet
1
0
Fork 0
mirror of https://github.com/suitenumerique/meet.git synced 2026-09-01 13:17:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

🔒️(ci) harden the remaining fetches in the workflow

Browse Source 
gitlint-core keeps the linter at 0.19.1, which the wheels-only pin was
resolving down to 0.18.0 through an sdist-only sh. --ignore-scripts
stops three npm ci, one yarn install and one npm install -g running
the scripts of what they fetch, and yarn is pinned to 1.22.22. curl
holds the dockerize download and its redirects to https.
This commit is contained in:
davd-gzl
2026-08-15 14:52:26 +00:00
committed by aleb_the_flash
parent 9e2383a341
commit a24100aceb
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/meet.yml
+9 -7
View File
@@ -33,7 +33,7 @@ jobs:
! git log | grep 'fixup!' ! git log | grep 'fixup!'
- name: Install gitlint - name: Install gitlint
if: always() if: always()
run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint==0.18.0" run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint-core==0.19.1"
- name: Lint commit messages added to main - name: Lint commit messages added to main
if: always() if: always()
run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
@@ -93,11 +93,11 @@ jobs:
- name: Install yarn - name: Install yarn
if: steps.mail-templates.outputs.cache-hit != 'true' if: steps.mail-templates.outputs.cache-hit != 'true'
run: npm install -g yarn run: npm install -g --ignore-scripts yarn@1.22.22
- name: Install node dependencies - name: Install node dependencies
if: steps.mail-templates.outputs.cache-hit != 'true' if: steps.mail-templates.outputs.cache-hit != 'true'
run: yarn install --frozen-lockfile run: yarn install --frozen-lockfile --ignore-scripts
- name: Build mails - name: Build mails
if: steps.mail-templates.outputs.cache-hit != 'true' if: steps.mail-templates.outputs.cache-hit != 'true'
@@ -262,7 +262,9 @@ jobs:
# Tool to wait for a service to be ready # Tool to wait for a service to be ready
- name: Install Dockerize - name: Install Dockerize
run: | run: |
curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
sudo tar -C /usr/local/bin -xzv
- name: Wait for MinIO to be ready - name: Wait for MinIO to be ready
run: | run: |
@@ -348,7 +350,7 @@ jobs:
uses: actions/checkout@v6 uses: actions/checkout@v6
- name: Install dependencies - name: Install dependencies
run: cd src/frontend/ && npm ci run: cd src/frontend/ && npm ci --ignore-scripts
- name: Check linting - name: Check linting
run: cd src/frontend/ && npm run lint run: cd src/frontend/ && npm run lint
@@ -368,7 +370,7 @@ jobs:
uses: actions/checkout@v6 uses: actions/checkout@v6
- name: Install dependencies - name: Install dependencies
run: npm ci run: npm ci --ignore-scripts
- name: Check linting - name: Check linting
run: npm run lint run: npm run lint
@@ -389,7 +391,7 @@ jobs:
uses: actions/checkout@v6 uses: actions/checkout@v6
- name: Install dependencies - name: Install dependencies
run: npm ci run: npm ci --ignore-scripts
- name: Build SDK - name: Build SDK
run: npm run build run: npm run build