mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
c1ce13758f
Pin three third-party actions to full commit SHAs with version comments so dependabot can update them in place without exposing the pipeline to upstream tag tampering: - aquasecurity/trivy-action@v0.35.0 - peter-evans/create-pull-request@v8.1.1 - googleapis/release-please-action@v4.4.0 Add a workflow-level permissions: contents: read default to ci.yml, with update-screenshots keeping its explicit contents: write + pull-requests: write override. Add the same default to docker-publish.yml (single job). Expand .dockerignore to explicitly exclude .env*, *.key, *.pem, .github/, docs/, website/, e2e/, tests/, test-results/, and playwright-report/ as defense in depth against accidental build-context leaks. None of these paths are read by any COPY step in Dockerfile.
24 lines
683 B
YAML
24 lines
683 B
YAML
name: Release Please
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
release-please:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
|
|
with:
|
|
# GITHUB_TOKEN cannot trigger other workflows (GitHub security restriction).
|
|
# Using DOCS_REPO_TOKEN (PAT) ensures the tag push from release-please
|
|
# cascades to docker-publish.yml and publishes to Docker Hub.
|
|
token: ${{ secrets.DOCS_REPO_TOKEN }}
|
|
config-file: release-please-config.json
|
|
manifest-file: .release-please-manifest.json
|