Skip to content

Commit 2a42888

Browse files
soumeh01soumeh01
committed
Addressing pinned dependencies,control permissions
1 parent a7f78c2 commit 2a42888

File tree

7 files changed

+286
-211
lines changed

7 files changed

+286
-211
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 190 additions & 168 deletions
Original file line numberDiff line numberDiff line change
@@ -1,168 +1,190 @@
1-
name: CI
2-
3-
on:
4-
push:
5-
branches:
6-
- main
7-
pull_request:
8-
branches:
9-
- main
10-
workflow_dispatch:
11-
merge_group:
12-
release:
13-
types: [published]
14-
15-
jobs:
16-
build:
17-
name: Build and test
18-
runs-on: [ubuntu-latest]
19-
steps:
20-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21-
with:
22-
fetch-depth: 0
23-
submodules: true
24-
25-
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
26-
with:
27-
node-version-file: package.json
28-
registry-url: https://npm.pkg.github.com
29-
always-auth: true
30-
cache: 'yarn'
31-
32-
- name: Set version
33-
if: github.repository_owner == 'Open-CMSIS-Pack'
34-
run: |
35-
case ${{ github.event_name }} in
36-
release)
37-
TAG="${{ github.event.release.tag_name }}"
38-
yarn version --no-git-tag-version --new-version "${TAG#v}"
39-
;;
40-
pull_request)
41-
DESCRIBE=$(git describe --tags | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+')
42-
QUALIFIER=$(git describe --tags | grep -Eo '\-g[0-9a-f]+$')
43-
yarn version -s --no-git-tag-version --new-version "${DESCRIBE#v}"
44-
yarn version --no-git-tag-version --prepatch --preid "pr${{ github.event.number }}${QUALIFIER}"
45-
;;
46-
*)
47-
DESCRIBE=$(git describe --tags | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+')
48-
QUALIFIER=$(git describe --tags | grep -Eo '[0-9]+\-g[0-9a-f]+$')
49-
yarn version -s --no-git-tag-version --new-version "${DESCRIBE#v}"
50-
yarn version --no-git-tag-version --prepatch --preid "${{ github.ref_name }}${QUALIFIER}"
51-
;;
52-
esac
53-
VERSION="$(jq -r ".version" < package.json)"
54-
sed -i "s/## Unreleased/## ${VERSION}/" CHANGELOG.md
55-
echo "Version is ${VERSION}"
56-
57-
- name: Remove Badges for dist
58-
run: |
59-
sed -i "/https:\/\/codeclimate\.com\/github\/Open\-CMSIS\-Pack\/vscode\-cmsis\-debugger/d" README.md
60-
sed -i "/https:\/\/securityscorecards\.dev\/viewer/d" README.md
61-
62-
- name: Build
63-
env:
64-
GITHUB_TOKEN: ${{github.token}}
65-
run: yarn --frozen-lockfile --prefer-offline
66-
67-
- name: Test
68-
run: yarn test
69-
70-
- name: Upload dist
71-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
72-
with:
73-
name: dist
74-
path: |
75-
./README.md
76-
./CHANGELOG.md
77-
./package.json
78-
./dist
79-
retention-days: 1
80-
81-
- name: Commit changelog
82-
if: false && github.event_name == 'release'
83-
run: |
84-
sed -i '3i ## Unreleased\n' CHANGELOG.md
85-
git checkout main
86-
git config user.name github-actions
87-
git config user.email [email protected]
88-
git add CHANGELOG.md
89-
git commit -m "Update CHANGELOG.md after release [skip ci]"
90-
git push
91-
92-
- name: Publish coverage report to Code Climate
93-
if: github.repository_owner == 'Open-CMSIS-Pack'
94-
uses: paambaati/codeclimate-action@f429536ee076d758a24705203199548125a28ca7 # v9.0.0
95-
env:
96-
CC_TEST_REPORTER_ID: ${{secrets.CC_TEST_REPORTER_ID}}
97-
with:
98-
debug: true
99-
coverageLocations: coverage/lcov.info:lcov
100-
101-
package:
102-
name: Package
103-
runs-on: [ubuntu-latest]
104-
needs: build
105-
strategy:
106-
fail-fast: true
107-
matrix:
108-
target:
109-
- win32-x64
110-
- linux-x64
111-
- linux-arm64
112-
- darwin-arm64
113-
steps:
114-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
115-
116-
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
117-
with:
118-
node-version-file: package.json
119-
registry-url: https://npm.pkg.github.com
120-
always-auth: true
121-
cache: 'yarn'
122-
123-
- name: Download dist
124-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
125-
with:
126-
name: dist
127-
path: .
128-
129-
- name: Cache tools
130-
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.6
131-
with:
132-
path: tools
133-
key: tools-${{ matrix.target }}-${{ github.head_ref || github.ref_name }}
134-
restore-keys: |
135-
tools-${{ matrix.target }}-${{ github.base_ref || 'main' }}
136-
tools-${{ matrix.target }}-
137-
138-
- name: Download tools
139-
run: |
140-
yarn --frozen-lockfile --ignore-scripts --prefer-offline
141-
yarn download-tools --target ${{ matrix.target }} --no-cache
142-
143-
- name: Create vsix package (pre-release)
144-
run: |
145-
yarn package --target ${{ matrix.target }} --pre-release
146-
147-
- name: Upload package
148-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
149-
with:
150-
name: vsix-package-${{ matrix.target }}
151-
path: ./*.vsix
152-
retention-days: 1
153-
154-
publish:
155-
name: Publish release
156-
runs-on: [ubuntu-latest]
157-
if: github.event_name == 'release'
158-
needs: package
159-
steps:
160-
- name: Download packages
161-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
162-
with:
163-
pattern: vsix-package-*
164-
165-
- name: Attach packages
166-
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
167-
with:
168-
files: "**/*.vsix"
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_dispatch:
11+
merge_group:
12+
release:
13+
types: [published]
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
permissions:
20+
contents: read
21+
22+
jobs:
23+
build:
24+
name: Build and test
25+
runs-on: [ubuntu-latest]
26+
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
29+
with:
30+
egress-policy: audit
31+
32+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
fetch-depth: 0
35+
submodules: true
36+
37+
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
38+
with:
39+
node-version-file: package.json
40+
registry-url: https://npm.pkg.github.com
41+
always-auth: true
42+
cache: 'yarn'
43+
44+
- name: Set version
45+
if: github.repository_owner == 'Open-CMSIS-Pack'
46+
run: |
47+
case ${{ github.event_name }} in
48+
release)
49+
TAG="${{ github.event.release.tag_name }}"
50+
yarn version --no-git-tag-version --new-version "${TAG#v}"
51+
;;
52+
pull_request)
53+
DESCRIBE=$(git describe --tags | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+')
54+
QUALIFIER=$(git describe --tags | grep -Eo '\-g[0-9a-f]+$')
55+
yarn version -s --no-git-tag-version --new-version "${DESCRIBE#v}"
56+
yarn version --no-git-tag-version --prepatch --preid "pr${{ github.event.number }}${QUALIFIER}"
57+
;;
58+
*)
59+
DESCRIBE=$(git describe --tags | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+')
60+
QUALIFIER=$(git describe --tags | grep -Eo '[0-9]+\-g[0-9a-f]+$')
61+
yarn version -s --no-git-tag-version --new-version "${DESCRIBE#v}"
62+
yarn version --no-git-tag-version --prepatch --preid "${{ github.ref_name }}${QUALIFIER}"
63+
;;
64+
esac
65+
VERSION="$(jq -r ".version" < package.json)"
66+
sed -i "s/## Unreleased/## ${VERSION}/" CHANGELOG.md
67+
echo "Version is ${VERSION}"
68+
69+
- name: Remove Badges for dist
70+
run: |
71+
sed -i "/https:\/\/codeclimate\.com\/github\/Open\-CMSIS\-Pack\/vscode\-cmsis\-debugger/d" README.md
72+
sed -i "/https:\/\/securityscorecards\.dev\/viewer/d" README.md
73+
74+
- name: Build
75+
env:
76+
GITHUB_TOKEN: ${{github.token}}
77+
run: yarn --frozen-lockfile --prefer-offline
78+
79+
- name: Test
80+
run: yarn test
81+
82+
- name: Upload dist
83+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
84+
with:
85+
name: dist
86+
path: |
87+
./README.md
88+
./CHANGELOG.md
89+
./package.json
90+
./dist
91+
retention-days: 1
92+
93+
- name: Commit changelog
94+
if: false && github.event_name == 'release'
95+
run: |
96+
sed -i '3i ## Unreleased\n' CHANGELOG.md
97+
git checkout main
98+
git config user.name github-actions
99+
git config user.email [email protected]
100+
git add CHANGELOG.md
101+
git commit -m "Update CHANGELOG.md after release [skip ci]"
102+
git push
103+
104+
- name: Publish coverage report to Code Climate
105+
if: github.repository_owner == 'Open-CMSIS-Pack'
106+
uses: paambaati/codeclimate-action@f429536ee076d758a24705203199548125a28ca7 # v9.0.0
107+
env:
108+
CC_TEST_REPORTER_ID: ${{secrets.CC_TEST_REPORTER_ID}}
109+
with:
110+
debug: true
111+
coverageLocations: coverage/lcov.info:lcov
112+
113+
package:
114+
name: Package
115+
runs-on: [ubuntu-latest]
116+
needs: build
117+
strategy:
118+
fail-fast: true
119+
matrix:
120+
target:
121+
- win32-x64
122+
- linux-x64
123+
- linux-arm64
124+
- darwin-arm64
125+
steps:
126+
- name: Harden the runner (Audit all outbound calls)
127+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
128+
with:
129+
egress-policy: audit
130+
131+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
132+
133+
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
134+
with:
135+
node-version-file: package.json
136+
registry-url: https://npm.pkg.github.com
137+
always-auth: true
138+
cache: 'yarn'
139+
140+
- name: Download dist
141+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
142+
with:
143+
name: dist
144+
path: .
145+
146+
- name: Cache tools
147+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.6
148+
with:
149+
path: tools
150+
key: tools-${{ matrix.target }}-${{ github.head_ref || github.ref_name }}
151+
restore-keys: |
152+
tools-${{ matrix.target }}-${{ github.base_ref || 'main' }}
153+
tools-${{ matrix.target }}-
154+
155+
- name: Download tools
156+
run: |
157+
yarn --frozen-lockfile --ignore-scripts --prefer-offline
158+
yarn download-tools --target ${{ matrix.target }} --no-cache
159+
160+
- name: Create vsix package (pre-release)
161+
run: |
162+
yarn package --target ${{ matrix.target }} --pre-release
163+
164+
- name: Upload package
165+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
166+
with:
167+
name: vsix-package-${{ matrix.target }}
168+
path: ./*.vsix
169+
retention-days: 1
170+
171+
publish:
172+
name: Publish release
173+
runs-on: [ubuntu-latest]
174+
if: github.event_name == 'release'
175+
needs: package
176+
steps:
177+
- name: Harden the runner (Audit all outbound calls)
178+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
179+
with:
180+
egress-policy: audit
181+
182+
- name: Download packages
183+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
184+
with:
185+
pattern: vsix-package-*
186+
187+
- name: Attach packages
188+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
189+
with:
190+
files: "**/*.vsix"

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@ jobs:
2424
runs-on: ubuntu-latest
2525

2626
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
29+
with:
30+
egress-policy: audit
31+
2732
- name: Checkout
2833
id: checkout
2934
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

‎.github/workflows/dependency-review.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: 'Dependency Review'
2+
on: [pull_request]
3+
4+
permissions:
5+
contents: read
6+
7+
jobs:
8+
dependency-review:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Harden the runner (Audit all outbound calls)
12+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
13+
with:
14+
egress-policy: audit
15+
16+
- name: 'Checkout Repository'
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
- name: 'Dependency Review'
19+
uses: actions/dependency-review-action@38ecb5b593bf0eb19e335c03f97670f792489a8b # v4.7.0

0 commit comments

Comments
 (0)