security: bump brace-expansion to 1.1.16 (high, ReDoS) (#383) #936
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| - run: npm ci | |
| - name: Run tests | |
| run: npm test | |
| - name: Validate repo consistency | |
| run: npm run validate | |
| - name: Validate agent templates | |
| run: node scripts/expand-templates.js --check | |
| - name: Validate adapter freshness | |
| run: node scripts/gen-adapters.js --check | |
| agnix: | |
| # SHA pin to agent-sh/.github main. Update by running: | |
| # gh api repos/agent-sh/.github/commits/main --jq .sha | |
| uses: agent-sh/.github/.github/workflows/ci-agnix.yml@2b48d4f12079b30046991f59f25853e34b18ed7c # main |