From c227ff6b3731a612a9902c732b2e1e7b4ed45e1d Mon Sep 17 00:00:00 2001 From: JaredScar Date: Thu, 5 Mar 2026 13:12:08 -0500 Subject: [PATCH 1/2] Add GitHub workflows for auditing and building PRs - Introduced `audit.yml` to run npm audit on main, rc, and hotfix-rc branches. - Added `build-pr.yml` to perform Webpack build checks on pull requests affecting specific paths. - Updated `build.yml` to replace `npm install` with `npm ci` for consistency in dependency management and added HUSKY environment variable. --- .github/workflows/audit.yml | 56 ++++++++++++++++++++++++++++++++ .github/workflows/build-pr.yml | 58 ++++++++++++++++++++++++++++++++++ .github/workflows/build.yml | 9 ++++-- 3 files changed, 120 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/audit.yml create mode 100644 .github/workflows/build-pr.yml diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 000000000..4b398d2ad --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,56 @@ +name: Audit + +on: + workflow_dispatch: + push: + branches: + - "main" + - "rc" + - "hotfix-rc" + pull_request: + +permissions: + contents: read + +jobs: + + audit: + name: Run npm audit + if: ${{ startsWith(github.head_ref, 'version_bump_') == false }} + runs-on: ubuntu-24.04 + env: + HUSKY: 0 + + steps: + - name: Check out repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Get Node version + id: retrieve-node-version + run: | + NODE_NVMRC=$(cat .nvmrc) + NODE_VERSION=${NODE_NVMRC/v/''} + echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT" + + - name: Set up Node + uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + with: + cache: 'npm' + cache-dependency-path: '**/package-lock.json' + node-version: ${{ steps.retrieve-node-version.outputs.node_version }} + + - name: Install Node dependencies + run: npm ci + + - name: Audit root package + run: npm audit --audit-level=high + + - name: Install src-cli Node dependencies + run: npm ci + working-directory: src-cli + + - name: Audit src-cli package + run: npm audit --audit-level=high + working-directory: src-cli diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml new file mode 100644 index 000000000..205d62cbf --- /dev/null +++ b/.github/workflows/build-pr.yml @@ -0,0 +1,58 @@ +name: Build PR + +on: + workflow_dispatch: + pull_request: + paths: + - 'src/**' + - 'src-cli/**' + - 'jslib/**' + - 'resources/**' + - 'scripts/**' + - 'package.json' + - 'package-lock.json' + - 'tsconfig.json' + - 'angular.json' + - '.github/workflows/build-pr.yml' + - '!*.md' + - '!*.txt' + +permissions: + contents: read + +jobs: + + build: + name: Webpack build check + if: ${{ startsWith(github.head_ref, 'version_bump_') == false }} + runs-on: ubuntu-24.04 + env: + HUSKY: 0 + + steps: + - name: Check out repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Get Node version + id: retrieve-node-version + run: | + NODE_NVMRC=$(cat .nvmrc) + NODE_VERSION=${NODE_NVMRC/v/''} + echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT" + + - name: Setup Node Environment + uses: ./.github/actions/setup-node-env + with: + node-version: ${{ steps.retrieve-node-version.outputs.node_version }} + platform: Linux + + - name: Install Node dependencies + run: npm ci + + - name: Build main and renderer + run: npm run build + + - name: Build CLI + run: npm run build:cli diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e5110ac0e..c718cd490 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -55,6 +55,7 @@ jobs: env: _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }} _NODE_VERSION: ${{ needs.setup.outputs.node_version }} + HUSKY: 0 permissions: contents: read steps: @@ -83,7 +84,7 @@ jobs: tar -xvf "./keytar/linux/$keytarTarGz" -C ./keytar/linux - name: Install - run: npm install + run: npm ci - name: Package CLI run: npm run dist:cli:lin @@ -130,6 +131,7 @@ jobs: env: _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }} _NODE_VERSION: ${{ needs.setup.outputs.node_version }} + HUSKY: 0 steps: - name: Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -156,7 +158,7 @@ jobs: tar -xvf "./keytar/macos/$keytarTarGz" -C ./keytar/macos - name: Install - run: npm install + run: npm ci - name: Package CLI run: npm run dist:cli:mac @@ -196,6 +198,7 @@ jobs: env: _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }} _NODE_VERSION: ${{ needs.setup.outputs.node_version }} + HUSKY: 0 steps: - name: Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -229,7 +232,7 @@ jobs: 7z e "./keytar/windows/$($keytarTar -f "win32")" -o"./keytar/windows" - name: Install - run: npm install + run: npm ci - name: Package CLI run: npm run dist:cli:win From 565581ebdd85395ccf6b373dd65e153dd3cd79e2 Mon Sep 17 00:00:00 2001 From: JaredScar Date: Wed, 11 Mar 2026 13:17:22 -0400 Subject: [PATCH 2/2] chore: update build workflow to use npm ci for consistent dependency installation --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c718cd490..19013f7b9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -295,7 +295,7 @@ jobs: run: dotnet tool install --global AzureSignTool --version 4.0.1 - name: Install Node dependencies - run: npm install + run: npm ci - name: Log in to Azure uses: bitwarden/gh-actions/azure-login@main @@ -388,7 +388,7 @@ jobs: sudo apt-get -y install rpm - name: NPM Install - run: npm install + run: npm ci - name: NPM Rebuild run: npm run rebuild @@ -495,7 +495,7 @@ jobs: security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain - name: Install Node dependencies - run: npm install + run: npm ci - name: Set up private auth key env: