Skip to content

Commit f4e7dfe

Browse files
forged-requestforged-request
committed
Chore: standardize string quotes in workflow
Chore: standardize string quotes in workflow https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks
1 parent 79daec0 commit f4e7dfe

File tree

3 files changed

+70
-55
lines changed

3 files changed

+70
-55
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,24 @@ on:
44
workflow_call:
55

66
permissions:
7-
contents: read # Checkout code
8-
actions: write # Save caches
7+
contents: read # Checkout code
8+
actions: write # Save caches
99

1010
jobs:
1111
install-build:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- name: 'Echo ref_name'
15-
run: echo ${{ github.ref_name }}
16-
- name: 'Checkout'
14+
- name: "Echo ref_name"
15+
env:
16+
REF_NAME: ${{ github.ref_name }}
17+
run: echo "$REF_NAME"
18+
- name: "Checkout"
1719
uses: actions/checkout@v4
18-
- name: 'Use NodeJS 20'
20+
- name: "Use NodeJS 20"
1921
uses: actions/setup-node@v4
2022
with:
21-
node-version: '20.11'
22-
cache: 'npm'
23+
node-version: "20.11"
24+
cache: "npm"
2325
- name: Restore Cypress Binary
2426
uses: actions/cache/restore@v4
2527
id: restore-cypress
@@ -40,7 +42,7 @@ jobs:
4042
npm run build
4143
- name: List components folder
4244
run: ls -la packages/components
43-
- name: Save Build folders
45+
- name: Save Build folders
4446
uses: actions/cache/save@v4
4547
with:
4648
path: |

‎.github/workflows/publish.yaml‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
workflow_call:
55
inputs:
66
publish-prelease:
7-
description: 'Publish prerelease version of the current ref'
7+
description: "Publish prerelease version of the current ref"
88
default: false
99
required: false
1010
type: boolean
@@ -19,18 +19,18 @@ jobs:
1919
contents: write
2020
id-token: write
2121
steps:
22-
- name: 'Checkout'
22+
- name: "Checkout"
2323
uses: actions/checkout@v4
2424
with:
2525
fetch-depth: 0 # Checkout all branches and tags, needed for publish
26-
- name: 'Use NodeJS 20'
26+
- name: "Use NodeJS 20"
2727
uses: actions/setup-node@v4
2828
with:
29-
node-version: '20.11'
30-
cache: 'npm'
29+
node-version: "20.11"
30+
cache: "npm"
3131
# Retrieve token from Vault and use in .npmrc for installing npm packages from the GitHub registry
3232
# See https://contentful.atlassian.net/wiki/spaces/ENG/pages/4396155213/Migrating+to+GitHub+Packages+from+npmjs?focusedCommentId=4431282518
33-
- name: 'Retrieve NPM Token from Vault'
33+
- name: "Retrieve NPM Token from Vault"
3434
id: vault
3535
uses: hashicorp/[email protected]
3636
with:
@@ -72,31 +72,35 @@ jobs:
7272
- name: Skip Publish if no changes
7373
if: ${{ steps.changed_packages.outputs.CHANGED_PACKAGES == '' }}
7474
run: echo "No changes to packages to publish, skipping publish step"
75-
- name: 'Version and publish'
75+
- name: "Version and publish"
7676
env:
7777
GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}
7878
# GH_TOKEN needed by lerna to create releases on github
7979
GH_TOKEN: ${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}
80+
ACTOR: ${{ github.actor }}
81+
REF_NAME: ${{ github.ref_name }}
82+
PUBLISH_PRERELEASE: ${{ inputs.publish-prelease }}
8083
if: ${{ steps.changed_packages.outputs.CHANGED_PACKAGES != '' }}
8184
run: |
82-
git config user.name "${{ github.actor }}"
83-
git config user.email "${{ github.actor}}@users.noreply.github.com"
85+
git config user.name "$ACTOR"
86+
git config user.email "$ACTOR@users.noreply.github.com"
8487
85-
if [ ${{ inputs.publish-prerelease }} ]; then
86-
npx lerna publish --conventional-commits --conventional-prerelease --exact --force-publish --preid prerelease-$(date +%Y%m%dT%H%M)-$(git rev-parse HEAD | cut -c1-7) --no-changelog --no-push --yes --no-private --dist-tag prerelease --allow-branch ${{ github.ref_name }} --git-tag-command="echo 'skipping git tag for prereleases'"
87-
elif [ ${{ github.ref_name }} = development ]; then
88+
if [ "$PUBLISH_PRERELEASE" = "true" ]; then
89+
npx lerna publish --conventional-commits --conventional-prerelease --exact --force-publish --preid prerelease-$(date +%Y%m%dT%H%M)-$(git rev-parse HEAD | cut -c1-7) --no-changelog --no-push --yes --no-private --dist-tag prerelease --allow-branch "$REF_NAME" --git-tag-command="echo 'skipping git tag for prereleases'"
90+
elif [ "$REF_NAME" = "development" ]; then
8891
npx lerna publish --conventional-commits --conventional-prerelease --exact --force-publish --preid dev-$(date +%Y%m%dT%H%M)-$(git rev-parse HEAD | cut -c1-7) --dist-tag dev --no-changelog --no-push --yes --no-private --git-tag-command="echo 'skipping git tag for prereleases'"
89-
elif [ ${{ github.ref_name }} = next ]; then
92+
elif [ "$REF_NAME" = "next" ]; then
9093
npx lerna publish --conventional-commits --conventional-prerelease --exact --force-publish --preid beta --dist-tag next --no-changelog --yes --no-private --git-tag-command="echo 'skipping git tag for prereleases'"
9194
else
9295
npx lerna publish --conventional-commits --conventional-graduate --exact --force-publish --yes --no-private --dist-tag latest --create-release github
9396
fi
94-
- name: 'Merge changes downstream'
95-
if: ${{ !inputs.publish-prerelease }}
97+
- name: "Merge changes downstream"
98+
if: ${{ !inputs.publish-prelease }}
9699
env:
97100
GH_TOKEN: ${{ secrets.GH_TOKEN }}
101+
REF_NAME: ${{ github.ref_name }}
98102
run: |
99-
if [ ${{ github.ref_name }} = main ]; then
103+
if [ "$REF_NAME" = "main" ]; then
100104
git checkout next
101105
git pull
102106
git rebase main
@@ -105,7 +109,7 @@ jobs:
105109
git pull
106110
git rebase next
107111
git push origin
108-
elif [ ${{ github.ref_name }} = next ]; then
112+
elif [ "$REF_NAME" = "next" ]; then
109113
git checkout development
110114
git pull
111115
git rebase next

‎.github/workflows/vercel.yaml‎

Lines changed: 38 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
workflow_call:
55
inputs:
66
publish-web-apps-to-prod:
7-
description: 'Publish web apps to prod'
7+
description: "Publish web apps to prod"
88
default: false
99
required: false
1010
type: boolean
@@ -21,15 +21,15 @@ jobs:
2121
contents: write
2222
id-token: write
2323
steps:
24-
- name: 'Checkout'
24+
- name: "Checkout"
2525
uses: actions/checkout@v4
2626
with:
2727
fetch-depth: 0 # Checkout all branches and tags, needed for publish
28-
- name: 'Use NodeJS 20'
28+
- name: "Use NodeJS 20"
2929
uses: actions/setup-node@v4
3030
with:
31-
node-version: '20.11'
32-
cache: 'npm'
31+
node-version: "20.11"
32+
cache: "npm"
3333
- name: Install dependencies
3434
run: |
3535
npm ci
@@ -51,48 +51,57 @@ jobs:
5151
# with:
5252
# ## limits ssh access and adds the ssh public key for the user which triggered the workflow
5353
# limit-access-to-actor: true
54-
- name: 'Deploy vite test-app site to Vercel'
54+
- name: "Deploy vite test-app site to Vercel"
5555
env:
5656
# Domain: experience-builder-test-app.colorfuldemo.com
5757
VERCEL_PROJECT_ID: prj_wr3mJgz9qLeHh33UaCFquePsr1hw
5858
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
59+
REF_NAME: ${{ github.ref_name }}
60+
PUBLISH_TO_PROD: ${{ inputs.publish-web-apps-to-prod }}
61+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
5962
run: |
60-
if [ ${{ github.ref_name }} = main ] || [ ${{ inputs.publish-web-apps-to-prod }} = true ]; then
61-
vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
62-
vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
63-
vercel deploy --prod --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
63+
if [ "$REF_NAME" = "main" ] || [ "$PUBLISH_TO_PROD" = "true" ]; then
64+
vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
65+
vercel build --prod --token="$VERCEL_TOKEN"
66+
vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN"
6467
else
65-
vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
66-
vercel build --token=${{ secrets.VERCEL_TOKEN }}
67-
vercel deploy --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
68+
vercel pull --yes --environment=preview --token="$VERCEL_TOKEN"
69+
vercel build --token="$VERCEL_TOKEN"
70+
vercel deploy --prebuilt --token="$VERCEL_TOKEN"
6871
fi
69-
- name: 'Deploy nextjs-marketing-demo site to Vercel'
72+
- name: "Deploy nextjs-marketing-demo site to Vercel"
7073
env:
7174
# Domain: studio-nextjs-marketing-demo.colorfuldemo.com
7275
VERCEL_PROJECT_ID: prj_CQ1K4Pbkx5SQq2Fi9c4ZPHloOv79
7376
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
77+
REF_NAME: ${{ github.ref_name }}
78+
PUBLISH_TO_PROD: ${{ inputs.publish-web-apps-to-prod }}
79+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
7480
run: |
75-
if [ ${{ github.ref_name }} = main ] || [ ${{ inputs.publish-web-apps-to-prod }} = true ]; then
76-
vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
77-
vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
78-
vercel deploy --prod --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
81+
if [ "$REF_NAME" = "main" ] || [ "$PUBLISH_TO_PROD" = "true" ]; then
82+
vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
83+
vercel build --prod --token="$VERCEL_TOKEN"
84+
vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN"
7985
else
80-
vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
81-
vercel build --token=${{ secrets.VERCEL_TOKEN }}
82-
vercel deploy --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
86+
vercel pull --yes --environment=preview --token="$VERCEL_TOKEN"
87+
vercel build --token="$VERCEL_TOKEN"
88+
vercel deploy --prebuilt --token="$VERCEL_TOKEN"
8389
fi
84-
- name: 'Deploy react vite template site to Vercel'
90+
- name: "Deploy react vite template site to Vercel"
8591
env:
8692
# Domain studio-react-vite-template.colorfuldemo.com
8793
VERCEL_PROJECT_ID: prj_HoAvIbgvZ3gYJDLCAaNsHIpBvI0k
8894
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
95+
REF_NAME: ${{ github.ref_name }}
96+
PUBLISH_TO_PROD: ${{ inputs.publish-web-apps-to-prod }}
97+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
8998
run: |
90-
if [ ${{ github.ref_name }} = main ] || [ ${{ inputs.publish-web-apps-to-prod }} = true ]; then
91-
vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
92-
vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
93-
vercel deploy --prod --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
99+
if [ "$REF_NAME" = "main" ] || [ "$PUBLISH_TO_PROD" = "true" ]; then
100+
vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
101+
vercel build --prod --token="$VERCEL_TOKEN"
102+
vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN"
94103
else
95-
vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
96-
vercel build --token=${{ secrets.VERCEL_TOKEN }}
97-
vercel deploy --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
104+
vercel pull --yes --environment=preview --token="$VERCEL_TOKEN"
105+
vercel build --token="$VERCEL_TOKEN"
106+
vercel deploy --prebuilt --token="$VERCEL_TOKEN"
98107
fi

0 commit comments

Comments
 (0)