build(deps-dev): bump jsdom from 20.0.0 to 30.0.0 #1851
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Test | |
| # The event triggers are configured as following: | |
| # - on `2.x` -> trigger the workflow on every push | |
| # - on any pull request -> trigger the workflow | |
| # This is to avoid running the workflow twice on pull requests. | |
| on: | |
| push: | |
| branches: | |
| - 2.x | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| install: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| node-version: [16.x, 17.x, 18.x, 19.x, 20.x, 21.x] | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Install xvfb | |
| # Inline replacement for GabrielBB/xvfb-action (unmaintained since 2022). | |
| # The action did the same thing this two-line install does, plus a | |
| # JavaScript wrapper around xvfb-run. Inlining removes a third-party | |
| # action dependency from the CI supply chain. | |
| run: sudo apt-get update && sudo apt-get install -y xvfb | |
| - name: Install Dependencies | |
| # --ignore-scripts skips preinstall/install/postinstall scripts from | |
| # all packages. Reduces the attack surface for malicious npm deps | |
| # that try to read secrets from the runner env during install. | |
| # Matches the pattern used by main's slsa-provenance.yml. | |
| run: npm ci --ignore-scripts | |
| - name: Build | |
| run: npm run build | |
| - name: Lint | |
| run: npm run lint | |
| - name: Test | |
| # xvfb-run -a allocates a fresh display number, runs the command | |
| # against it, and tears down. Functionally equivalent to what the | |
| # old xvfb-action did, but without the third-party action. | |
| run: xvfb-run -a npm run test:ci | |
| env: | |
| TEST_BROWSERSTACK: ${{ startsWith(matrix.node-version, '21') }} | |
| TEST_PROBE_ONLY: ${{ github.ref != 'refs/heads/2.x' }} | |
| # BrowserStack credentials are injected ONLY for the Node 21 matrix | |
| # entry, which is the only entry where TEST_BROWSERSTACK is true. | |
| # For other matrix entries the values resolve to empty strings, | |
| # so a malicious dependency installed during Node 16-20 jobs | |
| # cannot read BrowserStack credentials from env even if the | |
| # --ignore-scripts defense above fails for some reason. | |
| BS_USERNAME: ${{ startsWith(matrix.node-version, '21') && secrets.BS_USERNAME || '' }} | |
| BS_ACCESSKEY: ${{ startsWith(matrix.node-version, '21') && secrets.BS_ACCESSKEY || '' }} |