Skip to content

Commit 9797370

Browse files
cure53cure53
authored
chore: added new workflow files for a first test (#1308)
* chore: added new workflow files for a first test * chore: adjusted the build-and-test workflow slightly * chore: added a build-and-test-skip workflow to save on time and CPU
1 parent f009195 commit 9797370

7 files changed

Lines changed: 195 additions & 27 deletions

File tree

‎.github/workflows/build-and-test-skip.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Build & Test
2+
3+
# Companion workflow for build-and-test.yml.
4+
#
5+
# Background: GitHub's required-status-check system leaves PRs stuck in
6+
# "Waiting for status to be reported" when the workflow that would provide
7+
# the check is skipped via paths-ignore. GitHub's own documented workaround
8+
# is to define a twin workflow with the SAME workflow name and SAME job
9+
# names, gated on the INVERSE path filter, that does nothing but succeed.
10+
#
11+
# https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
12+
#
13+
# RULES FOR EDITING THIS FILE:
14+
#
15+
# 1. The top-level `name:` must match build-and-test.yml exactly. GitHub
16+
# identifies required checks by (workflow name, job name) tuple.
17+
#
18+
# 2. The `install` job's matrix and name must produce the SAME check
19+
# names as build-and-test.yml: "install (20.x)", "install (22.x)",
20+
# "install (24.x)", "install (25.x)".
21+
#
22+
# 3. The `paths` list below must be the INVERSE of the `paths-ignore`
23+
# list in build-and-test.yml. If you exclude a path there, include it
24+
# here (and vice versa). Mismatched lists = the real tests are
25+
# skipped AND this passthrough doesn't fire = PR hangs.
26+
#
27+
# 4. Every job is a no-op that exits 0. Do NOT add real work here - this
28+
# file exists purely to satisfy the required-check machinery.
29+
30+
on:
31+
pull_request:
32+
paths:
33+
- '**/*.md'
34+
- 'demos/**'
35+
- 'website/**'
36+
- 'LICENSE'
37+
- '.gitattributes'
38+
- '.editorconfig'
39+
- '.prettierignore'
40+
- '.prettierrc'
41+
- '.nvmrc'
42+
- '.gitignore'
43+
- '.husky/**'
44+
- '.pre-commit-config.yaml'
45+
- 'osv-scanner.toml'
46+
- '.github/ISSUE_TEMPLATE.md'
47+
- '.github/PULL_REQUEST_TEMPLATE.md'
48+
- '.github/FUNDING.yml'
49+
- '.github/dependabot.yml'
50+
- '.github/workflows/codeql-analysis.yml'
51+
- '.github/workflows/dependency-review.yml'
52+
- '.github/workflows/fuzz.yml'
53+
- '.github/workflows/scorecard.yml'
54+
- '.github/workflows/sign-release.yml'
55+
- '.github/workflows/slsa-provenance.yml'
56+
57+
permissions:
58+
contents: read
59+
60+
jobs:
61+
install:
62+
runs-on: ubuntu-latest
63+
strategy:
64+
matrix:
65+
node-version: [20.x, 22.x, 24.x, 25.x]
66+
steps:
67+
- name: No-op (docs-only change, real tests skipped)
68+
run: |
69+
echo "Skipping build & test - change only touched documentation or"
70+
echo "metadata files (see paths-ignore in build-and-test.yml)."
71+
echo "Reporting success so the required status check doesn't hang."

‎.github/workflows/build-and-test.yml‎

Lines changed: 70 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,71 @@ on:
66
- main
77
- 3.x
88
- 2.x
9+
# Skip on docs-only / metadata-only pushes. Keep this list in SYNC with
10+
# build-and-test-skip.yml - that companion workflow reports success for
11+
# the same required-check names when this one is skipped, otherwise PRs
12+
# that only touch docs would hang forever on "Waiting for status to be
13+
# reported" (GitHub's well-known paths-filter + required-check gotcha).
14+
paths-ignore:
15+
- '**/*.md'
16+
- 'demos/**'
17+
- 'website/**'
18+
- 'LICENSE'
19+
- '.gitattributes'
20+
- '.editorconfig'
21+
- '.prettierignore'
22+
- '.prettierrc'
23+
- '.nvmrc'
24+
- '.gitignore'
25+
- '.husky/**'
26+
- '.pre-commit-config.yaml'
27+
- 'osv-scanner.toml'
28+
- '.github/ISSUE_TEMPLATE.md'
29+
- '.github/PULL_REQUEST_TEMPLATE.md'
30+
- '.github/FUNDING.yml'
31+
- '.github/dependabot.yml'
32+
- '.github/workflows/codeql-analysis.yml'
33+
- '.github/workflows/dependency-review.yml'
34+
- '.github/workflows/fuzz.yml'
35+
- '.github/workflows/scorecard.yml'
36+
- '.github/workflows/sign-release.yml'
37+
- '.github/workflows/slsa-provenance.yml'
938
pull_request:
39+
paths-ignore:
40+
- '**/*.md'
41+
- 'demos/**'
42+
- 'website/**'
43+
- 'LICENSE'
44+
- '.gitattributes'
45+
- '.editorconfig'
46+
- '.prettierignore'
47+
- '.prettierrc'
48+
- '.nvmrc'
49+
- '.gitignore'
50+
- '.husky/**'
51+
- '.pre-commit-config.yaml'
52+
- 'osv-scanner.toml'
53+
- '.github/ISSUE_TEMPLATE.md'
54+
- '.github/PULL_REQUEST_TEMPLATE.md'
55+
- '.github/FUNDING.yml'
56+
- '.github/dependabot.yml'
57+
- '.github/workflows/codeql-analysis.yml'
58+
- '.github/workflows/dependency-review.yml'
59+
- '.github/workflows/fuzz.yml'
60+
- '.github/workflows/scorecard.yml'
61+
- '.github/workflows/sign-release.yml'
62+
- '.github/workflows/slsa-provenance.yml'
1063

1164
permissions:
1265
contents: read
1366

67+
# Cancel superseded runs on the same PR to save minutes on rapid pushes.
68+
# Pushes to protected branches are NOT cancelled - we want full CI history
69+
# for every merged commit.
70+
concurrency:
71+
group: build-test-${{ github.workflow }}-${{ github.ref }}
72+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
73+
1474
jobs:
1575
# Fast feedback: lint, jsdom, chromium-only browser test across Node versions.
1676
# Runs on every push and every PR.
@@ -29,6 +89,8 @@ jobs:
2989

3090
- name: Checkout
3191
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
92+
with:
93+
persist-credentials: false
3294

3395
- name: Setup Node.js ${{ matrix.node-version }}
3496
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -39,6 +101,10 @@ jobs:
39101
- name: Install Dependencies
40102
run: npm ci
41103

104+
# All three engines - test:ci runs the full browser matrix (no
105+
# --project flag, unlike local `npm test`). DOMPurify's security
106+
# posture depends on per-engine HTML parser behaviour being exercised,
107+
# so this coverage is kept on every PR despite the download cost.
42108
- name: Install Playwright Browsers
43109
run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
44110

@@ -53,7 +119,7 @@ jobs:
53119

54120
- name: Upload Playwright report
55121
if: failure()
56-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
122+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
57123
with:
58124
name: playwright-report-node-${{ matrix.node-version }}
59125
path: playwright-report/
@@ -86,6 +152,8 @@ jobs:
86152

87153
- name: Checkout
88154
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
155+
with:
156+
persist-credentials: false
89157

90158
- name: Setup Node.js 25.x
91159
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -112,7 +180,7 @@ jobs:
112180

113181
- name: Upload Playwright report
114182
if: failure()
115-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
183+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
116184
with:
117185
name: playwright-report-${{ matrix.os }}
118186
path: playwright-report/

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,13 @@ name: "CodeQL"
22

33
on:
44
push:
5-
branches: [main]
5+
branches: [main, 3.x, 2.x]
66
pull_request:
7-
# The branches below must be a subset of the branches above
8-
branches: [main]
7+
# Must match 'push' so PRs targeting release branches also get scanned.
8+
# The ruleset requires CodeQL as a status check on main, 3.x, and 2.x;
9+
# without these in pull_request, PRs to 3.x/2.x would wait forever for
10+
# a required check that never fires.
11+
branches: [main, 3.x, 2.x]
912
schedule:
1013
- cron: '0 19 * * 4'
1114

@@ -15,9 +18,9 @@ permissions:
1518
jobs:
1619
analyze:
1720
permissions:
18-
actions: read # for github/codeql-action/init to get workflow details
19-
contents: read # for actions/checkout to fetch code
20-
security-events: write # for github/codeql-action/autobuild to send a status report
21+
actions: read # for github/codeql-action/init to get workflow details
22+
contents: read # for actions/checkout to fetch code
23+
security-events: write # for github/codeql-action/autobuild to send a status report
2124
name: Analyze
2225
runs-on: ubuntu-latest
2326

@@ -39,14 +42,11 @@ jobs:
3942
- name: Checkout repository
4043
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4144
with:
42-
# We must fetch at least the immediate parents so that if this is
43-
# a pull request then we can checkout the head.
44-
fetch-depth: 2
45-
46-
# If this run was triggered by a pull request event, then checkout
47-
# the head of the pull request instead of the merge commit.
48-
- run: git checkout HEAD^2
49-
if: ${{ github.event_name == 'pull_request' }}
45+
persist-credentials: false
46+
# Default fetch-depth is fine. The old 'git checkout HEAD^2' dance
47+
# from legacy CodeQL templates is no longer needed - modern
48+
# codeql-action handles PR head checkout itself, and under this
49+
# repo's linear-history ruleset PRs aren't two-parent merges anyway.
5050

5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,17 @@ jobs:
2323

2424
- name: 'Checkout Repository'
2525
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
with:
27+
persist-credentials: false
2628
- name: 'Dependency Review'
2729
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
30+
with:
31+
# Block PRs that introduce high/critical CVEs. Lower-severity findings
32+
# still surface in the PR comment but don't block merge - consistent
33+
# with the policy documented in osv-scanner.toml, which already
34+
# suppresses dev-tooling CVEs that don't affect the distributed
35+
# runtime.
36+
fail-on-severity: high
37+
# Only post the summary comment when something actually needs
38+
# attention - cuts PR-comment noise on clean dependency bumps.
39+
comment-summary-in-pr: on-failure

‎.github/workflows/scorecard.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,10 @@ jobs:
2121
analysis:
2222
name: Scorecard analysis
2323
runs-on: ubuntu-latest
24-
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
25-
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
24+
# `publish_results: true` only works when run from the default branch.
25+
# (The previous 'pull_request' clause here was dead code - this workflow
26+
# doesn't trigger on pull_request events.)
27+
if: github.event.repository.default_branch == github.ref_name
2628
permissions:
2729
security-events: write
2830
id-token: write

‎.github/workflows/sign-release.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,19 @@ jobs:
1010
sign:
1111
runs-on: ubuntu-latest
1212
permissions:
13-
contents: write
14-
id-token: write
13+
contents: write # to attach .sigstore bundles to the release
14+
id-token: write # OIDC for keyless signing
1515
steps:
16-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
17-
- uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d
16+
- uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
17+
with:
18+
egress-policy: audit
19+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
with:
21+
persist-credentials: false
22+
- uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d # v3.0.1
1823
with:
1924
inputs: dist/purify.min.js dist/purify.js
20-
# uploads .sigstore.json bundles as release assets
25+
# Re-uploads signed artefacts to the release that triggered this run.
26+
# Without this flag, .sigstore bundles are generated but dropped at
27+
# job end - the release page gets nothing.
28+
release-signing-artifacts: true

‎.github/workflows/slsa-provenance.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,17 @@ jobs:
1010
provenance:
1111
runs-on: ubuntu-latest
1212
permissions:
13-
contents: write
14-
id-token: write
13+
contents: write # to attach the attestation bundle to the release
14+
id-token: write # OIDC to mint the signing certificate from Fulcio
15+
attestations: write # required by actions/attest-build-provenance v2.x to
16+
# write the attestation to the GH attestations API
1517
steps:
16-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
17-
- uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2
18+
- uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
19+
with:
20+
egress-policy: audit
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
- uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
1825
with:
1926
subject-path: 'dist/*'

0 commit comments

Comments
 (0)