fix(security): store the Etherpad API key as sensitive app config (#105) #52
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 Etherpad contributors | |
| # SPDX-License-Identifier: AGPL-3.0-or-later | |
| # | |
| # Modeled on https://github.com/nextcloud/notes/blob/main/.github/workflows/node.yml | |
| # Runs vitest plus a production build to catch regressions in the frontend bundle. | |
| name: Node | |
| on: pull_request | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: node-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| src: ${{ steps.changes.outputs.src }} | |
| steps: | |
| - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: changes | |
| continue-on-error: true | |
| with: | |
| filters: | | |
| src: | |
| - '.github/workflows/node.yml' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'vite.config.*' | |
| - 'vitest.config.*' | |
| - 'src/**' | |
| - 'js/**' | |
| - 'tests/js/**' | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.src != 'false' | |
| name: npm build + vitest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Read package.json node and npm engines | |
| id: versions | |
| uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 | |
| with: | |
| fallbackNode: '^20' | |
| fallbackNpm: '^10' | |
| - name: Set up node ${{ steps.versions.outputs.nodeVersion }} | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ steps.versions.outputs.nodeVersion }} | |
| cache: npm | |
| - name: Set up npm ${{ steps.versions.outputs.npmVersion }} | |
| run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run vitest | |
| run: npm test | |
| - name: Production build | |
| run: npm run build | |
| - name: Fail if built assets are stale | |
| # The committed js/ bundles must match a fresh build of src/. | |
| # Use `git status --porcelain` (not `git diff`) so a brand-new, | |
| # still-untracked chunk/entry point also fails the check. | |
| # If this fails, run `npm run build` locally and commit js/. | |
| run: | | |
| changes="$(git status --porcelain -- js/)" | |
| if [ -n "$changes" ]; then | |
| echo "Built js/ assets are out of date with src/. Run 'npm run build' and commit js/:" >&2 | |
| echo "$changes" >&2 | |
| exit 1 | |
| fi |