chore: address issue 1836 action items by pranitaurlam · Pull Request #1840 · finos/FDC3

pranitaurlam · 2026-04-13T04:27:24Z

Resolves #1826
Resolves #1827

Updates Node test matrix to include Node 22, 24, and 25
Pins GitHub Actions dependencies for better OpenSSF scorecard
Adds a CodeQL workflow
Adds the CodeCov coverage badge to README.md

netlify · 2026-04-13T04:27:29Z

✅ Deploy Preview for fdc3 canceled.

Name	Link
🔨 Latest commit	`824ecb4`
🔍 Latest deploy log	https://app.netlify.com/projects/fdc3/deploys/69dd28715072540008012d31

linux-foundation-easycla · 2026-04-13T04:27:33Z

The committers listed above are authorized under a signed CLA.

✅ login: pranitaurlam / name: urlam pranita (5295638, 824ecb4, 8780f4b, d837395, e8f86a6, f408c80)

pranitaurlam · 2026-04-13T05:17:32Z

/easycla

- Update Node test matrix to [22, 24, 25] in cve-scanning and coverage workflows - Pin GitHub Actions dependencies - Add CodeCov coverage badge to README.md - Add CodeQL workflow for OpenSSF scorecard

pranitaurlam · 2026-04-13T05:28:37Z

/easycla

pranitaurlam · 2026-04-13T05:48:25Z

Hi @kriswest

I've opened this PR to address the remaining action items from the April 8th maintainers meeting (#1836). Specifically, this PR covers:

Updated the Node.js test matrix to include Node 22, 24, and 25 (deprecating Node 20)
Pinned GitHub Actions dependencies to commit SHAs for improved OpenSSF scorecard
Added a CodeQL workflow for OpenSSF scorecard compliance
Added the CodeCov coverage badge to

README.md
The EasyCLA check has now passed. Could you please approve the 4 pending workflows so the CI tests can run? Happy to make any adjustments based on your feedback.

github-advanced-security · 2026-04-13T07:37:13Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

kriswest

Thanks for having a go at this. There are a couple of small adjustments to make + we'll need to figure out why the coverage and CVE scanning jobs are failing.

- Remove '// trigger' comment from webpack.config.js - Pin codeql-action steps to commit SHA - Simplify cve-scanning to use node 22 only (no matrix)

pranitaurlam · 2026-04-13T08:24:59Z

Hi @kriswest, thank you for the feedback! I've addressed all the requested changes:

Removed the // trigger comment from toolbox/fdc3-conformance/webpack.config.js
Pinned all codeql-action steps (init, autobuild, analyze) to their commit SHAs in .github/workflows/codeql.yml
Simplified .github/workflows/cve-scanning.yml to use a single node-version: 22 instead of a matrix

Could you also let me know what's failing in the coverage and CVE scanning jobs so I can help investigate? Happy to make any further adjustments.

kriswest

This looks good to me now - we just need to figure out why the workflows are failing...

kriswest · 2026-04-13T11:34:17Z

@bingenito this PR is handling a couple of the action items you and I were going to look at after the maintainers meeting (CodeQL, dependency pinning etc., node test matrix). However, its failing the coverage and CVE scanning checks on what looks like token permissions issues? Is that something you could take a look at and advise on (as that was the remaining item you'd offered to look at - and probably understand a lot better than I)?

pranitaurlam · 2026-04-13T13:31:29Z

Thanks @kriswest
I’ll investigate the failing workflows (coverage and CVE scanning) and work on fixing them. I’ll push an update once it’s resolved.

codecov-commenter · 2026-04-13T16:59:39Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.68%. Comparing base (c0f0e95) to head (824ecb4).
⚠️ Report is 26 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1840      +/-   ##
==========================================
+ Coverage   95.65%   95.68%   +0.02%     
==========================================
  Files          69       69              
  Lines        4631     4631              
  Branches      714      807      +93     
==========================================
+ Hits         4430     4431       +1     
+ Misses        201      200       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…onfigured

…ctions syntax

bingenito · 2026-04-14T17:27:15Z

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4


These got downgraded. We really should add a dependabot config at least for actions if we don't want to do npm yet. I suspect this older version will also not work with oidc.

bingenito · 2026-04-14T17:28:27Z

    - name: Codecov
-      uses: codecov/codecov-action@v6
-      with:
-        use_oidc: true


We lost this. It has to be sent.

bingenito · 2026-04-14T17:29:21Z

-      uses: codecov/codecov-action@v6
-      with:
-        use_oidc: true
+      uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4


Since we have a build matrix, we will now have an issue that it will upload coverage for each entry of the build matrix overwriting the last. One fix for this is to upload with a to codecov that includes the matrix variable in it.

bingenito · 2026-04-14T17:30:12Z


    permissions:
      contents: read
-      id-token: write


This is required when adding back the oidc which was removed erroneously. It can be put at a lower level, but it has to be here in combination with oidc for codecov upload to work without tokens.

bingenito · 2026-04-14T17:36:04Z

+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
-          node-version: 20
+          node-version: 22


If we change this to 24 (the publishing node version), we can remote the NODE_AUTH_TOKEN from the npm publish env variables and it will use oidc and trusted publishing for free. Trusted publishing requires a new version of npm with node 24.

I'm definitely OK with moving forward to node 24 (and trusted publishing) sooner rather than later.

pranitaurlam requested a review from a team as a code owner April 13, 2026 04:27

pranitaurlam force-pushed the issue-1836-action-items branch 3 times, most recently from 39d40b2 to 74ad9bc Compare April 13, 2026 05:05

pranitaurlam added 2 commits April 13, 2026 10:58

chore: Address Issue 1836 action items

8780f4b

- Update Node test matrix to [22, 24, 25] in cve-scanning and coverage workflows - Pin GitHub Actions dependencies - Add CodeCov coverage badge to README.md - Add CodeQL workflow for OpenSSF scorecard

chore: trigger CLA re-check

f408c80

pranitaurlam force-pushed the issue-1836-action-items branch from 4aa7dc7 to f408c80 Compare April 13, 2026 05:28

kriswest requested changes Apr 13, 2026

View reviewed changes

Comment thread toolbox/fdc3-conformance/webpack.config.js Outdated

Comment thread .github/workflows/codeql.yml Outdated

Comment thread .github/workflows/codeql.yml Outdated

Comment thread .github/workflows/cve-scanning.yml

chore: address reviewer feedback

d837395

- Remove '// trigger' comment from webpack.config.js - Pin codeql-action steps to commit SHA - Simplify cve-scanning to use node 22 only (no matrix)

kriswest linked an issue Apr 13, 2026 that may be closed by this pull request

Deprecate node 20 and change testing matrix to node 22, 24 & 25 #1826

Open

kriswest reviewed Apr 13, 2026

View reviewed changes

kriswest assigned bingenito Apr 13, 2026

fix: remove OIDC from codecov and simplify coverage matrix to node 22

5295638

pranitaurlam added 2 commits April 13, 2026 22:50

fix: skip CVE audit steps gracefully when OSS_INDEX secrets are not c…

e8f86a6

…onfigured

fix: use env var for secret check in CVE workflow to satisfy GitHub A…

824ecb4

…ctions syntax

kriswest self-requested a review April 14, 2026 09:54

bingenito reviewed Apr 14, 2026

View reviewed changes

Conversation

pranitaurlam commented Apr 13, 2026 • edited by kriswest Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for fdc3 canceled.

Uh oh!

linux-foundation-easycla Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pranitaurlam commented Apr 13, 2026

Uh oh!

pranitaurlam commented Apr 13, 2026

Uh oh!

pranitaurlam commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-advanced-security AI commented Apr 13, 2026

What Enabling Code Scanning Means:

Uh oh!

kriswest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pranitaurlam commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kriswest left a comment

Choose a reason for hiding this comment

Uh oh!

kriswest commented Apr 13, 2026

Uh oh!

pranitaurlam commented Apr 13, 2026

Uh oh!

codecov-commenter commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bingenito Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bingenito Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

bingenito Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

bingenito Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

bingenito Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

kriswest Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pranitaurlam commented Apr 13, 2026 •

edited by kriswest

Loading

netlify Bot commented Apr 13, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Apr 13, 2026 •

edited

Loading

pranitaurlam commented Apr 13, 2026 •

edited

Loading

pranitaurlam commented Apr 13, 2026 •

edited

Loading

codecov-commenter commented Apr 13, 2026 •

edited

Loading

bingenito Apr 14, 2026 •

edited

Loading