Add article: Agentic security is only as good as the device data underneath it #36275
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Fleet website | |
| on: | |
| pull_request: | |
| paths: | |
| - "website/**" | |
| - "docs/**" | |
| - "handbook/**" | |
| - "schema/**" | |
| - "articles/**" | |
| - ".github/workflows/test-website.yml" | |
| - "ee/maintained-apps/outputs/**" | |
| # This allows a subsequently queued workflow run to interrupt previous runs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference | |
| shell: bash | |
| permissions: | |
| contents: read | |
| env: | |
| # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc. | |
| NPM_CONFIG_MIN_RELEASE_AGE: 0.5 | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: [20.x] | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| # Set the Node.js version | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| # 2025-08-07: The Storybook steps in website workflows have been temporarily disabled until a compatibility issue with the @storybook/test-runner has been resolved. See https://github.com/fleetdm/fleet/issues/31720 for more information. | |
| # # Download top-level dependencies and build Storybook in the website's assets/ folder. | |
| # - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose | |
| # Now start building! | |
| # > …but first, get a little crazy for a sec and delete the top-level package.json file | |
| # > i.e. the one used by the Fleet server. This is because require() in node will go | |
| # > hunting in ancestral directories for missing dependencies, and since some of the | |
| # > bundled transpiler tasks sniff for package availability using require(), this trips | |
| # > up when it encounters another Node universe in the parent directory. | |
| - run: rm -rf package.json package-lock.json node_modules/ | |
| # > Turns out there's a similar issue with how eslint plugins are looked up, so we | |
| # > delete the top level .eslintrc file too. | |
| - run: rm -f .eslintrc.js | |
| # Get dependencies (including dev deps) | |
| - run: cd website/ && npm install | |
| # Run sanity checks | |
| - run: cd website/ && npm test | |
| # Scan for malicious packages | |
| # - name: Security Scan with Shai-Hulud Detector | |
| # run: | | |
| # git clone https://github.com/Cobenian/shai-hulud-detect | |
| # cd shai-hulud-detect | |
| # chmod +x shai-hulud-detector.sh | |
| # # ./shai-hulud-detector.sh --paranoid ../ # Pipeline will automatically fail on exit codes 1 or 2 | |
| # Compile assets | |
| - run: cd website/ && BUILD_SCRIPT_ARGS="--githubAccessToken=${{ secrets.FLEET_GITHUB_TOKEN_FOR_WEBSITE_TEST }}" npm run build-for-prod |