chore(deps): bump fast-uri from 3.1.2 to 3.1.5 #210
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for secrets | |
| env: | |
| # Bump together; checksum from | |
| # https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| echo "${GITLEAKS_SHA256} /tmp/gitleaks.tgz" | sha256sum -c - | |
| tar xz -C /tmp -f /tmp/gitleaks.tgz | |
| /tmp/gitleaks detect --source . --verbose --redact | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: 'npm' | |
| - name: Check for large files | |
| run: | | |
| LARGE=$(find . -not -path './.git/*' -not -path './node_modules/*' -type f -size +5M) | |
| if [ -n "$LARGE" ]; then | |
| echo "::error::Large files detected (>5 MB):" | |
| echo "$LARGE" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Check licenses | |
| # Pinned to 25.0.1: package is dormant, so a future hijack can't weaken this gate. | |
| run: npx license-checker@25.0.1 --failOn "GPL-2.0;GPL-3.0;AGPL-3.0" | |
| - name: Validate manifest and audit permissions | |
| run: | | |
| node -e " | |
| const m = JSON.parse(require('fs').readFileSync('manifest.json','utf8')); | |
| const required = ['manifest_version','name','version']; | |
| const missing = required.filter(k => !m[k]); | |
| if (missing.length) { console.error('Missing required fields:', missing.join(', ')); process.exit(1); } | |
| if (m.manifest_version !== 3) { console.error('manifest_version must be 3'); process.exit(1); } | |
| if (!/^\d+\.\d+\.\d+$/.test(m.version)) { console.error('Invalid version format (expected x.y.z):', m.version); process.exit(1); } | |
| console.log('manifest.json is valid (v' + m.version + ')'); | |
| const risky = ['debugger','<all_urls>','cookies','webRequestBlocking']; | |
| const perms = m.permissions || []; | |
| const optional = m.optional_permissions || []; | |
| const hosts = m.host_permissions || []; | |
| const all = [...perms, ...optional, ...hosts]; | |
| const found = all.filter(p => risky.includes(p)); | |
| if (found.length) { console.warn('::warning::Risky permissions detected:', found.join(', ')); } | |
| const broad = hosts.filter(h => ['<all_urls>','*://*/*'].includes(h)); | |
| if (broad.length) { console.warn('::warning::Broad host permissions may slow CWS review:', broad.join(', ')); } | |
| console.log('Permissions audit passed (' + all.length + ' total)'); | |
| " | |
| - name: Security audit | |
| run: npm audit --audit-level=high | |
| - name: Lint | |
| run: npm run lint && npm run lint:css | |
| - name: Test | |
| run: npm test | |
| - name: Build verification | |
| run: | | |
| npm run build:chrome | |
| SIZE=$(stat -c%s dist/extension.zip 2>/dev/null || stat -f%z dist/extension.zip) | |
| echo "Zip size: $((SIZE / 1024)) KB" | |
| if [ "$SIZE" -gt 10485760 ]; then | |
| echo "::error::Extension zip exceeds 10 MB ($((SIZE / 1024 / 1024)) MB)" | |
| exit 1 | |
| fi | |
| - name: Install Playwright Chromium | |
| run: npx playwright install --with-deps chromium | |
| - name: Browser extension smoke | |
| run: npm run smoke:extension |