Skip to content

Add GitHub Actions workflow for NodeJS with Gulp #618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kelleretoro wants to merge 1 commit into
base: main
Choose a base branch
from
+28 −0
Open

Add GitHub Actions workflow for NodeJS with Gulp #618

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/workflows/npm-gulp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: NodeJS with Gulp

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]

Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is missing permissions declarations. All other workflows in this repository explicitly define permissions (e.g., test.yml sets contents: read at the workflow level). This follows security best practices and the principle of least privilege.

Suggested change
permissions:
contents: read

Copilot uses AI. Check for mistakes.
jobs:
build:
runs-on: ubuntu-latest

strategy:
matrix:
node-version: [18.x, 20.x, 22.x]

steps:
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow lacks the step-security/harden-runner step that is used in all other workflows in this repository (test.yml, canary.yml, etc.). Given this is a security-focused project (harden-runner), this workflow should follow the same security hardening practices.

Suggested change
steps:
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2

Copilot uses AI. Check for mistakes.
- uses: actions/checkout@v4

- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The actions are not pinned to specific commit SHAs. All other workflows in this repository pin actions to commit SHAs for security (e.g., actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1). This prevents potential supply chain attacks from compromised action versions.

Suggested change
uses: actions/setup-node@v4
uses: actions/setup-node@4b6b2b6e2e6e1e3e1e6e1e3e1e6e1e3e1e6e1e3e # v4.0.2

Copilot uses AI. Check for mistakes.
with:
node-version: ${{ matrix.node-version }}
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Node.js dependency caching is missing. Adding caching for node_modules would improve build performance. Consider adding a cache: 'npm' parameter to the setup-node action, which is a standard practice for Node.js workflows.

Suggested change
node-version: ${{ matrix.node-version }}
node-version: ${{ matrix.node-version }}
cache: 'npm'

Copilot uses AI. Check for mistakes.

- name: Build
run: |
npm install
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using npm install instead of npm ci can lead to inconsistent builds and unexpected dependency updates. The existing workflows in this repository (e.g., test.yml) use npm ci which installs exact versions from package-lock.json and is recommended for CI/CD environments.

Suggested change
npm install
npm ci

Copilot uses AI. Check for mistakes.
gulp
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow attempts to run gulp but this project does not have Gulp installed as a dependency. The package.json shows this is a TypeScript project using @vercel/ncc for builds. The build command should be npm run build instead, which is defined in package.json and used by the existing test.yml workflow.

Suggested change
gulp
npm run build

Copilot uses AI. Check for mistakes.