Skip to content

Commit 192a203

Browse files
data-douserdata-douser
authored
Merge pull request #279 from advanced-security/data-douser/cds-extractor-windows-os
Update `.github/workflows/*.yml` : YAML Lint, least-privilege `permissions` & actions versions
2 parents 8f67f25 + bf11c5e commit 192a203

File tree

5 files changed

+87
-76
lines changed

5 files changed

+87
-76
lines changed

‎.github/workflows/cds-extractor-dist-bundle.yml‎

Lines changed: 69 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: CDS Extractor Distribution Bundle
33
on:
44
push:
55
branches: [ main ]
6-
paths:
6+
paths:
77
- 'extractors/cds/**'
88
pull_request:
99
branches: [ main ]
@@ -12,77 +12,80 @@ on:
1212
workflow_dispatch:
1313
# This job can be manually triggered to validate the CDS extractor bundle
1414

15+
permissions:
16+
contents: read
17+
1518
jobs:
1619
bundle-validation:
1720
name: CDS extractor bundle validation
1821
runs-on: ubuntu-latest
19-
22+
2023
steps:
21-
- name: Checkout repository
22-
uses: actions/checkout@v5
23-
24-
- name: Setup Node.js
25-
uses: actions/setup-node@v6
26-
with:
27-
node-version: '20'
28-
cache: 'npm'
29-
cache-dependency-path: 'extractors/cds/tools/package-lock.json'
30-
31-
- name: Install node dependencies
32-
working-directory: extractors/cds/tools
33-
run: npm ci
34-
35-
- name: Run TS code linter
36-
working-directory: extractors/cds/tools
37-
run: npm run lint
38-
39-
- name: Run TS code unit tests with coverage report
40-
working-directory: extractors/cds/tools
41-
run: npm run test:coverage
42-
43-
- name: Build and validate the CDS extractor bundle
44-
working-directory: extractors/cds/tools
45-
run: npm run build:validate
24+
- name: Checkout repository
25+
uses: actions/checkout@v6
26+
27+
- name: Setup Node.js
28+
uses: actions/setup-node@v6
29+
with:
30+
node-version: '20'
31+
cache: 'npm'
32+
cache-dependency-path: 'extractors/cds/tools/package-lock.json'
33+
34+
- name: Install node dependencies
35+
working-directory: extractors/cds/tools
36+
run: npm ci
37+
38+
- name: Run TS code linter
39+
working-directory: extractors/cds/tools
40+
run: npm run lint
41+
42+
- name: Run TS code unit tests with coverage report
43+
working-directory: extractors/cds/tools
44+
run: npm run test:coverage
45+
46+
- name: Build and validate the CDS extractor bundle
47+
working-directory: extractors/cds/tools
48+
run: npm run build:validate
4649

47-
- name: Validate CDS extractor JS bundle and map files
48-
working-directory: extractors/cds/tools
49-
run: |
50-
_bundle_file="dist/cds-extractor.bundle.js"
51-
_bundle_map_file="${_bundle_file}.map"
52-
if [ -f "$_bundle_file" ]; then
53-
echo "✅ Bundle file exists."
54-
else
55-
echo "❌ Bundle file not found."
56-
exit 2
57-
fi
50+
- name: Validate CDS extractor JS bundle and map files
51+
working-directory: extractors/cds/tools
52+
run: |
53+
_bundle_file="dist/cds-extractor.bundle.js"
54+
_bundle_map_file="${_bundle_file}.map"
55+
if [ -f "$_bundle_file" ]; then
56+
echo "✅ Bundle file exists."
57+
else
58+
echo "❌ Bundle file not found."
59+
exit 2
60+
fi
5861
59-
if [ -f "$_bundle_map_file" ]; then
60-
echo "✅ CDS extractor JS bundle source map file exists."
61-
else
62-
echo "❌ CDS extractor JS bundle source map file not found."
63-
exit 3
64-
fi
62+
if [ -f "$_bundle_map_file" ]; then
63+
echo "✅ CDS extractor JS bundle source map file exists."
64+
else
65+
echo "❌ CDS extractor JS bundle source map file not found."
66+
exit 3
67+
fi
6568
66-
# Check if the built bundle and map files differ
67-
# from the versions committed to git.
68-
if git diff --exit-code "$_bundle_file" "$_bundle_map_file"; then
69-
echo "✅ CDS JS bundle and map files match committed versions."
70-
else
71-
echo "❌ CDS JS bundle and/or map file(s) differ from committed version(s)."
72-
echo "The built bundle and/or source map do not match the committed versions."
73-
echo "Please rebuild the bundle and commit the changes:"
74-
echo " cd extractors/cds/tools"
75-
echo " npm install"
76-
echo " npm run build:all"
77-
echo " git add dist/cds-extractor.bundle.*"
78-
echo " git commit -m 'Update CDS extractor dist bundle'"
79-
exit 4
80-
fi
69+
# Check if the built bundle and map files differ
70+
# from the versions committed to git.
71+
if git diff --exit-code "$_bundle_file" "$_bundle_map_file"; then
72+
echo "✅ CDS JS bundle and map files match committed versions."
73+
else
74+
echo "❌ CDS JS bundle and/or map file(s) differ from committed version(s)."
75+
echo "The built bundle and/or source map do not match the committed versions."
76+
echo "Please rebuild the bundle and commit the changes:"
77+
echo " cd extractors/cds/tools"
78+
echo " npm install"
79+
echo " npm run build:all"
80+
echo " git add dist/cds-extractor.bundle.*"
81+
echo " git commit -m 'Update CDS extractor dist bundle'"
82+
exit 4
83+
fi
8184
82-
# Check if bundle file starts with the expected shebang for `node`.
83-
if head -n 1 "${_bundle_file}" | grep -q "#!/usr/bin/env node"; then
84-
echo "✅ Bundle has Node.js shebang"
85-
else
86-
echo "❌ Bundle missing Node.js shebang"
87-
exit 5
88-
fi
85+
# Check if bundle file starts with the expected shebang for `node`.
86+
if head -n 1 "${_bundle_file}" | grep -q "#!/usr/bin/env node"; then
87+
echo "✅ Bundle has Node.js shebang"
88+
else
89+
echo "❌ Bundle missing Node.js shebang"
90+
exit 5
91+
fi

‎.github/workflows/code_scanning.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
- cron: '39 12 * * 2'
1111
workflow_dispatch:
1212

13+
permissions:
14+
contents: read
15+
1316
env:
1417
CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
1518

@@ -39,7 +42,7 @@ jobs:
3942
- name: Extract CodeQL bundle version from qlt.conf.json
4043
run: |
4144
echo "BUNDLE_VERSION=$(jq .CodeQLCLIBundle qlt.conf.json -r)" >> $GITHUB_ENV
42-
45+
4346
- name: Initialize CodeQL
4447
id: initialize-codeql
4548
uses: github/codeql-action/init@v4
@@ -52,7 +55,7 @@ jobs:
5255
db-location: ${{ runner.temp }}/codeql-database
5356
tools: https://github.com/github/codeql-action/releases/download/${{env.BUNDLE_VERSION}}/codeql-bundle-linux64.tar.gz
5457
debug: true
55-
58+
5659
- name: Run CDS extractor
5760
shell: bash
5861
run: |

‎.github/workflows/codeql-ql.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
branches: [ "main" ]
88
workflow_dispatch:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
codeql:
1215
uses: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml@main

‎.github/workflows/run-codeql-unit-tests-javascript.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
- 'main'
1111
workflow_dispatch:
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
create-unit-test-matrix:
1518
name: Create CodeQL Unit Test Matrix
@@ -18,7 +21,7 @@ jobs:
1821
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
1922
steps:
2023
- name: Checkout repository
21-
uses: actions/checkout@v5
24+
uses: actions/checkout@v6
2225

2326
- name: Install QLT
2427
id: install-qlt
@@ -43,7 +46,7 @@ jobs:
4346

4447
steps:
4548
- name: Checkout repository
46-
uses: actions/checkout@v5
49+
uses: actions/checkout@v6
4750

4851
- name: Install QLT
4952
id: install-qlt
@@ -80,7 +83,7 @@ jobs:
8083
- name: Setup Node.js for CDS compilation
8184
uses: actions/setup-node@v6
8285
with:
83-
node-version: '18'
86+
node-version: '20'
8487
cache: 'npm'
8588
cache-dependency-path: 'extractors/cds/tools/package-lock.json'
8689

@@ -121,7 +124,7 @@ jobs:
121124
--work-dir $RUNNER_TMP
122125
123126
- name: Upload test results
124-
uses: actions/upload-artifact@v5
127+
uses: actions/upload-artifact@v6
125128
with:
126129
name: test-results-${{ runner.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
127130
path: |
@@ -135,7 +138,7 @@ jobs:
135138
steps:
136139

137140
- name: Checkout repository
138-
uses: actions/checkout@v5
141+
uses: actions/checkout@v6
139142

140143
- name: Install QLT
141144
id: install-qlt
@@ -146,10 +149,9 @@ jobs:
146149

147150

148151
- name: Collect test results
149-
uses: actions/download-artifact@v6
152+
uses: actions/download-artifact@v7
150153

151154
- name: Validate test results
152155
run: |
153156
qlt test run validate-unit-tests --pretty-print --results-directory . >> $GITHUB_STEP_SUMMARY
154157
qlt test run validate-unit-tests --results-directory .
155-

‎.github/workflows/update-codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717

1818
steps:
1919
- name: Checkout repository
20-
uses: actions/checkout@v5
20+
uses: actions/checkout@v6
2121

2222
- name: Check latest CodeQL CLI version and update qlt.conf.json
2323
id: check-version

0 commit comments

Comments
 (0)