-
-
Notifications
You must be signed in to change notification settings - Fork 235
add CI workflow #683
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add CI workflow #683
Changes from all commits
19978a7
cd98ec0
6f20ff6
b7e6568
d48592f
d73c915
4d33b3d
a17d400
f744cfa
c486e3b
baa7340
78dc847
1e112f3
4478fa0
c2732c6
b1608a3
86c08d1
dffee34
1401ab9
5133348
9b21cf7
8b9a882
659d2c9
829117e
4964ecb
3eb883d
5e20990
61ff06e
a5ef83f
954c18d
2d6b332
1236035
8710d3b
f1be8ea
194f5cc
dc58d14
1905e95
f7b1453
6d4fd7e
e790dea
209ca4a
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| name: Test | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request_review: | ||
| types: [submitted] | ||
| pull_request: | ||
| types: [labeled] | ||
|
|
||
| jobs: | ||
| test: | ||
| if: github.event_name == 'push' || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved' && github.event.pull_request.base.ref == 'main') || (github.event_name == 'pull_request' && github.event.label.name == 'canary') | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Bug: CI workflow doesn't run tests on PR open/syncThe PR description states the workflow "runs on every PR to |
||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ (github.event_name == 'pull_request_review' || github.event_name == 'pull_request') && github.event.pull_request.head.sha || github.sha }} | ||
|
|
||
| - name: Setup Git user | ||
| shell: bash | ||
| run: | | ||
| git config --global user.name github-actions[bot] | ||
| git config --global user.email 41898282+github-actions[bot]@users.noreply.github.com | ||
| - name: Setup Bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: latest | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| with: | ||
| version: 10 | ||
|
|
||
| - name: Install Dependencies | ||
| run: bun install --frozen-lockfile | ||
| env: | ||
| BTS_TELEMETRY: 0 | ||
|
|
||
| - name: Build Workspace Dependencies | ||
| run: cd packages/types && bun run build | ||
|
|
||
| - name: Run Tests | ||
| working-directory: apps/cli | ||
| run: bun run test:ci | ||
| env: | ||
| AGENT: 1 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -38,4 +38,6 @@ yarn-error.log* | |
| .vscode | ||
| .env*.local | ||
|
|
||
| .smoke | ||
| .smoke | ||
|
|
||
| .idea | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| [test] | ||
| # Preload setup file for global setup/teardown | ||
| preload = ["./test/setup.ts"] | ||
|
|
||
| # Per-test timeout (3 minutes for smoke tests) | ||
| timeout = 180000 | ||
|
|
||
| # Skip test files from coverage reports | ||
| coverageSkipTestFiles = true | ||
|
|
||
| # Exclude patterns from coverage | ||
| coveragePathIgnorePatterns = [ | ||
| "test/**", | ||
| "dist/**", | ||
| "templates/**", | ||
| "node_modules/**", | ||
| ] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Bug: Checkout of untrusted code with pull_request_target has security risk
The workflow changed from
pull_requesttopull_request_targetand checks outgithub.event.pull_request.head.sha(untrusted PR code).pull_request_targetruns with write permissions and access to repository secrets likeNPM_TOKEN. While the 'canary' label requirement provides a gate, this pattern allows untrusted code to execute with secrets if a maintainer adds the label without careful review, or if code is pushed to the PR after review but before labeling (TOCTOU vulnerability). The safer pattern is to avoid checking out PR head code when usingpull_request_target.Additional Locations (1)
.github/workflows/release.yaml#L125-L130