Skip to content

Commit 6bd1546

Browse files
NathanWalkerNathanWalker
authored
Merge branch 'main' into security-harden-runner
2 parents 7e1d12c + 0d042b4 commit 6bd1546

8 files changed

Lines changed: 393 additions & 46 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: monthly
7+
8+
- package-ecosystem: npm
9+
directory: /AppWithModules/app
10+
schedule:
11+
interval: monthly
12+
time: "23:00"
13+
open-pull-requests-limit: 10
14+
ignore:
15+
- dependency-name: "*"
16+
update-types: ["version-update:semver-major"]
17+
18+
- package-ecosystem: npm
19+
directory: /TestRunner/app
20+
schedule:
21+
interval: monthly
22+
time: "23:00"
23+
open-pull-requests-limit: 10
24+
ignore:
25+
- dependency-name: "*"
26+
update-types: ["version-update:semver-major"]
27+
28+
- package-ecosystem: npm
29+
directory: /TestRunner/app/tests
30+
schedule:
31+
interval: monthly
32+
time: "23:00"
33+
open-pull-requests-limit: 10
34+
ignore:
35+
- dependency-name: "*"
36+
update-types: ["version-update:semver-major"]
37+
38+
- package-ecosystem: npm
39+
directory: /TestRunner/app/tests/shared/Require/PackageJsonApp/io
40+
schedule:
41+
interval: monthly
42+
time: "23:00"
43+
open-pull-requests-limit: 10
44+
ignore:
45+
- dependency-name: "*"
46+
update-types: ["version-update:semver-major"]
47+
48+
- package-ecosystem: npm
49+
directory: /TestRunner/app/tests/shared/Require/PackageJsonAppNoMain/io
50+
schedule:
51+
interval: monthly
52+
time: "23:00"
53+
open-pull-requests-limit: 10
54+
ignore:
55+
- dependency-name: "*"
56+
update-types: ["version-update:semver-major"]
57+
58+
- package-ecosystem: npm
59+
directory: /TestRunner/app/tests/shared/Require/PackageJsonAppWithoutExtension/io
60+
schedule:
61+
interval: monthly
62+
time: "23:00"
63+
open-pull-requests-limit: 10
64+
ignore:
65+
- dependency-name: "*"
66+
update-types: ["version-update:semver-major"]
67+
68+
- package-ecosystem: npm
69+
directory: /TestRunner/app/tests/shared/Require/PackageJsonMainPointsToDir
70+
schedule:
71+
interval: monthly
72+
time: "23:00"
73+
open-pull-requests-limit: 10
74+
ignore:
75+
- dependency-name: "*"
76+
update-types: ["version-update:semver-major"]
77+
78+
- package-ecosystem: npm
79+
directory: /TestRunner/app/tests/shared/Require/PackageJsonSyntaxError/io
80+
schedule:
81+
interval: monthly
82+
time: "23:00"
83+
open-pull-requests-limit: 10
84+
ignore:
85+
- dependency-name: "*"
86+
update-types: ["version-update:semver-major"]
87+
88+
- package-ecosystem: npm
89+
directory: /TestRunner/app/tests/shared/Require/ResolveCanonicalPath
90+
schedule:
91+
interval: monthly
92+
time: "23:00"
93+
open-pull-requests-limit: 10
94+
ignore:
95+
- dependency-name: "*"
96+
update-types: ["version-update:semver-major"]
97+
98+
- package-ecosystem: npm
99+
directory: /TestRunner/app/tests/shared
100+
schedule:
101+
interval: monthly
102+
time: "23:00"
103+
open-pull-requests-limit: 10
104+
ignore:
105+
- dependency-name: "*"
106+
update-types: ["version-update:semver-major"]
107+
108+
- package-ecosystem: npm
109+
directory: /TestRunner/app/tns_modules/dummy-package
110+
schedule:
111+
interval: monthly
112+
time: "23:00"
113+
open-pull-requests-limit: 10
114+
ignore:
115+
- dependency-name: "*"
116+
update-types: ["version-update:semver-major"]
117+
118+
- package-ecosystem: npm
119+
directory: /TestRunner/app/tns_modules/tns-core-modules/shared/Require/PackageJsonTns/io
120+
schedule:
121+
interval: monthly
122+
time: "23:00"
123+
open-pull-requests-limit: 10
124+
ignore:
125+
- dependency-name: "*"
126+
update-types: ["version-update:semver-major"]
127+
128+
- package-ecosystem: npm
129+
directory: /TestRunner/app/tns_modules/tns-core-modules/shared/Require/RequirePriority/dependency5
130+
schedule:
131+
interval: monthly
132+
time: "23:00"
133+
open-pull-requests-limit: 10
134+
ignore:
135+
- dependency-name: "*"
136+
update-types: ["version-update:semver-major"]
137+
138+
- package-ecosystem: npm
139+
directory: /
140+
schedule:
141+
interval: monthly
142+
time: "23:00"
143+
open-pull-requests-limit: 10
144+
ignore:
145+
- dependency-name: "*"
146+
update-types: ["version-update:semver-major"]

‎.github/workflows/dependency-review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: 'Checkout Repository'
20+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
21+
- name: 'Dependency Review'
22+
uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3

‎.github/workflows/npm_release.yml‎

Lines changed: 40 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -21,31 +21,38 @@ jobs:
2121
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
2222
with:
2323
egress-policy: audit
24-
- uses: maxim-lobanov/setup-xcode@v1
24+
- uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
2525
with:
2626
xcode-version: ${{env.XCODE_VERSION}}
27-
- uses: actions/checkout@v3
27+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2828
with:
2929
fetch-depth: 0
3030
- name: LLVM cache
31-
uses: actions/cache@v3
31+
uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
3232
with:
3333
path: ./llvm
3434
key: ${{ hashFiles('download_llvm.sh') }}
35-
- uses: actions/setup-node@v3
35+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
3636
with:
3737
node-version: 20
3838
registry-url: "https://registry.npmjs.org"
3939
- name: Install Python
40-
uses: actions/setup-python@v4
40+
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
4141
with:
4242
python-version: "3"
4343
- name: Install Dependencies
4444
run: |
4545
npm install
4646
python3 -m pip install --upgrade pip six
47-
brew install cmake
48-
[ ! -f /usr/local/bin/cmake ] && ln -s /usr/local/bin/cmake $(which cmake) || true
47+
# Ensure CMake is available without conflicting with pinned Homebrew formula
48+
if ! command -v cmake >/dev/null; then
49+
brew list cmake || brew install cmake
50+
fi
51+
# Some scripts expect cmake at /usr/local/bin; create a shim if needed
52+
if [ ! -x /usr/local/bin/cmake ]; then
53+
sudo mkdir -p /usr/local/bin
54+
sudo ln -sf "$(command -v cmake)" /usr/local/bin/cmake
55+
fi
4956
- name: Get Current Version
5057
run: |
5158
NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
@@ -65,12 +72,12 @@ jobs:
6572
- name: Build
6673
run: npm run build-ios
6774
- name: Upload npm package artifact
68-
uses: actions/upload-artifact@v4
75+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6976
with:
7077
name: npm-package
7178
path: dist/nativescript-ios-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
7279
- name: Upload dSYMs artifact
73-
uses: actions/upload-artifact@v4
80+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7481
with:
7582
name: NativeScript-dSYMs
7683
path: dist/dSYMs
@@ -83,28 +90,35 @@ jobs:
8390
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
8491
with:
8592
egress-policy: audit
86-
- uses: maxim-lobanov/setup-xcode@v1
93+
- uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
8794
with:
8895
xcode-version: ${{env.XCODE_VERSION}}
89-
- uses: actions/checkout@v3
96+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
9097
- name: LLVM cache
91-
uses: actions/cache@v3
98+
uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
9299
with:
93100
path: ./llvm
94101
key: ${{ hashFiles('download_llvm.sh') }}
95-
- uses: actions/setup-node@v3
102+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
96103
with:
97104
node-version: 20
98105
- name: Install Python
99-
uses: actions/setup-python@v4
106+
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
100107
with:
101108
python-version: "3"
102109
- name: Install Dependencies
103110
run: |
104111
npm install
105112
python3 -m pip install --upgrade pip six
106-
brew install cmake
107-
[ ! -f /usr/local/bin/cmake ] && ln -s /usr/local/bin/cmake $(which cmake) || true
113+
# Ensure CMake is available without conflicting with pinned Homebrew formula
114+
if ! command -v cmake >/dev/null; then
115+
brew list cmake || brew install cmake
116+
fi
117+
# Some scripts expect cmake at /usr/local/bin; create a shim if needed
118+
if [ ! -x /usr/local/bin/cmake ]; then
119+
sudo mkdir -p /usr/local/bin
120+
sudo ln -sf "$(command -v cmake)" /usr/local/bin/cmake
121+
fi
108122
brew install chargepoint/xcparse/xcparse
109123
npm install -g @edusperoni/junit-cli-report-viewer verify-junit-xml
110124
- name: Prepare
@@ -114,7 +128,7 @@ jobs:
114128
mkdir -p dist-test
115129
echo TEST_FOLDER=$(pwd)/dist-test >> $GITHUB_ENV
116130
- name: Xcode Tests
117-
uses: nick-fields/retry@v2
131+
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
118132
# try to run the tests with xcpretty. If it fails then try again without xcpretty twice for better log output
119133
# the xcode tests are a bit flaky and they should never fail on this step, as this step only collects the JS test results as junit xml
120134
with:
@@ -130,7 +144,7 @@ jobs:
130144
find $TEST_FOLDER/test-out -name "*junit*.xml" -maxdepth 1 -print0 | xargs -n 1 -0 npx verify-junit-xml
131145
- name: Archive Test Result Data
132146
if: always()
133-
uses: actions/upload-artifact@v4
147+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
134148
with:
135149
name: test-results
136150
path: ${{env.TEST_FOLDER}}/test_results.xcresult
@@ -150,11 +164,11 @@ jobs:
150164
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
151165
with:
152166
egress-policy: audit
153-
- uses: actions/setup-node@v3
167+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
154168
with:
155169
node-version: 20
156170
registry-url: "https://registry.npmjs.org"
157-
- uses: actions/download-artifact@v4.1.7
171+
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
158172
with:
159173
name: npm-package
160174
path: dist
@@ -180,19 +194,19 @@ jobs:
180194
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
181195
with:
182196
egress-policy: audit
183-
- uses: actions/checkout@v3
197+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
184198
with:
185199
fetch-depth: 0
186-
- uses: actions/setup-node@v3
200+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
187201
with:
188202
node-version: 20
189203
- name: Setup
190204
run: npm install
191-
- uses: actions/download-artifact@v4.1.7
205+
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
192206
with:
193207
name: npm-package
194208
path: dist
195-
- uses: actions/download-artifact@v4.1.7
209+
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
196210
with:
197211
name: NativeScript-dSYMs
198212
path: dist/dSYMs
@@ -201,8 +215,9 @@ jobs:
201215
run: find . -maxdepth 1 -name '*.dSYM' -print | xargs -I@ zip -r @.zip @
202216
- name: Partial Changelog
203217
run: npx conventional-changelog -p angular -r2 > body.md
204-
- uses: ncipollo/release-action@v1
218+
- uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
205219
with:
206220
artifacts: "dist/nativescript-ios-*.tgz,dist/dSYMs/*.zip"
207221
bodyFile: "body.md"
208222
prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}
223+
allowUpdates: true

0 commit comments

Comments
 (0)