mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Jordan Ritter
771cac6cab
Adds .github/workflows/sentinel.yml for org-wide rollout in blocking mode (fail-on-findings: true). Fixes the security findings sentinel surfaced on existing workflows: - stable-release.yml: workflow-dispatch-injection (inputs interpolated into run: blocks). Move inputs to env: block + use shell variables. Remaining inputs.* in peter-evans/create-pull-request with: params are action API parameters, not shell-executed -- excepted via policy. - publish-release.yml: credential-window (GITHUB_TOKEN persisted in .git/config for whole job). Scope via per-step GIT_CONFIG_* env vars. - publish-commit.yml: missing-persist-credentials (intentional -- pkg- pr-new needs the token). Add explicit persist-credentials: true and except via policy with documented reason. - showcase_build_check.yml: ai-config-injection (false positive -- no AI tools run). Excepted via policy. Adds .sentinel-ci.yml policy file for documented exceptions. Spec: https://www.notion.so/copilotkit/3683aa381852818bacd8e14eb7233c22
63 lines
1.8 KiB
YAML
63 lines
1.8 KiB
YAML
name: 🚀 pkg-pr-new
|
|
on:
|
|
push:
|
|
paths:
|
|
- "packages/**"
|
|
pull_request:
|
|
paths:
|
|
- "packages/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
NX_VERBOSE_LOGGING: true
|
|
NX_CI_EXECUTION_ID: ${{ github.head_ref }}-${{ github.sha }}-${{ github.run_attempt }}
|
|
NX_CI_EXECUTION_ENV: "Publish Commit"
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: npm
|
|
permissions:
|
|
contents: read
|
|
# pkg-pr-new posts snapshot comments on the PR using the workflow token
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: true
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
|
|
- run: corepack enable
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: "package.json"
|
|
# setup-node built-in cache is fork-safe (fork PRs can't write to base repo cache)
|
|
cache: "pnpm"
|
|
cache-dependency-path: "**/pnpm-lock.yaml"
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Configure Nx Cloud environment
|
|
run: |
|
|
echo "NX_CI_EXECUTION_ID=${{ github.run_id }}-${{ github.run_attempt }}-pkg-pr-new" >> $GITHUB_ENV
|
|
echo "NX_CLOUD_NO_TIMEOUTS=true" >> $GITHUB_ENV
|
|
echo "NX_CLOUD_DISTRIBUTED_EXECUTION=false" >> $GITHUB_ENV
|
|
echo "NX_NO_CLOUD=true" >> $GITHUB_ENV
|
|
|
|
- name: Build
|
|
run: pnpm run build
|
|
|
|
- run: npx pkg-pr-new publish --pnpm --packageManager pnpm "./packages/*"
|