Files
davila7__claude-code-templates/.github/workflows/update-json-data.yml
Daniel Avila 0e06493dbe security: Harden CI/CD and repo for open-source safety (#458)
* enhance: Improve prompt-engineer agent (automated review)

- Fix broken reasoning framework: complete Ordering field and Necessity scale
- Remove OpenAI attribution from description; add invocation example block
- Restrict tools to Read only (text-transformation agent needs no writes)
- Add XML Structure and CoT Opportunity dimensions to reasoning template
- Move meta-instruction NOTE out of output template, place as agent directive
- Fix stray markdown bold markers on Reasoning Before Conclusions guideline
- Integrate orphaned examples bullet into the Examples guideline line
- Add concrete worked example section (classify customer feedback)

Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>

* security: Harden CI/CD and repo for open-source safety

- Add --ignore-scripts to all npm ci/install in CI workflows and predeploy script
- Fix shell injection in discord-release-notification (use env vars + jq for payload)
- Add explicit permissions to all workflows (least privilege principle)
- Add root .npmrc with ignore-scripts=true
- Add .github/dependabot.yml for automated dependency security updates
- Add .github/CODEOWNERS to protect workflows, scripts, and API paths
- Expand .gitignore with *.pem, *.key, credentials.json patterns

* fix: Grant contents:read to deploy workflow so checkout works

Cubic correctly flagged that permissions: {} blocks actions/checkout.
2026-03-26 19:19:39 -04:00

84 lines
2.6 KiB
YAML

name: Update JSON Data
on:
schedule:
# Ejecutar todos los días a las 3:00 AM UTC
- cron: '0 3 * * *'
workflow_dispatch: # Permite ejecutar manualmente desde GitHub UI
permissions:
contents: write
jobs:
update-json:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.11'
cache: 'pip'
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: 'cli-tool/package-lock.json'
- name: Install Python dependencies
run: |
pip install --upgrade pip
pip install requests python-dotenv
- name: Install Node.js dependencies
run: |
cd cli-tool
npm ci --ignore-scripts
- name: Create .env file with secrets
run: |
echo "SUPABASE_URL=${{ secrets.SUPABASE_URL }}" >> .env
echo "SUPABASE_API_KEY=${{ secrets.SUPABASE_API_KEY }}" >> .env
- name: Generate components.json
run: python scripts/generate_components_json.py
env:
SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
SUPABASE_API_KEY: ${{ secrets.SUPABASE_API_KEY }}
- name: Generate trending-data.json
run: python scripts/generate_trending_data.py
env:
SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
SUPABASE_API_KEY: ${{ secrets.SUPABASE_API_KEY }}
- name: Generate claude-jobs.json
run: python scripts/generate_claude_jobs.py
- name: Copy data to dashboard
run: |
cp docs/claude-jobs.json dashboard/public/claude-jobs.json
- name: Check for changes
id: check_changes
run: |
git diff --quiet docs/components.json docs/trending-data.json docs/claude-jobs.json dashboard/public/claude-jobs.json || echo "changed=true" >> $GITHUB_OUTPUT
- name: Commit and push changes
if: steps.check_changes.outputs.changed == 'true'
run: |
git config --local user.email "github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
git add docs/components.json docs/trending-data.json docs/claude-jobs.json dashboard/public/claude-jobs.json
git commit -m "chore: Update components and trending data
🤖 Generated with [GitHub Actions](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})"
git push