mirror of
https://github.com/millionco/react-doctor.git
synced 2026-09-14 20:00:24 +08:00
Skosh
72a4f4684c
* fix(ci): harden workflows against cache poisoning and document unsigned tags - Restrict TURBO_TOKEN/TURBO_TEAM to main-branch pushes only across ci.yml, code-quality.yml, and react-doctor.yml. First-party PR branches no longer have cache write access (preventing cache poisoning attacks). PRs run with a cold cache. - Add SECURITY comments in action-version-bump.yml explaining that tags are unsigned and recommending SHA pinning for hardened CI. - Update install-github-workflow.ts template to include security note about @v2 floating major tag and SHA pinning recommendation. Closes #1685 Co-authored-by: Skosh <skoshx@users.noreply.github.com> * fix(ci): make pull request cache read-only --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Skosh <skoshx@users.noreply.github.com> Co-authored-by: Aiden Bai <aiden@million.dev>
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
name: React Doctor
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
statuses: write
|
|
|
|
concurrency:
|
|
group: react-doctor-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
# First-party PRs can read the Turbo cache, but only trusted push runs can write it.
|
|
env:
|
|
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
|
|
TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
|
|
TURBO_CACHE: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'local:rw,remote:r' || github.event_name == 'pull_request' && 'local:rw' || 'local:rw,remote:rw' }}
|
|
|
|
jobs:
|
|
react-doctor:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0
|
|
|
|
- uses: pnpm/action-setup@v5
|
|
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 22.18.0
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile --prefer-offline
|
|
|
|
# Build the workspace CLI and point the local action at it (version:
|
|
# ./packages/react-doctor) so this job dogfoods the PR's own action AND
|
|
# CLI, not the published npm release.
|
|
- run: pnpm --filter react-doctor... build
|
|
|
|
- uses: ./
|
|
with:
|
|
blocking: none
|
|
node-version: 22.18.0
|
|
version: ./packages/react-doctor
|
|
# This repo dogfoods its own action; opt out of the missing-baseline
|
|
# warning so self-scans don't nag about their own CI setup.
|
|
silence-missing-baseline-warning: true
|