mirror of
https://github.com/millionco/react-doctor.git
synced 2026-09-14 20:00:24 +08:00
Skosh
72a4f4684c
* fix(ci): harden workflows against cache poisoning and document unsigned tags - Restrict TURBO_TOKEN/TURBO_TEAM to main-branch pushes only across ci.yml, code-quality.yml, and react-doctor.yml. First-party PR branches no longer have cache write access (preventing cache poisoning attacks). PRs run with a cold cache. - Add SECURITY comments in action-version-bump.yml explaining that tags are unsigned and recommending SHA pinning for hardened CI. - Update install-github-workflow.ts template to include security note about @v2 floating major tag and SHA pinning recommendation. Closes #1685 Co-authored-by: Skosh <skoshx@users.noreply.github.com> * fix(ci): make pull request cache read-only --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Skosh <skoshx@users.noreply.github.com> Co-authored-by: Aiden Bai <aiden@million.dev>
75 lines
1.9 KiB
YAML
75 lines
1.9 KiB
YAML
name: Code Quality
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
# Keyed by PR number (not head_ref): two different fork PRs can share a
|
|
# head branch name (most commonly `main`), and a name-keyed group would let
|
|
# one contributor's push cancel or queue behind another's unrelated run.
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
# First-party PRs can read the Turbo cache, but only trusted push runs can write it.
|
|
env:
|
|
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
|
|
TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
|
|
TURBO_CACHE: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'local:rw,remote:r' || github.event_name == 'pull_request' && 'local:rw' || 'local:rw,remote:rw' }}
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 22.18.0
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile --prefer-offline
|
|
|
|
- name: Lint
|
|
run: pnpm lint
|
|
|
|
typecheck:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v5
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 22.18.0
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile --prefer-offline
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|