mirror of
https://github.com/supabase/server.git
synced 2026-09-14 15:28:52 +08:00
Katerina Skroumpelou
ea17d2fdf1
Splits release.yml into two jobs to close the OIDC-theft path that the
TanStack/router compromise (2026-05-11) exploited:
- `build` job: contents: write + pull-requests: write (release-please).
Runs install/build/pack and uploads the .tgz as an artifact. NO id-token.
- `publish-npm` job: needs build, id-token: write only. Downloads the
tarball into a scratch dir and runs `npm publish --provenance`. Never
executes pnpm install or any third-party code.
JSR publish and GH pre-release stay in the build job (JSR uses its own
OIDC binding scoped to JSR, not npm).
Also drops `cache: pnpm` from docs.yml and ci.yml. Per
adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache, GitHub
Actions cache poisoning lets a compromised dep on a main-branch workflow
steal the cache token and poison entries that other privileged workflows
on main will restore. release.yml never used cache; docs.yml has
id-token: write for Pages OIDC and is the main remaining target. ci.yml
is low impact but dropped for consistency. preview-release.yml runs in
fork cache scope and is unaffected.
All `\${{ ... }}` substitutions in inline shell scripts moved to env:
blocks (GHSL Part 2 defense in depth, even though upstream values are
regex-validated).
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1.3 KiB
YAML
56 lines
1.3 KiB
YAML
name: Deploy Documentation
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
pages: write
|
|
id-token: write
|
|
|
|
concurrency:
|
|
group: pages
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: '22'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build docs (HTML + spec.json)
|
|
run: pnpm run docs
|
|
|
|
- name: Upload Pages artifact
|
|
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
|
|
with:
|
|
path: ./api-docs
|
|
|
|
deploy:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
environment:
|
|
name: github-pages
|
|
url: ${{ steps.deployment.outputs.page_url }}
|
|
steps:
|
|
- name: Deploy to GitHub Pages
|
|
id: deployment
|
|
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
|