Repository navigation
chore(ci): update actions to latest and fix workflow permission alerts - #2
Merged
Merged
Conversation
Every action was several majors behind and being force-run on Node 24, which the runner reported as a deprecation warning on the 10.3.0 publish. - actions/checkout v4 -> v7 - actions/setup-node v4 -> v7 - softprops/action-gh-release v1 -> v3 - codecov/codecov-action v4 -> v7 Checked for breaking input changes rather than assuming: codecov v5 deprecated `file`/`plugin`, neither of which this repo uses, and all five inputs it does use still exist in v7. setup-node v5/v6 added automatic caching driven by a `packageManager` field in package.json; there is none here and `cache: 'npm'` stays explicit, so behaviour is unchanged. Also resolves two medium CodeQL alerts (actions/missing-workflow-permissions), one of which the typescript-next job introduced. Both workflows now declare a read-only default with jobs opting in: - publish-npm keeps `contents: write` for the GitHub Release and `id-token: write` for Trusted Publishing and provenance. - Dropped `packages: write`, which was never used — this publishes to registry.npmjs.org, not GitHub Packages. Made the lint step gating instead of `continue-on-error`. `eslint .` exits non-zero only on errors, and the repo is at 0 errors, so the pre-existing no-explicit-any warnings do not fail the build. Same for coverage generation, which was already covered by the test step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every action was several majors behind and being force-run on Node 24, which the runner reported as a deprecation warning on the 10.3.0 publish.
actions/checkoutactions/setup-nodesoftprops/action-gh-releasecodecov/codecov-actionBreaking changes checked, not assumed
fileandplugin. Neither is used here, and all five inputs this repo does use (token,files,flags,name,fail_ci_if_error) still exist in v7.packageManagerfield inpackage.json. There is none here andcache: 'npm'stays explicit, so behaviour is unchanged.pull_request_target/workflow_run; neither trigger is used.Resolves 2 medium CodeQL alerts
actions/missing-workflow-permissionson both jobs intest.yml— one of which thetypescript-nextjob introduced. Both workflows now declare a read-only default with jobs opting in:publish-npmkeepscontents: writefor the GitHub Release andid-token: writefor Trusted Publishing and provenance.packages: write, which was never used — this publishes to registry.npmjs.org, not GitHub Packages.Lint is now gating
Was
continue-on-error: true.eslint .exits non-zero only on errors and the repo is at 0 errors, so the pre-existingno-explicit-anywarnings do not fail the build. Same for coverage generation, which the test step already covers.All four gating steps verified locally: lint, test (825 passing incl. type tests), build, coverage.
Not in this PR
7 pre-existing high CodeQL alerts in source (
js/polynomial-redos,js/incomplete-multi-character-sanitization) inHtmlSanitizer.ts,HtmlRenderer.tsandRouter.ts. Unrelated to CI and worth handling separately.