-
Notifications
You must be signed in to change notification settings - Fork 0
release: prepare Samsarix 1.1.0 #13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,49 @@ | ||||||||||
| name: Draft GitHub release | ||||||||||
|
|
||||||||||
| on: | ||||||||||
| push: | ||||||||||
| tags: | ||||||||||
| - "v*" | ||||||||||
|
|
||||||||||
| permissions: | ||||||||||
| contents: write | ||||||||||
|
|
||||||||||
| jobs: | ||||||||||
| release: | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
| timeout-minutes: 25 | ||||||||||
|
|
||||||||||
| steps: | ||||||||||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Disable persisted checkout credentials. Line 17 persists the write-capable checkout token in the Git remote configuration. Proposed fix - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.29.0)[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||
|
|
||||||||||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||||||||||
| with: | ||||||||||
| node-version: 22 | ||||||||||
| cache: npm | ||||||||||
|
|
||||||||||
| - name: Install locked dependencies | ||||||||||
| run: npm ci | ||||||||||
|
|
||||||||||
| - name: Verify minimum supported VS Code host | ||||||||||
| run: xvfb-run -a npm run test:integration | ||||||||||
| env: | ||||||||||
| SAMSARIX_VSCODE_TEST_VERSION: "1.85.2" | ||||||||||
|
|
||||||||||
| - name: Verify source and package | ||||||||||
| run: npm run check | ||||||||||
|
|
||||||||||
| - name: Audit complete dependency graph | ||||||||||
| run: npm audit --audit-level=high | ||||||||||
|
|
||||||||||
| - name: Create draft release with immutable evidence | ||||||||||
| env: | ||||||||||
| GH_TOKEN: ${{ github.token }} | ||||||||||
| run: >- | ||||||||||
| gh release create "${GITHUB_REF_NAME}" | ||||||||||
| dist/*.vsix | ||||||||||
| dist/*.sha256 | ||||||||||
| dist/*.contents.txt | ||||||||||
| --draft | ||||||||||
| --verify-tag | ||||||||||
| --generate-notes | ||||||||||
| --title "Samsarix ${GITHUB_REF_NAME}" | ||||||||||
|
Comment on lines
+42
to
+49
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Validate the release tag against Line 42 creates a release for every Proposed fix+ - name: Verify release tag version
+ run: |
+ expected_tag="v$(node -p "require('./package.json').version")"
+ test "${GITHUB_REF_NAME}" = "${expected_tag}"
+
- name: Create draft release with immutable evidence🤖 Prompt for AI Agents |
||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| export const localOnly = true; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Deathcharge/samsarix-vscode
Length of output: 5677
🏁 Script executed:
Repository: Deathcharge/samsarix-vscode
Length of output: 6100
🌐 Web query:
GitHub actions/checkout persist-credentials default true local git config README💡 Result:
The persist-credentials input for the GitHub actions/checkout action has a default value of true [1][2][3]. When set to true, the action configures the authentication token or SSH key within the local Git configuration of the checked-out repository, allowing subsequent scripts to execute authenticated Git commands [1][4]. In recent versions of actions/checkout, credential security has been improved: instead of writing directly to the repository's.git/config, credentials are stored in a separate file under the runner's temporary directory ($RUNNER_TEMP) and included conditionally using Git's includeIf mechanism [1][2][5]. This sensitive data is automatically removed during the post-job cleanup process [1][3][4]. Users who wish to prevent the action from configuring these credentials in the local Git configuration can explicitly set persist-credentials to false [1][2].
Citations:
🏁 Script executed:
Repository: Deathcharge/samsarix-vscode
Length of output: 1175
🏁 Script executed:
Repository: Deathcharge/samsarix-vscode
Length of output: 1323
Disable checkout credential persistence in all workflows.
actions/checkoutdefaultspersist-credentialstotrueand configures a credential helper for later Git commands. Both workflows run repository-controlled npm commands after checkout. The release workflow also grantscontents: write.Set
persist-credentials: falseon the checkout steps at.github/workflows/ci.yml:20,.github/workflows/ci.yml:68, and.github/workflows/release.yml:17.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Source: Linters/SAST tools