fix(gateway)!: reject cross-origin WebSocket handshakes #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # When to run: on every push to main, on every pull request, and on demand. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| # Least privilege: this workflow only ever reads the repo. | |
| permissions: | |
| contents: read | |
| # A new push to the same branch cancels the previous, still-running check. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| name: Lint, typecheck, test, build | |
| runs-on: ubuntu-latest | |
| steps: | |
| # 1. Get the code onto the runner. | |
| # Actions are pinned to a full commit SHA (org policy); comment tracks the version. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # No checks here push anything, so don't leave a credential in .git/config. | |
| persist-credentials: false | |
| # 2. Install the toolchain from .mise.toml — Node is pinned there to the | |
| # same version packaging/assemble.sh bundles into the .deb, so CI tests | |
| # the runtime that actually ships. | |
| - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| install: true | |
| cache: true | |
| # 3. Cache npm downloads across runs, keyed on the lockfile. | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.npm | |
| key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }} | |
| restore-keys: ${{ runner.os }}-npm- | |
| # 4. Install from the lockfile (clean, reproducible). | |
| - run: mise run install | |
| # 5. The gate. Identical to `mise run ci` locally — format check, | |
| # both typechecks, tests with the coverage floor, and the GUI build. | |
| - run: mise run ci | |
| zizmor: | |
| name: Zizmor (GitHub Actions audit) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Audit GitHub Actions workflows (zizmor) | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| advanced-security: false |