From 872c3e78ee6d0f7d88540f45892fa40aa071cea3 Mon Sep 17 00:00:00 2001 From: Christian Oliff Date: Mon, 8 Sep 2025 17:04:40 +0900 Subject: [PATCH] Update GitHub Actions --- .cspell.json | 1 + .github/workflows/codeql-analysis.yml | 6 ++-- .github/workflows/ossf-scorecard.yml | 43 +++++++++++++++++++++++++++ .github/workflows/publish.yml | 4 +-- .github/workflows/spellcheck.yml | 4 +-- .github/workflows/super-linter.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- .github/workflows/test.yml | 6 ++-- .github/workflows/website.yml | 6 ++-- 9 files changed, 59 insertions(+), 15 deletions(-) create mode 100644 .github/workflows/ossf-scorecard.yml diff --git a/.cspell.json b/.cspell.json index 37b3e1d6c..18c0527a6 100644 --- a/.cspell.json +++ b/.cspell.json @@ -61,6 +61,7 @@ "npmjs", "onttt", "opencollective", + "ossf", "Rehype", "Rollup", "ruleid", diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 12245e216..7824e5d95 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -22,16 +22,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: config-file: ./.github/codeql/codeql-config.yml languages: 'javascript' queries: +security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml new file mode 100644 index 000000000..c7ada4d99 --- /dev/null +++ b/.github/workflows/ossf-scorecard.yml @@ -0,0 +1,43 @@ +name: Scorecard supply-chain security +on: + branch_protection_rule: + schedule: + - cron: '27 12 * * 2' + push: + branches: ['main'] + +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' + permissions: + security-events: write + id-token: write + + steps: + - name: 'Checkout code' + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + + - name: 'Run analysis' + uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: 'Upload artifact' + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + - name: 'Upload to code-scanning' + uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 + with: + sarif_file: results.sarif diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a3efdee1c..5123f929d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -11,12 +11,12 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Checkout - uses: actions/checkout@v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false - name: ⎔ Setup node - uses: actions/setup-node@v5 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml index 23d9bffff..dd3336072 100644 --- a/.github/workflows/spellcheck.yml +++ b/.github/workflows/spellcheck.yml @@ -13,11 +13,11 @@ jobs: runs-on: ubuntu-latest if: ${{ github.actor != 'dependabot[bot]' }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false - - uses: streetsidesoftware/cspell-action@v7 + - uses: streetsidesoftware/cspell-action@157048954070986ce4315d0813573a2d8faee361 # v7.1.1 with: check_dot_files: false incremental_files_only: true diff --git a/.github/workflows/super-linter.yml b/.github/workflows/super-linter.yml index eb5506a3a..e4bb8e79c 100644 --- a/.github/workflows/super-linter.yml +++ b/.github/workflows/super-linter.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 0db70e74e..57cfaad6b 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 694947d36..525b98e73 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - name: ⎔ Setup node - uses: actions/setup-node@v5 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: cache: npm @@ -48,12 +48,12 @@ jobs: access_token: ${{ secrets.GITHUB_TOKEN }} - name: ⬇️ Checkout - uses: actions/checkout@v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false - name: ⎔ Setup node ${{ matrix.node }} - uses: actions/setup-node@v5 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node }} cache: npm diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml index c5216d7cf..f82050bf8 100644 --- a/.github/workflows/website.yml +++ b/.github/workflows/website.yml @@ -18,12 +18,12 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Checkout - uses: actions/checkout@v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: persist-credentials: false - name: ⎔ Setup node - uses: actions/setup-node@v5 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: cache: npm cache-dependency-path: website/package-lock.json @@ -45,7 +45,7 @@ jobs: # Continue even if HTMLHint finds issues - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: sarif_file: website/htmlhint.sarif category: HTMLHint