@macedon-technologies/batman 1.17.2 → 1.17.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.jsii +83 -11
- package/API.md +57 -1
- package/build-tools/scan-generated-workflows.ts +18 -11
- package/lib/Application.js +6 -1
- package/lib/BatmanProject.js +1 -1
- package/lib/BootcampProject.js +1 -1
- package/lib/CodeOwnersFile.js +1 -1
- package/lib/ProductionDeployWorkflow.js +1 -1
- package/lib/ProjenWorkflowHardening.d.ts +18 -0
- package/lib/ProjenWorkflowHardening.js +59 -0
- package/lib/StagingDeployWorkflow.js +1 -1
- package/lib/WorkflowActionVersions.d.ts +31 -1
- package/lib/WorkflowActionVersions.js +5 -1
- package/lib/WorkflowAutoDiscover.js +1 -1
- package/package.json +1 -1
package/.jsii
CHANGED
|
@@ -123,7 +123,7 @@
|
|
|
123
123
|
"kind": "interface",
|
|
124
124
|
"locationInModule": {
|
|
125
125
|
"filename": "src/Application.ts",
|
|
126
|
-
"line":
|
|
126
|
+
"line": 21
|
|
127
127
|
},
|
|
128
128
|
"name": "ApplicationEnvironmentConfig",
|
|
129
129
|
"properties": [
|
|
@@ -135,7 +135,7 @@
|
|
|
135
135
|
"immutable": true,
|
|
136
136
|
"locationInModule": {
|
|
137
137
|
"filename": "src/Application.ts",
|
|
138
|
-
"line":
|
|
138
|
+
"line": 22
|
|
139
139
|
},
|
|
140
140
|
"name": "githubActionRoleArn",
|
|
141
141
|
"type": {
|
|
@@ -918,13 +918,13 @@
|
|
|
918
918
|
"docs": {
|
|
919
919
|
"remarks": "zizmor flags unpinned `uses:` references as a high-severity finding\n(https://docs.zizmor.sh/audits/#unpinned-uses) because a mutable tag can be\nrepointed to different code after review. Every field here can be\noverridden by consumers who need a different pinned SHA (e.g. to pick up a\nnewer release before this package does).",
|
|
920
920
|
"stability": "stable",
|
|
921
|
-
"summary": "SHA-pinned action references used by the generated deploy/cleanup workflows."
|
|
921
|
+
"summary": "SHA-pinned action references used by the generated deploy/cleanup workflows, and applied to the workflows AwsCdkTypeScriptApp generates on its own (upgrade.yml, pull-request-lint.yml) via `hardenProjenGeneratedWorkflows` — see `ProjenWorkflowHardening.ts`."
|
|
922
922
|
},
|
|
923
923
|
"fqn": "@macedon-technologies/batman.WorkflowActionVersions",
|
|
924
924
|
"kind": "interface",
|
|
925
925
|
"locationInModule": {
|
|
926
926
|
"filename": "src/WorkflowActionVersions.ts",
|
|
927
|
-
"line":
|
|
927
|
+
"line": 12
|
|
928
928
|
},
|
|
929
929
|
"name": "WorkflowActionVersions",
|
|
930
930
|
"properties": [
|
|
@@ -938,7 +938,7 @@
|
|
|
938
938
|
"immutable": true,
|
|
939
939
|
"locationInModule": {
|
|
940
940
|
"filename": "src/WorkflowActionVersions.ts",
|
|
941
|
-
"line":
|
|
941
|
+
"line": 18
|
|
942
942
|
},
|
|
943
943
|
"name": "checkout",
|
|
944
944
|
"optional": true,
|
|
@@ -956,7 +956,7 @@
|
|
|
956
956
|
"immutable": true,
|
|
957
957
|
"locationInModule": {
|
|
958
958
|
"filename": "src/WorkflowActionVersions.ts",
|
|
959
|
-
"line":
|
|
959
|
+
"line": 32
|
|
960
960
|
},
|
|
961
961
|
"name": "configureAwsCredentials",
|
|
962
962
|
"optional": true,
|
|
@@ -964,6 +964,42 @@
|
|
|
964
964
|
"primitive": "string"
|
|
965
965
|
}
|
|
966
966
|
},
|
|
967
|
+
{
|
|
968
|
+
"abstract": true,
|
|
969
|
+
"docs": {
|
|
970
|
+
"default": "'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' // v8.1.1",
|
|
971
|
+
"stability": "stable",
|
|
972
|
+
"summary": "The `peter-evans/create-pull-request` action reference, used by projen's built-in dependency-upgrade workflow to open the upgrade PR."
|
|
973
|
+
},
|
|
974
|
+
"immutable": true,
|
|
975
|
+
"locationInModule": {
|
|
976
|
+
"filename": "src/WorkflowActionVersions.ts",
|
|
977
|
+
"line": 54
|
|
978
|
+
},
|
|
979
|
+
"name": "createPullRequest",
|
|
980
|
+
"optional": true,
|
|
981
|
+
"type": {
|
|
982
|
+
"primitive": "string"
|
|
983
|
+
}
|
|
984
|
+
},
|
|
985
|
+
{
|
|
986
|
+
"abstract": true,
|
|
987
|
+
"docs": {
|
|
988
|
+
"default": "'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' // v8",
|
|
989
|
+
"stability": "stable",
|
|
990
|
+
"summary": "The `actions/download-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs."
|
|
991
|
+
},
|
|
992
|
+
"immutable": true,
|
|
993
|
+
"locationInModule": {
|
|
994
|
+
"filename": "src/WorkflowActionVersions.ts",
|
|
995
|
+
"line": 70
|
|
996
|
+
},
|
|
997
|
+
"name": "downloadArtifact",
|
|
998
|
+
"optional": true,
|
|
999
|
+
"type": {
|
|
1000
|
+
"primitive": "string"
|
|
1001
|
+
}
|
|
1002
|
+
},
|
|
967
1003
|
{
|
|
968
1004
|
"abstract": true,
|
|
969
1005
|
"docs": {
|
|
@@ -974,7 +1010,7 @@
|
|
|
974
1010
|
"immutable": true,
|
|
975
1011
|
"locationInModule": {
|
|
976
1012
|
"filename": "src/WorkflowActionVersions.ts",
|
|
977
|
-
"line":
|
|
1013
|
+
"line": 46
|
|
978
1014
|
},
|
|
979
1015
|
"name": "githubScript",
|
|
980
1016
|
"optional": true,
|
|
@@ -992,7 +1028,7 @@
|
|
|
992
1028
|
"immutable": true,
|
|
993
1029
|
"locationInModule": {
|
|
994
1030
|
"filename": "src/WorkflowActionVersions.ts",
|
|
995
|
-
"line":
|
|
1031
|
+
"line": 39
|
|
996
1032
|
},
|
|
997
1033
|
"name": "pnpmActionSetup",
|
|
998
1034
|
"optional": true,
|
|
@@ -1000,6 +1036,24 @@
|
|
|
1000
1036
|
"primitive": "string"
|
|
1001
1037
|
}
|
|
1002
1038
|
},
|
|
1039
|
+
{
|
|
1040
|
+
"abstract": true,
|
|
1041
|
+
"docs": {
|
|
1042
|
+
"default": "'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50' // v6.1.1",
|
|
1043
|
+
"stability": "stable",
|
|
1044
|
+
"summary": "The `amannn/action-semantic-pull-request` action reference, used by projen's built-in pull-request-lint workflow to validate PR titles."
|
|
1045
|
+
},
|
|
1046
|
+
"immutable": true,
|
|
1047
|
+
"locationInModule": {
|
|
1048
|
+
"filename": "src/WorkflowActionVersions.ts",
|
|
1049
|
+
"line": 78
|
|
1050
|
+
},
|
|
1051
|
+
"name": "semanticPullRequest",
|
|
1052
|
+
"optional": true,
|
|
1053
|
+
"type": {
|
|
1054
|
+
"primitive": "string"
|
|
1055
|
+
}
|
|
1056
|
+
},
|
|
1003
1057
|
{
|
|
1004
1058
|
"abstract": true,
|
|
1005
1059
|
"docs": {
|
|
@@ -1010,13 +1064,31 @@
|
|
|
1010
1064
|
"immutable": true,
|
|
1011
1065
|
"locationInModule": {
|
|
1012
1066
|
"filename": "src/WorkflowActionVersions.ts",
|
|
1013
|
-
"line":
|
|
1067
|
+
"line": 25
|
|
1014
1068
|
},
|
|
1015
1069
|
"name": "setupNode",
|
|
1016
1070
|
"optional": true,
|
|
1017
1071
|
"type": {
|
|
1018
1072
|
"primitive": "string"
|
|
1019
1073
|
}
|
|
1074
|
+
},
|
|
1075
|
+
{
|
|
1076
|
+
"abstract": true,
|
|
1077
|
+
"docs": {
|
|
1078
|
+
"default": "'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' // v7",
|
|
1079
|
+
"stability": "stable",
|
|
1080
|
+
"summary": "The `actions/upload-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs."
|
|
1081
|
+
},
|
|
1082
|
+
"immutable": true,
|
|
1083
|
+
"locationInModule": {
|
|
1084
|
+
"filename": "src/WorkflowActionVersions.ts",
|
|
1085
|
+
"line": 62
|
|
1086
|
+
},
|
|
1087
|
+
"name": "uploadArtifact",
|
|
1088
|
+
"optional": true,
|
|
1089
|
+
"type": {
|
|
1090
|
+
"primitive": "string"
|
|
1091
|
+
}
|
|
1020
1092
|
}
|
|
1021
1093
|
],
|
|
1022
1094
|
"symbolId": "src/WorkflowActionVersions:WorkflowActionVersions"
|
|
@@ -1068,6 +1140,6 @@
|
|
|
1068
1140
|
"symbolId": "src/WorkflowAutoDiscover:WorkflowAutoDiscover"
|
|
1069
1141
|
}
|
|
1070
1142
|
},
|
|
1071
|
-
"version": "1.17.
|
|
1072
|
-
"fingerprint": "
|
|
1143
|
+
"version": "1.17.3",
|
|
1144
|
+
"fingerprint": "P+oTgE5PvMlTAfLt/cPc3/R0/p+eE8VKJnnVlGRzP4Y="
|
|
1073
1145
|
}
|
package/API.md
CHANGED
|
@@ -10648,7 +10648,7 @@ Overrides for the pinned action versions used by this workflow.
|
|
|
10648
10648
|
|
|
10649
10649
|
### WorkflowActionVersions <a name="WorkflowActionVersions" id="@macedon-technologies/batman.WorkflowActionVersions"></a>
|
|
10650
10650
|
|
|
10651
|
-
SHA-pinned action references used by the generated deploy/cleanup workflows.
|
|
10651
|
+
SHA-pinned action references used by the generated deploy/cleanup workflows, and applied to the workflows AwsCdkTypeScriptApp generates on its own (upgrade.yml, pull-request-lint.yml) via `hardenProjenGeneratedWorkflows` — see `ProjenWorkflowHardening.ts`.
|
|
10652
10652
|
|
|
10653
10653
|
zizmor flags unpinned `uses:` references as a high-severity finding
|
|
10654
10654
|
(https://docs.zizmor.sh/audits/#unpinned-uses) because a mutable tag can be
|
|
@@ -10670,9 +10670,13 @@ const workflowActionVersions: WorkflowActionVersions = { ... }
|
|
|
10670
10670
|
| --- | --- | --- |
|
|
10671
10671
|
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.checkout">checkout</a></code> | <code>string</code> | The `actions/checkout` action reference. |
|
|
10672
10672
|
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.configureAwsCredentials">configureAwsCredentials</a></code> | <code>string</code> | The `aws-actions/configure-aws-credentials` action reference. |
|
|
10673
|
+
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.createPullRequest">createPullRequest</a></code> | <code>string</code> | The `peter-evans/create-pull-request` action reference, used by projen's built-in dependency-upgrade workflow to open the upgrade PR. |
|
|
10674
|
+
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.downloadArtifact">downloadArtifact</a></code> | <code>string</code> | The `actions/download-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs. |
|
|
10673
10675
|
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.githubScript">githubScript</a></code> | <code>string</code> | The `actions/github-script` action reference. |
|
|
10674
10676
|
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.pnpmActionSetup">pnpmActionSetup</a></code> | <code>string</code> | The `pnpm/action-setup` action reference, used when the project's package manager is pnpm. |
|
|
10677
|
+
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.semanticPullRequest">semanticPullRequest</a></code> | <code>string</code> | The `amannn/action-semantic-pull-request` action reference, used by projen's built-in pull-request-lint workflow to validate PR titles. |
|
|
10675
10678
|
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.setupNode">setupNode</a></code> | <code>string</code> | The `actions/setup-node` action reference. |
|
|
10679
|
+
| <code><a href="#@macedon-technologies/batman.WorkflowActionVersions.property.uploadArtifact">uploadArtifact</a></code> | <code>string</code> | The `actions/upload-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs. |
|
|
10676
10680
|
|
|
10677
10681
|
---
|
|
10678
10682
|
|
|
@@ -10702,6 +10706,32 @@ The `aws-actions/configure-aws-credentials` action reference.
|
|
|
10702
10706
|
|
|
10703
10707
|
---
|
|
10704
10708
|
|
|
10709
|
+
##### `createPullRequest`<sup>Optional</sup> <a name="createPullRequest" id="@macedon-technologies/batman.WorkflowActionVersions.property.createPullRequest"></a>
|
|
10710
|
+
|
|
10711
|
+
```typescript
|
|
10712
|
+
public readonly createPullRequest: string;
|
|
10713
|
+
```
|
|
10714
|
+
|
|
10715
|
+
- *Type:* string
|
|
10716
|
+
- *Default:* 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' // v8.1.1
|
|
10717
|
+
|
|
10718
|
+
The `peter-evans/create-pull-request` action reference, used by projen's built-in dependency-upgrade workflow to open the upgrade PR.
|
|
10719
|
+
|
|
10720
|
+
---
|
|
10721
|
+
|
|
10722
|
+
##### `downloadArtifact`<sup>Optional</sup> <a name="downloadArtifact" id="@macedon-technologies/batman.WorkflowActionVersions.property.downloadArtifact"></a>
|
|
10723
|
+
|
|
10724
|
+
```typescript
|
|
10725
|
+
public readonly downloadArtifact: string;
|
|
10726
|
+
```
|
|
10727
|
+
|
|
10728
|
+
- *Type:* string
|
|
10729
|
+
- *Default:* 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' // v8
|
|
10730
|
+
|
|
10731
|
+
The `actions/download-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs.
|
|
10732
|
+
|
|
10733
|
+
---
|
|
10734
|
+
|
|
10705
10735
|
##### `githubScript`<sup>Optional</sup> <a name="githubScript" id="@macedon-technologies/batman.WorkflowActionVersions.property.githubScript"></a>
|
|
10706
10736
|
|
|
10707
10737
|
```typescript
|
|
@@ -10728,6 +10758,19 @@ The `pnpm/action-setup` action reference, used when the project's package manage
|
|
|
10728
10758
|
|
|
10729
10759
|
---
|
|
10730
10760
|
|
|
10761
|
+
##### `semanticPullRequest`<sup>Optional</sup> <a name="semanticPullRequest" id="@macedon-technologies/batman.WorkflowActionVersions.property.semanticPullRequest"></a>
|
|
10762
|
+
|
|
10763
|
+
```typescript
|
|
10764
|
+
public readonly semanticPullRequest: string;
|
|
10765
|
+
```
|
|
10766
|
+
|
|
10767
|
+
- *Type:* string
|
|
10768
|
+
- *Default:* 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50' // v6.1.1
|
|
10769
|
+
|
|
10770
|
+
The `amannn/action-semantic-pull-request` action reference, used by projen's built-in pull-request-lint workflow to validate PR titles.
|
|
10771
|
+
|
|
10772
|
+
---
|
|
10773
|
+
|
|
10731
10774
|
##### `setupNode`<sup>Optional</sup> <a name="setupNode" id="@macedon-technologies/batman.WorkflowActionVersions.property.setupNode"></a>
|
|
10732
10775
|
|
|
10733
10776
|
```typescript
|
|
@@ -10741,5 +10784,18 @@ The `actions/setup-node` action reference.
|
|
|
10741
10784
|
|
|
10742
10785
|
---
|
|
10743
10786
|
|
|
10787
|
+
##### `uploadArtifact`<sup>Optional</sup> <a name="uploadArtifact" id="@macedon-technologies/batman.WorkflowActionVersions.property.uploadArtifact"></a>
|
|
10788
|
+
|
|
10789
|
+
```typescript
|
|
10790
|
+
public readonly uploadArtifact: string;
|
|
10791
|
+
```
|
|
10792
|
+
|
|
10793
|
+
- *Type:* string
|
|
10794
|
+
- *Default:* 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' // v7
|
|
10795
|
+
|
|
10796
|
+
The `actions/upload-artifact` action reference, used by projen's built-in dependency-upgrade workflow to pass the upgrade patch between jobs.
|
|
10797
|
+
|
|
10798
|
+
---
|
|
10799
|
+
|
|
10744
10800
|
|
|
10745
10801
|
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Synthesizes a representative BatmanProject and scans
|
|
3
|
-
*
|
|
4
|
-
* regressions in PrDeployWorkflow.ts/PrCleanupWorkflow.ts/etc.
|
|
5
|
-
* here rather than shipping to every consumer of this construct.
|
|
2
|
+
* Synthesizes a representative BatmanProject and scans every GitHub Actions
|
|
3
|
+
* workflow it generates for downstream consumer repos with zizmor, so
|
|
4
|
+
* regressions in PrDeployWorkflow.ts/PrCleanupWorkflow.ts/ProjenWorkflowHardening.ts/etc.
|
|
5
|
+
* are caught here rather than shipping to every consumer of this construct.
|
|
6
6
|
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
7
|
+
* This includes upgrade.yml and pull-request-lint.yml, which AwsCdkTypeScriptApp
|
|
8
|
+
* generates on its own with unpinned action tags and (for pull-request-lint.yml) a
|
|
9
|
+
* pull_request_target trigger — see macedon-technologies/exman#13, where those
|
|
10
|
+
* defaults leaked into a consumer repo unpinned. `Application` corrects both via
|
|
11
|
+
* `hardenProjenGeneratedWorkflows`, and this scan is what would have caught it.
|
|
12
12
|
*/
|
|
13
13
|
import { execFileSync } from 'child_process';
|
|
14
14
|
import { mkdtempSync, rmSync } from 'fs';
|
|
@@ -42,8 +42,15 @@ try {
|
|
|
42
42
|
prod: ENV,
|
|
43
43
|
});
|
|
44
44
|
project.synth();
|
|
45
|
-
const
|
|
46
|
-
|
|
45
|
+
const GENERATED_WORKFLOWS = [
|
|
46
|
+
'pr-deploy.yml',
|
|
47
|
+
'pr-cleanup.yml',
|
|
48
|
+
'staging-deploy.yml',
|
|
49
|
+
'production-deploy.yml',
|
|
50
|
+
'upgrade.yml',
|
|
51
|
+
'pull-request-lint.yml',
|
|
52
|
+
];
|
|
53
|
+
const paths = GENERATED_WORKFLOWS.map((f) => join(outdir, '.github', 'workflows', f));
|
|
47
54
|
execFileSync('uvx', [`zizmor@${ZIZMOR_VERSION}`, ...paths], { stdio: 'inherit' });
|
|
48
55
|
} finally {
|
|
49
56
|
rmSync(outdir, { recursive: true, force: true });
|
package/lib/Application.js
CHANGED
|
@@ -13,6 +13,7 @@ const MainTestFile_1 = require("./MainTestFile");
|
|
|
13
13
|
const PrCleanupWorkflow_1 = require("./PrCleanupWorkflow");
|
|
14
14
|
const PrDeployWorkflow_1 = require("./PrDeployWorkflow");
|
|
15
15
|
const ProductionDeployWorkflow_1 = require("./ProductionDeployWorkflow");
|
|
16
|
+
const ProjenWorkflowHardening_1 = require("./ProjenWorkflowHardening");
|
|
16
17
|
const StagingDeployWorkflow_1 = require("./StagingDeployWorkflow");
|
|
17
18
|
const StaticWebsiteConstructFile_1 = require("./StaticWebsiteConstructFile");
|
|
18
19
|
const WorkflowAutoDiscover_1 = require("./WorkflowAutoDiscover");
|
|
@@ -81,7 +82,11 @@ class Application {
|
|
|
81
82
|
clerkPublishableKey: options.prod.clerkPublishableKey,
|
|
82
83
|
actionVersions: options.actionVersions,
|
|
83
84
|
});
|
|
85
|
+
// Harden the workflows AwsCdkTypeScriptApp generates on its own (upgrade.yml,
|
|
86
|
+
// pull-request-lint.yml), which otherwise ship with unpinned actions and a
|
|
87
|
+
// pull_request_target trigger zizmor flags on every consumer of this construct.
|
|
88
|
+
(0, ProjenWorkflowHardening_1.hardenProjenGeneratedWorkflows)(project, options.actionVersions);
|
|
84
89
|
}
|
|
85
90
|
}
|
|
86
91
|
exports.Application = Application;
|
|
87
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
92
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQXBwbGljYXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvQXBwbGljYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQ0EsNkNBQTBDO0FBQzFDLHlEQUFzRDtBQUN0RCxpRUFBOEQ7QUFDOUQseUVBQXNFO0FBQ3RFLHFEQUFrRDtBQUNsRCxpRUFBOEQ7QUFDOUQsbURBQWdEO0FBQ2hELHlDQUF5RDtBQUN6RCxpREFBOEM7QUFDOUMsMkRBQXdEO0FBQ3hELHlEQUFzRDtBQUN0RCx5RUFBc0U7QUFDdEUsdUVBQTJFO0FBQzNFLG1FQUFnRTtBQUNoRSw2RUFBMEU7QUFFMUUsaUVBQThEO0FBQzlELHlEQUEwRDtBQTJCMUQ7O0dBRUc7QUFDSCxNQUFhLFdBQVc7SUFDdEIsWUFBWSxPQUE0QixFQUFFLE9BQTJCO1FBQ25FLGdDQUFnQztRQUVoQyxJQUFJLG1CQUFRLENBQUMsT0FBTyxFQUFFO1lBQ3BCLFdBQVcsRUFBRSxPQUFPLENBQUMsSUFBSTtZQUN6QixHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7WUFDaEIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO1lBQ3hCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixjQUFjLEVBQUUsT0FBTyxDQUFDLGNBQWM7U0FDdkMsQ0FBQyxDQUFDO1FBRUgsSUFBSSw2QkFBYSxDQUFDLE9BQU8sRUFBRTtZQUN6QixXQUFXLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDekIsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHO1NBQ2pCLENBQUMsQ0FBQztRQUVILHFCQUFxQjtRQUNyQixJQUFJLDJDQUFvQixDQUFDLE9BQU8sRUFBRTtZQUNoQyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsZ0JBQWdCO1NBQzNDLENBQUMsQ0FBQztRQUVILElBQUksbURBQXdCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEMsSUFBSSwyQ0FBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVsQyx5QkFBeUI7UUFDekIsSUFBSSxtQ0FBZ0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSx1QkFBdUIsRUFBRSxPQUFPLENBQUMsdUJBQXVCLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLElBQUksdURBQTBCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFeEMscUJBQXFCO1FBQ3JCLElBQUksT0FBTyxDQUFDLFlBQVksS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQy9ELElBQUksdUNBQW9CLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDbEMsSUFBSSwyQ0FBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNwQyxDQUFDO1FBRUQsbURBQW1EO1FBQ25ELElBQUksbUJBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUV0QixvQkFBb0I7UUFDcEIsSUFBSSwyQkFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRTFCLHNCQUFzQjtRQUN0QixJQUFJLCtCQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFNUIsa0NBQWtDO1FBQ2xDLElBQUksbUNBQWdCLENBQUMsT0FBTyxFQUFFO1lBQzVCLE9BQU8sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQjtZQUN4QyxTQUFTLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNO1lBQzdCLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CO1lBQ3BELGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztTQUN2QyxDQUFDLENBQUM7UUFFSCxJQUFJLHFDQUFpQixDQUFDLE9BQU8sRUFBRTtZQUM3QixPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUI7WUFDeEMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTTtZQUM3QixXQUFXLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDekIsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjO1NBQ3ZDLENBQUMsQ0FBQztRQUVILElBQUksNkNBQXFCLENBQUMsT0FBTyxFQUFFO1lBQ2pDLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQjtZQUM1QyxTQUFTLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNO1lBQ2pDLFdBQVcsRUFBRSxPQUFPLENBQUMsSUFBSTtZQUN6QixtQkFBbUIsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQjtZQUN4RCxjQUFjLEVBQUUsT0FBTyxDQUFDLGNBQWM7U0FDdkMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxtREFBd0IsQ0FBQyxPQUFPLEVBQUU7WUFDcEMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsbUJBQW1CO1lBQ3pDLFNBQVMsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU07WUFDOUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ3pCLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsbUJBQW1CO1lBQ3JELGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztTQUN2QyxDQUFDLENBQUM7UUFFSCw4RUFBOEU7UUFDOUUsMkVBQTJFO1FBQzNFLGdGQUFnRjtRQUNoRixJQUFBLHdEQUE4QixFQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDbEUsQ0FBQztDQUNGO0FBaEZELGtDQWdGQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEF3c0Nka1R5cGVTY3JpcHRBcHAgfSBmcm9tICdwcm9qZW4vbGliL2F3c2Nkayc7XG5pbXBvcnQgeyBBcGlGaWxlcyB9IGZyb20gJy4vQXBpL0FwaUZpbGVzJztcbmltcG9ydCB7IEFwaUNvbnN0cnVjdEZpbGUgfSBmcm9tICcuL0FwaUNvbnN0cnVjdEZpbGUnO1xuaW1wb3J0IHsgQXBwbGljYXRpb25TdGFja0ZpbGUgfSBmcm9tICcuL0FwcGxpY2F0aW9uU3RhY2tGaWxlJztcbmltcG9ydCB7IEJhc2VBcHBsaWNhdGlvblN0YWNrRmlsZSB9IGZyb20gJy4vQmFzZUFwcGxpY2F0aW9uU3RhY2tGaWxlJztcbmltcG9ydCB7IENvZGVSYWJiaXRGaWxlIH0gZnJvbSAnLi9Db2RlUmFiYml0RmlsZSc7XG5pbXBvcnQgeyBHaXRIdWJSb2xlc1N0YWNrRmlsZSB9IGZyb20gJy4vR2l0SHViUm9sZXNTdGFja0ZpbGUnO1xuaW1wb3J0IHsgTG9jYWxEZXZGaWxlcyB9IGZyb20gJy4vTG9jYWxEZXZGaWxlcyc7XG5pbXBvcnQgeyBFbnZpcm9ubWVudENvbmZpZywgTWFpbkZpbGUgfSBmcm9tICcuL01haW5GaWxlJztcbmltcG9ydCB7IE1haW5UZXN0RmlsZSB9IGZyb20gJy4vTWFpblRlc3RGaWxlJztcbmltcG9ydCB7IFByQ2xlYW51cFdvcmtmbG93IH0gZnJvbSAnLi9QckNsZWFudXBXb3JrZmxvdyc7XG5pbXBvcnQgeyBQckRlcGxveVdvcmtmbG93IH0gZnJvbSAnLi9QckRlcGxveVdvcmtmbG93JztcbmltcG9ydCB7IFByb2R1Y3Rpb25EZXBsb3lXb3JrZmxvdyB9IGZyb20gJy4vUHJvZHVjdGlvbkRlcGxveVdvcmtmbG93JztcbmltcG9ydCB7IGhhcmRlblByb2plbkdlbmVyYXRlZFdvcmtmbG93cyB9IGZyb20gJy4vUHJvamVuV29ya2Zsb3dIYXJkZW5pbmcnO1xuaW1wb3J0IHsgU3RhZ2luZ0RlcGxveVdvcmtmbG93IH0gZnJvbSAnLi9TdGFnaW5nRGVwbG95V29ya2Zsb3cnO1xuaW1wb3J0IHsgU3RhdGljV2Vic2l0ZUNvbnN0cnVjdEZpbGUgfSBmcm9tICcuL1N0YXRpY1dlYnNpdGVDb25zdHJ1Y3RGaWxlJztcbmltcG9ydCB7IFdvcmtmbG93QWN0aW9uVmVyc2lvbnMgfSBmcm9tICcuL1dvcmtmbG93QWN0aW9uVmVyc2lvbnMnO1xuaW1wb3J0IHsgV29ya2Zsb3dBdXRvRGlzY292ZXIgfSBmcm9tICcuL1dvcmtmbG93QXV0b0Rpc2NvdmVyJztcbmltcG9ydCB7IFdvcmtmbG93UHJvdmlkZXJGaWxlIH0gZnJvbSAnLi9Xb3JrZmxvd1Byb3ZpZGVyJztcblxuZXhwb3J0IGludGVyZmFjZSBBcHBsaWNhdGlvbkVudmlyb25tZW50Q29uZmlnIGV4dGVuZHMgRW52aXJvbm1lbnRDb25maWcge1xuICByZWFkb25seSBnaXRodWJBY3Rpb25Sb2xlQXJuOiBgYXJuOmF3czppYW06OiR7c3RyaW5nfTpyb2xlLyR7c3RyaW5nfWA7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgQXBwbGljYXRpb25PcHRpb25zIHtcbiAgcmVhZG9ubHkgZ2l0aHViUmVwb3NpdG9yeTogc3RyaW5nO1xuICByZWFkb25seSBkZXY6IEFwcGxpY2F0aW9uRW52aXJvbm1lbnRDb25maWc7XG4gIHJlYWRvbmx5IHN0YWdpbmc6IEFwcGxpY2F0aW9uRW52aXJvbm1lbnRDb25maWc7XG4gIHJlYWRvbmx5IHByb2Q6IEFwcGxpY2F0aW9uRW52aXJvbm1lbnRDb25maWc7XG4gIHJlYWRvbmx5IGFkZGl0aW9uYWxUYWdzPzogeyBba2V5OiBzdHJpbmddOiBzdHJpbmcgfTtcbiAgcmVhZG9ubHkgbjhuV29ya2Zsb3dzPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogT3ZlcnJpZGVzIGZvciB0aGUgcGlubmVkIGFjdGlvbiB2ZXJzaW9ucyB1c2VkIGJ5IHRoZSBnZW5lcmF0ZWQgR2l0SHViIEFjdGlvbnMgd29ya2Zsb3dzLlxuICAgKi9cbiAgcmVhZG9ubHkgYWN0aW9uVmVyc2lvbnM/OiBXb3JrZmxvd0FjdGlvblZlcnNpb25zO1xuXG4gIC8qKlxuICAgKiBPdmVycmlkZXMgdGhlIHBpbm5lZCBTMyBvYmplY3QgdmVyc2lvbiBvZiB0aGUgY2xlcmstYXV0aG9yaXplciBMYW1iZGEgZGVwbG95bWVudCBwYWNrYWdlLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIHRoZSBkZWZhdWx0IHBpbm5lZCBpbiBBcGlDb25zdHJ1Y3RGaWxlXG4gICAqL1xuICByZWFkb25seSBhdXRob3JpemVyT2JqZWN0VmVyc2lvbj86IHN0cmluZztcbn1cblxuLyoqXG4gKiBBcHBsaWNhdGlvbiBjb25zdHJ1Y3QgdGhhdCBjcmVhdGVzIGFsbCBzdGFuZGFyZCBwcm9qZWN0IGZpbGVzXG4gKi9cbmV4cG9ydCBjbGFzcyBBcHBsaWNhdGlvbiB7XG4gIGNvbnN0cnVjdG9yKHByb2plY3Q6IEF3c0Nka1R5cGVTY3JpcHRBcHAsIG9wdGlvbnM6IEFwcGxpY2F0aW9uT3B0aW9ucykge1xuICAgIC8vIENyZWF0ZSBtYWluIGVudHJ5IHBvaW50IGZpbGVzXG5cbiAgICBuZXcgTWFpbkZpbGUocHJvamVjdCwge1xuICAgICAgcHJvamVjdE5hbWU6IHByb2plY3QubmFtZSxcbiAgICAgIGRldjogb3B0aW9ucy5kZXYsXG4gICAgICBzdGFnaW5nOiBvcHRpb25zLnN0YWdpbmcsXG4gICAgICBwcm9kOiBvcHRpb25zLnByb2QsXG4gICAgICBhZGRpdGlvbmFsVGFnczogb3B0aW9ucy5hZGRpdGlvbmFsVGFncyxcbiAgICB9KTtcblxuICAgIG5ldyBMb2NhbERldkZpbGVzKHByb2plY3QsIHtcbiAgICAgIHByb2plY3ROYW1lOiBwcm9qZWN0Lm5hbWUsXG4gICAgICBkZXY6IG9wdGlvbnMuZGV2LFxuICAgIH0pO1xuXG4gICAgLy8gQ3JlYXRlIHN0YWNrIGZpbGVzXG4gICAgbmV3IEdpdEh1YlJvbGVzU3RhY2tGaWxlKHByb2plY3QsIHtcbiAgICAgIGdpdGh1YlJlcG9zaXRvcnk6IG9wdGlvbnMuZ2l0aHViUmVwb3NpdG9yeSxcbiAgICB9KTtcblxuICAgIG5ldyBCYXNlQXBwbGljYXRpb25TdGFja0ZpbGUocHJvamVjdCk7XG4gICAgbmV3IEFwcGxpY2F0aW9uU3RhY2tGaWxlKHByb2plY3QpO1xuXG4gICAgLy8gQ3JlYXRlIGNvbnN0cnVjdCBmaWxlc1xuICAgIG5ldyBBcGlDb25zdHJ1Y3RGaWxlKHByb2plY3QsIHsgYXV0aG9yaXplck9iamVjdFZlcnNpb246IG9wdGlvbnMuYXV0aG9yaXplck9iamVjdFZlcnNpb24gfSk7XG4gICAgbmV3IFN0YXRpY1dlYnNpdGVDb25zdHJ1Y3RGaWxlKHByb2plY3QpO1xuXG4gICAgLy8gbjhuIHdvcmtmbG93IGZpbGVzXG4gICAgaWYgKG9wdGlvbnMubjhuV29ya2Zsb3dzID09PSB1bmRlZmluZWQgfHwgb3B0aW9ucy5uOG5Xb3JrZmxvd3MpIHtcbiAgICAgIG5ldyBXb3JrZmxvd1Byb3ZpZGVyRmlsZShwcm9qZWN0KTtcbiAgICAgIG5ldyBXb3JrZmxvd0F1dG9EaXNjb3Zlcihwcm9qZWN0KTtcbiAgICB9XG5cbiAgICAvLyBDcmVhdGUgaGFuZGxlciBmaWxlcyBhbmQgQVBJIGJhY2tlbmQgbG9naWMgZmlsZXNcbiAgICBuZXcgQXBpRmlsZXMocHJvamVjdCk7XG5cbiAgICAvLyBDcmVhdGUgdGVzdCBmaWxlc1xuICAgIG5ldyBNYWluVGVzdEZpbGUocHJvamVjdCk7XG5cbiAgICAvLyBDcmVhdGUgY29uZmlnIGZpbGVzXG4gICAgbmV3IENvZGVSYWJiaXRGaWxlKHByb2plY3QpO1xuXG4gICAgLy8gQ3JlYXRlIEdpdEh1YiBBY3Rpb25zIHdvcmtmbG93c1xuICAgIG5ldyBQckRlcGxveVdvcmtmbG93KHByb2plY3QsIHtcbiAgICAgIHJvbGVBcm46IG9wdGlvbnMuZGV2LmdpdGh1YkFjdGlvblJvbGVBcm4sXG4gICAgICBhd3NSZWdpb246IG9wdGlvbnMuZGV2LnJlZ2lvbixcbiAgICAgIGNsZXJrUHVibGlzaGFibGVLZXk6IG9wdGlvbnMuZGV2LmNsZXJrUHVibGlzaGFibGVLZXksXG4gICAgICBhY3Rpb25WZXJzaW9uczogb3B0aW9ucy5hY3Rpb25WZXJzaW9ucyxcbiAgICB9KTtcblxuICAgIG5ldyBQckNsZWFudXBXb3JrZmxvdyhwcm9qZWN0LCB7XG4gICAgICByb2xlQXJuOiBvcHRpb25zLmRldi5naXRodWJBY3Rpb25Sb2xlQXJuLFxuICAgICAgYXdzUmVnaW9uOiBvcHRpb25zLmRldi5yZWdpb24sXG4gICAgICBwcm9qZWN0TmFtZTogcHJvamVjdC5uYW1lLFxuICAgICAgYWN0aW9uVmVyc2lvbnM6IG9wdGlvbnMuYWN0aW9uVmVyc2lvbnMsXG4gICAgfSk7XG5cbiAgICBuZXcgU3RhZ2luZ0RlcGxveVdvcmtmbG93KHByb2plY3QsIHtcbiAgICAgIHJvbGVBcm46IG9wdGlvbnMuc3RhZ2luZy5naXRodWJBY3Rpb25Sb2xlQXJuLFxuICAgICAgYXdzUmVnaW9uOiBvcHRpb25zLnN0YWdpbmcucmVnaW9uLFxuICAgICAgcHJvamVjdE5hbWU6IHByb2plY3QubmFtZSxcbiAgICAgIGNsZXJrUHVibGlzaGFibGVLZXk6IG9wdGlvbnMuc3RhZ2luZy5jbGVya1B1Ymxpc2hhYmxlS2V5LFxuICAgICAgYWN0aW9uVmVyc2lvbnM6IG9wdGlvbnMuYWN0aW9uVmVyc2lvbnMsXG4gICAgfSk7XG5cbiAgICBuZXcgUHJvZHVjdGlvbkRlcGxveVdvcmtmbG93KHByb2plY3QsIHtcbiAgICAgIHJvbGVBcm46IG9wdGlvbnMucHJvZC5naXRodWJBY3Rpb25Sb2xlQXJuLFxuICAgICAgYXdzUmVnaW9uOiBvcHRpb25zLnByb2QucmVnaW9uLFxuICAgICAgcHJvamVjdE5hbWU6IHByb2plY3QubmFtZSxcbiAgICAgIGNsZXJrUHVibGlzaGFibGVLZXk6IG9wdGlvbnMucHJvZC5jbGVya1B1Ymxpc2hhYmxlS2V5LFxuICAgICAgYWN0aW9uVmVyc2lvbnM6IG9wdGlvbnMuYWN0aW9uVmVyc2lvbnMsXG4gICAgfSk7XG5cbiAgICAvLyBIYXJkZW4gdGhlIHdvcmtmbG93cyBBd3NDZGtUeXBlU2NyaXB0QXBwIGdlbmVyYXRlcyBvbiBpdHMgb3duICh1cGdyYWRlLnltbCxcbiAgICAvLyBwdWxsLXJlcXVlc3QtbGludC55bWwpLCB3aGljaCBvdGhlcndpc2Ugc2hpcCB3aXRoIHVucGlubmVkIGFjdGlvbnMgYW5kIGFcbiAgICAvLyBwdWxsX3JlcXVlc3RfdGFyZ2V0IHRyaWdnZXIgeml6bW9yIGZsYWdzIG9uIGV2ZXJ5IGNvbnN1bWVyIG9mIHRoaXMgY29uc3RydWN0LlxuICAgIGhhcmRlblByb2plbkdlbmVyYXRlZFdvcmtmbG93cyhwcm9qZWN0LCBvcHRpb25zLmFjdGlvblZlcnNpb25zKTtcbiAgfVxufVxuIl19
|
package/lib/BatmanProject.js
CHANGED
|
@@ -11,7 +11,7 @@ const GitHubRolesFile_1 = require("./GitHubRolesFile");
|
|
|
11
11
|
const utils_1 = require("./utils");
|
|
12
12
|
const ViteReactProject_1 = require("./ViteReactProject");
|
|
13
13
|
class BatmanProject extends awscdk_1.AwsCdkTypeScriptApp {
|
|
14
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.BatmanProject", version: "1.17.
|
|
14
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.BatmanProject", version: "1.17.3" };
|
|
15
15
|
constructor(options) {
|
|
16
16
|
super({
|
|
17
17
|
...options,
|
package/lib/BootcampProject.js
CHANGED
|
@@ -11,7 +11,7 @@ const GitHubRolesFile_1 = require("./GitHubRolesFile");
|
|
|
11
11
|
const utils_1 = require("./utils");
|
|
12
12
|
const ViteReactProject_1 = require("./ViteReactProject");
|
|
13
13
|
class BootcampProject extends awscdk_1.AwsCdkTypeScriptApp {
|
|
14
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.BootcampProject", version: "1.17.
|
|
14
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.BootcampProject", version: "1.17.3" };
|
|
15
15
|
constructor(options) {
|
|
16
16
|
super({
|
|
17
17
|
...options,
|
package/lib/CodeOwnersFile.js
CHANGED
|
@@ -4,7 +4,7 @@ exports.CodeOwnersFile = void 0;
|
|
|
4
4
|
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
|
|
5
5
|
const projen_1 = require("projen");
|
|
6
6
|
class CodeOwnersFile extends projen_1.TextFile {
|
|
7
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.CodeOwnersFile", version: "1.17.
|
|
7
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.CodeOwnersFile", version: "1.17.3" };
|
|
8
8
|
constructor(project, options = {}) {
|
|
9
9
|
const defaultOwners = ['* @macedon-technologies/platform'];
|
|
10
10
|
const allOwners = [...defaultOwners, ...(options.additionalOwners || [])];
|
|
@@ -7,7 +7,7 @@ const javascript_1 = require("projen/lib/javascript");
|
|
|
7
7
|
const utils_1 = require("./utils");
|
|
8
8
|
const WorkflowActionVersions_1 = require("./WorkflowActionVersions");
|
|
9
9
|
class ProductionDeployWorkflow extends projen_1.YamlFile {
|
|
10
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.ProductionDeployWorkflow", version: "1.17.
|
|
10
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.ProductionDeployWorkflow", version: "1.17.3" };
|
|
11
11
|
constructor(project, options) {
|
|
12
12
|
const packageManager = project.package.packageManager;
|
|
13
13
|
const actionVersions = (0, WorkflowActionVersions_1.resolveActionVersions)(options.actionVersions);
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import { AwsCdkTypeScriptApp } from 'projen/lib/awscdk';
|
|
2
|
+
import { WorkflowActionVersions } from './WorkflowActionVersions';
|
|
3
|
+
/**
|
|
4
|
+
* Hardens the GitHub Actions workflows that `AwsCdkTypeScriptApp` generates on its own
|
|
5
|
+
* (`upgrade.yml`, `pull-request-lint.yml`, ...) against the zizmor findings raised on
|
|
6
|
+
* consumer repos (e.g. macedon-technologies/exman#13).
|
|
7
|
+
*
|
|
8
|
+
* These workflows aren't hand-authored by this package the way `PrDeployWorkflow`/
|
|
9
|
+
* `PrCleanupWorkflow`/etc. are, so they can't be pinned by writing a literal SHA into a
|
|
10
|
+
* `uses:` string. projen exposes `project.github.actions` for exactly this case: every
|
|
11
|
+
* `uses:` rendered by a `GithubWorkflow`/`Job` (including projen's own built-in
|
|
12
|
+
* components) is resolved through it at synthesis time.
|
|
13
|
+
*
|
|
14
|
+
* `persist-credentials` and the `pull_request_target` trigger aren't covered by that
|
|
15
|
+
* registry (it only rewrites `uses:`), so those are corrected with a `JsonPatch` against
|
|
16
|
+
* the synthesized workflow file instead.
|
|
17
|
+
*/
|
|
18
|
+
export declare function hardenProjenGeneratedWorkflows(project: AwsCdkTypeScriptApp, actionVersions?: WorkflowActionVersions): void;
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.hardenProjenGeneratedWorkflows = hardenProjenGeneratedWorkflows;
|
|
4
|
+
const projen_1 = require("projen");
|
|
5
|
+
const WorkflowActionVersions_1 = require("./WorkflowActionVersions");
|
|
6
|
+
/**
|
|
7
|
+
* Hardens the GitHub Actions workflows that `AwsCdkTypeScriptApp` generates on its own
|
|
8
|
+
* (`upgrade.yml`, `pull-request-lint.yml`, ...) against the zizmor findings raised on
|
|
9
|
+
* consumer repos (e.g. macedon-technologies/exman#13).
|
|
10
|
+
*
|
|
11
|
+
* These workflows aren't hand-authored by this package the way `PrDeployWorkflow`/
|
|
12
|
+
* `PrCleanupWorkflow`/etc. are, so they can't be pinned by writing a literal SHA into a
|
|
13
|
+
* `uses:` string. projen exposes `project.github.actions` for exactly this case: every
|
|
14
|
+
* `uses:` rendered by a `GithubWorkflow`/`Job` (including projen's own built-in
|
|
15
|
+
* components) is resolved through it at synthesis time.
|
|
16
|
+
*
|
|
17
|
+
* `persist-credentials` and the `pull_request_target` trigger aren't covered by that
|
|
18
|
+
* registry (it only rewrites `uses:`), so those are corrected with a `JsonPatch` against
|
|
19
|
+
* the synthesized workflow file instead.
|
|
20
|
+
*/
|
|
21
|
+
function hardenProjenGeneratedWorkflows(project, actionVersions) {
|
|
22
|
+
const versions = (0, WorkflowActionVersions_1.resolveActionVersions)(actionVersions);
|
|
23
|
+
const github = project.github;
|
|
24
|
+
if (!github) {
|
|
25
|
+
return;
|
|
26
|
+
}
|
|
27
|
+
// zizmor: unpinned-uses (high) — projen's built-in workflows reference these actions by
|
|
28
|
+
// mutable tag (e.g. `actions/checkout@v6`). Overriding by bare action name repoints every
|
|
29
|
+
// usage projen renders, without touching the hand-authored workflows above (which already
|
|
30
|
+
// embed a resolved SHA literal and never go through this registry). upload-artifact,
|
|
31
|
+
// download-artifact and action-semantic-pull-request weren't reported in #13, but are the
|
|
32
|
+
// same finding on the same two files, so they're pinned here too rather than left ticking.
|
|
33
|
+
github.actions.set('actions/checkout', versions.checkout);
|
|
34
|
+
github.actions.set('actions/setup-node', versions.setupNode);
|
|
35
|
+
github.actions.set('pnpm/action-setup', versions.pnpmActionSetup);
|
|
36
|
+
github.actions.set('actions/github-script', versions.githubScript);
|
|
37
|
+
github.actions.set('peter-evans/create-pull-request', versions.createPullRequest);
|
|
38
|
+
github.actions.set('actions/upload-artifact', versions.uploadArtifact);
|
|
39
|
+
github.actions.set('actions/download-artifact', versions.downloadArtifact);
|
|
40
|
+
github.actions.set('amannn/action-semantic-pull-request', versions.semanticPullRequest);
|
|
41
|
+
// zizmor: artipacked (low) — actions/checkout persists git credentials to disk by
|
|
42
|
+
// default. Neither of upgrade.yml's checkout steps need to push from that checkout
|
|
43
|
+
// (the "pr" job's push happens via peter-evans/create-pull-request with its own token).
|
|
44
|
+
const upgrade = github.tryFindWorkflow('upgrade');
|
|
45
|
+
upgrade?.file?.patch(projen_1.JsonPatch.add('/jobs/upgrade/steps/0/with', { 'persist-credentials': false }), projen_1.JsonPatch.add('/jobs/pr/steps/0/with', { 'persist-credentials': false }));
|
|
46
|
+
// zizmor: dangerous-triggers (high) — pull-request-lint.yml only validates the PR title;
|
|
47
|
+
// it doesn't need pull_request_target's access to secrets/write permissions against
|
|
48
|
+
// untrusted fork content. `pull_request` covers the same title-changed events without
|
|
49
|
+
// the risk. (If a consumer ever needs this check to comment on forked PRs, that consumer
|
|
50
|
+
// should override `pullRequestLintOptions` accordingly instead of reverting this globally.)
|
|
51
|
+
const pullRequestLint = github.tryFindWorkflow('pull-request-lint');
|
|
52
|
+
pullRequestLint?.file?.patch(projen_1.JsonPatch.replace('/on', {
|
|
53
|
+
pull_request: {
|
|
54
|
+
types: ['labeled', 'opened', 'synchronize', 'reopened', 'ready_for_review', 'edited'],
|
|
55
|
+
},
|
|
56
|
+
merge_group: {},
|
|
57
|
+
}));
|
|
58
|
+
}
|
|
59
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUHJvamVuV29ya2Zsb3dIYXJkZW5pbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvUHJvamVuV29ya2Zsb3dIYXJkZW5pbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFtQkEsd0VBNkNDO0FBaEVELG1DQUFtQztBQUVuQyxxRUFBeUY7QUFFekY7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxTQUFnQiw4QkFBOEIsQ0FBQyxPQUE0QixFQUFFLGNBQXVDO0lBQ2xILE1BQU0sUUFBUSxHQUFHLElBQUEsOENBQXFCLEVBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQztJQUM5QixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixPQUFPO0lBQ1QsQ0FBQztJQUVELHdGQUF3RjtJQUN4RiwwRkFBMEY7SUFDMUYsMEZBQTBGO0lBQzFGLHFGQUFxRjtJQUNyRiwwRkFBMEY7SUFDMUYsMkZBQTJGO0lBQzNGLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFrQixFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMxRCxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDN0QsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLEVBQUUsUUFBUSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixFQUFFLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUNuRSxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpQ0FBaUMsRUFBRSxRQUFRLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUNsRixNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyx5QkFBeUIsRUFBRSxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkJBQTJCLEVBQUUsUUFBUSxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0UsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMscUNBQXFDLEVBQUUsUUFBUSxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFFeEYsa0ZBQWtGO0lBQ2xGLG1GQUFtRjtJQUNuRix3RkFBd0Y7SUFDeEYsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRCxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FDbEIsa0JBQVMsQ0FBQyxHQUFHLENBQUMsNEJBQTRCLEVBQUUsRUFBRSxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsQ0FBQyxFQUM3RSxrQkFBUyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsRUFBRSxFQUFFLHFCQUFxQixFQUFFLEtBQUssRUFBRSxDQUFDLENBQ3pFLENBQUM7SUFFRix5RkFBeUY7SUFDekYsb0ZBQW9GO0lBQ3BGLHNGQUFzRjtJQUN0Rix5RkFBeUY7SUFDekYsNEZBQTRGO0lBQzVGLE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyxlQUFlLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUNwRSxlQUFlLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FDMUIsa0JBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO1FBQ3ZCLFlBQVksRUFBRTtZQUNaLEtBQUssRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsYUFBYSxFQUFFLFVBQVUsRUFBRSxrQkFBa0IsRUFBRSxRQUFRLENBQUM7U0FDdEY7UUFDRCxXQUFXLEVBQUUsRUFBRTtLQUNoQixDQUFDLENBQ0gsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBKc29uUGF0Y2ggfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgQXdzQ2RrVHlwZVNjcmlwdEFwcCB9IGZyb20gJ3Byb2plbi9saWIvYXdzY2RrJztcbmltcG9ydCB7IHJlc29sdmVBY3Rpb25WZXJzaW9ucywgV29ya2Zsb3dBY3Rpb25WZXJzaW9ucyB9IGZyb20gJy4vV29ya2Zsb3dBY3Rpb25WZXJzaW9ucyc7XG5cbi8qKlxuICogSGFyZGVucyB0aGUgR2l0SHViIEFjdGlvbnMgd29ya2Zsb3dzIHRoYXQgYEF3c0Nka1R5cGVTY3JpcHRBcHBgIGdlbmVyYXRlcyBvbiBpdHMgb3duXG4gKiAoYHVwZ3JhZGUueW1sYCwgYHB1bGwtcmVxdWVzdC1saW50LnltbGAsIC4uLikgYWdhaW5zdCB0aGUgeml6bW9yIGZpbmRpbmdzIHJhaXNlZCBvblxuICogY29uc3VtZXIgcmVwb3MgKGUuZy4gbWFjZWRvbi10ZWNobm9sb2dpZXMvZXhtYW4jMTMpLlxuICpcbiAqIFRoZXNlIHdvcmtmbG93cyBhcmVuJ3QgaGFuZC1hdXRob3JlZCBieSB0aGlzIHBhY2thZ2UgdGhlIHdheSBgUHJEZXBsb3lXb3JrZmxvd2AvXG4gKiBgUHJDbGVhbnVwV29ya2Zsb3dgL2V0Yy4gYXJlLCBzbyB0aGV5IGNhbid0IGJlIHBpbm5lZCBieSB3cml0aW5nIGEgbGl0ZXJhbCBTSEEgaW50byBhXG4gKiBgdXNlczpgIHN0cmluZy4gcHJvamVuIGV4cG9zZXMgYHByb2plY3QuZ2l0aHViLmFjdGlvbnNgIGZvciBleGFjdGx5IHRoaXMgY2FzZTogZXZlcnlcbiAqIGB1c2VzOmAgcmVuZGVyZWQgYnkgYSBgR2l0aHViV29ya2Zsb3dgL2BKb2JgIChpbmNsdWRpbmcgcHJvamVuJ3Mgb3duIGJ1aWx0LWluXG4gKiBjb21wb25lbnRzKSBpcyByZXNvbHZlZCB0aHJvdWdoIGl0IGF0IHN5bnRoZXNpcyB0aW1lLlxuICpcbiAqIGBwZXJzaXN0LWNyZWRlbnRpYWxzYCBhbmQgdGhlIGBwdWxsX3JlcXVlc3RfdGFyZ2V0YCB0cmlnZ2VyIGFyZW4ndCBjb3ZlcmVkIGJ5IHRoYXRcbiAqIHJlZ2lzdHJ5IChpdCBvbmx5IHJld3JpdGVzIGB1c2VzOmApLCBzbyB0aG9zZSBhcmUgY29ycmVjdGVkIHdpdGggYSBgSnNvblBhdGNoYCBhZ2FpbnN0XG4gKiB0aGUgc3ludGhlc2l6ZWQgd29ya2Zsb3cgZmlsZSBpbnN0ZWFkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaGFyZGVuUHJvamVuR2VuZXJhdGVkV29ya2Zsb3dzKHByb2plY3Q6IEF3c0Nka1R5cGVTY3JpcHRBcHAsIGFjdGlvblZlcnNpb25zPzogV29ya2Zsb3dBY3Rpb25WZXJzaW9ucyk6IHZvaWQge1xuICBjb25zdCB2ZXJzaW9ucyA9IHJlc29sdmVBY3Rpb25WZXJzaW9ucyhhY3Rpb25WZXJzaW9ucyk7XG4gIGNvbnN0IGdpdGh1YiA9IHByb2plY3QuZ2l0aHViO1xuICBpZiAoIWdpdGh1Yikge1xuICAgIHJldHVybjtcbiAgfVxuXG4gIC8vIHppem1vcjogdW5waW5uZWQtdXNlcyAoaGlnaCkg4oCUIHByb2plbidzIGJ1aWx0LWluIHdvcmtmbG93cyByZWZlcmVuY2UgdGhlc2UgYWN0aW9ucyBieVxuICAvLyBtdXRhYmxlIHRhZyAoZS5nLiBgYWN0aW9ucy9jaGVja291dEB2NmApLiBPdmVycmlkaW5nIGJ5IGJhcmUgYWN0aW9uIG5hbWUgcmVwb2ludHMgZXZlcnlcbiAgLy8gdXNhZ2UgcHJvamVuIHJlbmRlcnMsIHdpdGhvdXQgdG91Y2hpbmcgdGhlIGhhbmQtYXV0aG9yZWQgd29ya2Zsb3dzIGFib3ZlICh3aGljaCBhbHJlYWR5XG4gIC8vIGVtYmVkIGEgcmVzb2x2ZWQgU0hBIGxpdGVyYWwgYW5kIG5ldmVyIGdvIHRocm91Z2ggdGhpcyByZWdpc3RyeSkuIHVwbG9hZC1hcnRpZmFjdCxcbiAgLy8gZG93bmxvYWQtYXJ0aWZhY3QgYW5kIGFjdGlvbi1zZW1hbnRpYy1wdWxsLXJlcXVlc3Qgd2VyZW4ndCByZXBvcnRlZCBpbiAjMTMsIGJ1dCBhcmUgdGhlXG4gIC8vIHNhbWUgZmluZGluZyBvbiB0aGUgc2FtZSB0d28gZmlsZXMsIHNvIHRoZXkncmUgcGlubmVkIGhlcmUgdG9vIHJhdGhlciB0aGFuIGxlZnQgdGlja2luZy5cbiAgZ2l0aHViLmFjdGlvbnMuc2V0KCdhY3Rpb25zL2NoZWNrb3V0JywgdmVyc2lvbnMuY2hlY2tvdXQpO1xuICBnaXRodWIuYWN0aW9ucy5zZXQoJ2FjdGlvbnMvc2V0dXAtbm9kZScsIHZlcnNpb25zLnNldHVwTm9kZSk7XG4gIGdpdGh1Yi5hY3Rpb25zLnNldCgncG5wbS9hY3Rpb24tc2V0dXAnLCB2ZXJzaW9ucy5wbnBtQWN0aW9uU2V0dXApO1xuICBnaXRodWIuYWN0aW9ucy5zZXQoJ2FjdGlvbnMvZ2l0aHViLXNjcmlwdCcsIHZlcnNpb25zLmdpdGh1YlNjcmlwdCk7XG4gIGdpdGh1Yi5hY3Rpb25zLnNldCgncGV0ZXItZXZhbnMvY3JlYXRlLXB1bGwtcmVxdWVzdCcsIHZlcnNpb25zLmNyZWF0ZVB1bGxSZXF1ZXN0KTtcbiAgZ2l0aHViLmFjdGlvbnMuc2V0KCdhY3Rpb25zL3VwbG9hZC1hcnRpZmFjdCcsIHZlcnNpb25zLnVwbG9hZEFydGlmYWN0KTtcbiAgZ2l0aHViLmFjdGlvbnMuc2V0KCdhY3Rpb25zL2Rvd25sb2FkLWFydGlmYWN0JywgdmVyc2lvbnMuZG93bmxvYWRBcnRpZmFjdCk7XG4gIGdpdGh1Yi5hY3Rpb25zLnNldCgnYW1hbm5uL2FjdGlvbi1zZW1hbnRpYy1wdWxsLXJlcXVlc3QnLCB2ZXJzaW9ucy5zZW1hbnRpY1B1bGxSZXF1ZXN0KTtcblxuICAvLyB6aXptb3I6IGFydGlwYWNrZWQgKGxvdykg4oCUIGFjdGlvbnMvY2hlY2tvdXQgcGVyc2lzdHMgZ2l0IGNyZWRlbnRpYWxzIHRvIGRpc2sgYnlcbiAgLy8gZGVmYXVsdC4gTmVpdGhlciBvZiB1cGdyYWRlLnltbCdzIGNoZWNrb3V0IHN0ZXBzIG5lZWQgdG8gcHVzaCBmcm9tIHRoYXQgY2hlY2tvdXRcbiAgLy8gKHRoZSBcInByXCIgam9iJ3MgcHVzaCBoYXBwZW5zIHZpYSBwZXRlci1ldmFucy9jcmVhdGUtcHVsbC1yZXF1ZXN0IHdpdGggaXRzIG93biB0b2tlbikuXG4gIGNvbnN0IHVwZ3JhZGUgPSBnaXRodWIudHJ5RmluZFdvcmtmbG93KCd1cGdyYWRlJyk7XG4gIHVwZ3JhZGU/LmZpbGU/LnBhdGNoKFxuICAgIEpzb25QYXRjaC5hZGQoJy9qb2JzL3VwZ3JhZGUvc3RlcHMvMC93aXRoJywgeyAncGVyc2lzdC1jcmVkZW50aWFscyc6IGZhbHNlIH0pLFxuICAgIEpzb25QYXRjaC5hZGQoJy9qb2JzL3ByL3N0ZXBzLzAvd2l0aCcsIHsgJ3BlcnNpc3QtY3JlZGVudGlhbHMnOiBmYWxzZSB9KSxcbiAgKTtcblxuICAvLyB6aXptb3I6IGRhbmdlcm91cy10cmlnZ2VycyAoaGlnaCkg4oCUIHB1bGwtcmVxdWVzdC1saW50LnltbCBvbmx5IHZhbGlkYXRlcyB0aGUgUFIgdGl0bGU7XG4gIC8vIGl0IGRvZXNuJ3QgbmVlZCBwdWxsX3JlcXVlc3RfdGFyZ2V0J3MgYWNjZXNzIHRvIHNlY3JldHMvd3JpdGUgcGVybWlzc2lvbnMgYWdhaW5zdFxuICAvLyB1bnRydXN0ZWQgZm9yayBjb250ZW50LiBgcHVsbF9yZXF1ZXN0YCBjb3ZlcnMgdGhlIHNhbWUgdGl0bGUtY2hhbmdlZCBldmVudHMgd2l0aG91dFxuICAvLyB0aGUgcmlzay4gKElmIGEgY29uc3VtZXIgZXZlciBuZWVkcyB0aGlzIGNoZWNrIHRvIGNvbW1lbnQgb24gZm9ya2VkIFBScywgdGhhdCBjb25zdW1lclxuICAvLyBzaG91bGQgb3ZlcnJpZGUgYHB1bGxSZXF1ZXN0TGludE9wdGlvbnNgIGFjY29yZGluZ2x5IGluc3RlYWQgb2YgcmV2ZXJ0aW5nIHRoaXMgZ2xvYmFsbHkuKVxuICBjb25zdCBwdWxsUmVxdWVzdExpbnQgPSBnaXRodWIudHJ5RmluZFdvcmtmbG93KCdwdWxsLXJlcXVlc3QtbGludCcpO1xuICBwdWxsUmVxdWVzdExpbnQ/LmZpbGU/LnBhdGNoKFxuICAgIEpzb25QYXRjaC5yZXBsYWNlKCcvb24nLCB7XG4gICAgICBwdWxsX3JlcXVlc3Q6IHtcbiAgICAgICAgdHlwZXM6IFsnbGFiZWxlZCcsICdvcGVuZWQnLCAnc3luY2hyb25pemUnLCAncmVvcGVuZWQnLCAncmVhZHlfZm9yX3JldmlldycsICdlZGl0ZWQnXSxcbiAgICAgIH0sXG4gICAgICBtZXJnZV9ncm91cDoge30sXG4gICAgfSksXG4gICk7XG59XG4iXX0=
|
|
@@ -7,7 +7,7 @@ const javascript_1 = require("projen/lib/javascript");
|
|
|
7
7
|
const utils_1 = require("./utils");
|
|
8
8
|
const WorkflowActionVersions_1 = require("./WorkflowActionVersions");
|
|
9
9
|
class StagingDeployWorkflow extends projen_1.YamlFile {
|
|
10
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.StagingDeployWorkflow", version: "1.17.
|
|
10
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.StagingDeployWorkflow", version: "1.17.3" };
|
|
11
11
|
constructor(project, options) {
|
|
12
12
|
const packageManager = project.package.packageManager;
|
|
13
13
|
const actionVersions = (0, WorkflowActionVersions_1.resolveActionVersions)(options.actionVersions);
|
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* SHA-pinned action references used by the generated deploy/cleanup workflows
|
|
2
|
+
* SHA-pinned action references used by the generated deploy/cleanup workflows, and applied
|
|
3
|
+
* to the workflows AwsCdkTypeScriptApp generates on its own (upgrade.yml, pull-request-lint.yml)
|
|
4
|
+
* via `hardenProjenGeneratedWorkflows` — see `ProjenWorkflowHardening.ts`.
|
|
3
5
|
*
|
|
4
6
|
* zizmor flags unpinned `uses:` references as a high-severity finding
|
|
5
7
|
* (https://docs.zizmor.sh/audits/#unpinned-uses) because a mutable tag can be
|
|
@@ -38,6 +40,34 @@ export interface WorkflowActionVersions {
|
|
|
38
40
|
* @default 'actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71' // v9.0.0
|
|
39
41
|
*/
|
|
40
42
|
readonly githubScript?: string;
|
|
43
|
+
/**
|
|
44
|
+
* The `peter-evans/create-pull-request` action reference, used by projen's built-in
|
|
45
|
+
* dependency-upgrade workflow to open the upgrade PR.
|
|
46
|
+
*
|
|
47
|
+
* @default 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' // v8.1.1
|
|
48
|
+
*/
|
|
49
|
+
readonly createPullRequest?: string;
|
|
50
|
+
/**
|
|
51
|
+
* The `actions/upload-artifact` action reference, used by projen's built-in
|
|
52
|
+
* dependency-upgrade workflow to pass the upgrade patch between jobs.
|
|
53
|
+
*
|
|
54
|
+
* @default 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' // v7
|
|
55
|
+
*/
|
|
56
|
+
readonly uploadArtifact?: string;
|
|
57
|
+
/**
|
|
58
|
+
* The `actions/download-artifact` action reference, used by projen's built-in
|
|
59
|
+
* dependency-upgrade workflow to pass the upgrade patch between jobs.
|
|
60
|
+
*
|
|
61
|
+
* @default 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' // v8
|
|
62
|
+
*/
|
|
63
|
+
readonly downloadArtifact?: string;
|
|
64
|
+
/**
|
|
65
|
+
* The `amannn/action-semantic-pull-request` action reference, used by projen's
|
|
66
|
+
* built-in pull-request-lint workflow to validate PR titles.
|
|
67
|
+
*
|
|
68
|
+
* @default 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50' // v6.1.1
|
|
69
|
+
*/
|
|
70
|
+
readonly semanticPullRequest?: string;
|
|
41
71
|
}
|
|
42
72
|
export declare const DEFAULT_WORKFLOW_ACTION_VERSIONS: Required<WorkflowActionVersions>;
|
|
43
73
|
export declare function resolveActionVersions(overrides?: WorkflowActionVersions): Required<WorkflowActionVersions>;
|
|
@@ -8,6 +8,10 @@ exports.DEFAULT_WORKFLOW_ACTION_VERSIONS = {
|
|
|
8
8
|
configureAwsCredentials: 'aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a', // v4.3.1
|
|
9
9
|
pnpmActionSetup: 'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86', // v6.0.10
|
|
10
10
|
githubScript: 'actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71', // v9.0.0
|
|
11
|
+
createPullRequest: 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1', // v8.1.1
|
|
12
|
+
uploadArtifact: 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', // v7
|
|
13
|
+
downloadArtifact: 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c', // v8
|
|
14
|
+
semanticPullRequest: 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50', // v6.1.1
|
|
11
15
|
};
|
|
12
16
|
function resolveActionVersions(overrides) {
|
|
13
17
|
return {
|
|
@@ -15,4 +19,4 @@ function resolveActionVersions(overrides) {
|
|
|
15
19
|
...overrides,
|
|
16
20
|
};
|
|
17
21
|
}
|
|
18
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
22
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiV29ya2Zsb3dBY3Rpb25WZXJzaW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9Xb3JrZmxvd0FjdGlvblZlcnNpb25zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQTRGQSxzREFLQztBQWpCWSxRQUFBLGdDQUFnQyxHQUFxQztJQUNoRixRQUFRLEVBQUUsMkRBQTJELEVBQUUsU0FBUztJQUNoRixTQUFTLEVBQUUsNkRBQTZELEVBQUUsU0FBUztJQUNuRix1QkFBdUIsRUFBRSxnRkFBZ0YsRUFBRSxTQUFTO0lBQ3BILGVBQWUsRUFBRSw0REFBNEQsRUFBRSxVQUFVO0lBQ3pGLFlBQVksRUFBRSxnRUFBZ0UsRUFBRSxTQUFTO0lBQ3pGLGlCQUFpQixFQUFFLDBFQUEwRSxFQUFFLFNBQVM7SUFDeEcsY0FBYyxFQUFFLGtFQUFrRSxFQUFFLEtBQUs7SUFDekYsZ0JBQWdCLEVBQUUsb0VBQW9FLEVBQUUsS0FBSztJQUM3RixtQkFBbUIsRUFBRSw4RUFBOEUsRUFBRSxTQUFTO0NBQy9HLENBQUM7QUFFRixTQUFnQixxQkFBcUIsQ0FBQyxTQUFrQztJQUN0RSxPQUFPO1FBQ0wsR0FBRyx3Q0FBZ0M7UUFDbkMsR0FBRyxTQUFTO0tBQ2IsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFNIQS1waW5uZWQgYWN0aW9uIHJlZmVyZW5jZXMgdXNlZCBieSB0aGUgZ2VuZXJhdGVkIGRlcGxveS9jbGVhbnVwIHdvcmtmbG93cywgYW5kIGFwcGxpZWRcbiAqIHRvIHRoZSB3b3JrZmxvd3MgQXdzQ2RrVHlwZVNjcmlwdEFwcCBnZW5lcmF0ZXMgb24gaXRzIG93biAodXBncmFkZS55bWwsIHB1bGwtcmVxdWVzdC1saW50LnltbClcbiAqIHZpYSBgaGFyZGVuUHJvamVuR2VuZXJhdGVkV29ya2Zsb3dzYCDigJQgc2VlIGBQcm9qZW5Xb3JrZmxvd0hhcmRlbmluZy50c2AuXG4gKlxuICogeml6bW9yIGZsYWdzIHVucGlubmVkIGB1c2VzOmAgcmVmZXJlbmNlcyBhcyBhIGhpZ2gtc2V2ZXJpdHkgZmluZGluZ1xuICogKGh0dHBzOi8vZG9jcy56aXptb3Iuc2gvYXVkaXRzLyN1bnBpbm5lZC11c2VzKSBiZWNhdXNlIGEgbXV0YWJsZSB0YWcgY2FuIGJlXG4gKiByZXBvaW50ZWQgdG8gZGlmZmVyZW50IGNvZGUgYWZ0ZXIgcmV2aWV3LiBFdmVyeSBmaWVsZCBoZXJlIGNhbiBiZVxuICogb3ZlcnJpZGRlbiBieSBjb25zdW1lcnMgd2hvIG5lZWQgYSBkaWZmZXJlbnQgcGlubmVkIFNIQSAoZS5nLiB0byBwaWNrIHVwIGFcbiAqIG5ld2VyIHJlbGVhc2UgYmVmb3JlIHRoaXMgcGFja2FnZSBkb2VzKS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBXb3JrZmxvd0FjdGlvblZlcnNpb25zIHtcbiAgLyoqXG4gICAqIFRoZSBgYWN0aW9ucy9jaGVja291dGAgYWN0aW9uIHJlZmVyZW5jZS5cbiAgICpcbiAgICogQGRlZmF1bHQgJ2FjdGlvbnMvY2hlY2tvdXRAZmJjNmYzOTkyZDI0Yjc5NmQ1YTA0OGZmMjczZjdmY2M0YTdiNmMwOScgLy8gdjUuMS4wXG4gICAqL1xuICByZWFkb25seSBjaGVja291dD86IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGBhY3Rpb25zL3NldHVwLW5vZGVgIGFjdGlvbiByZWZlcmVuY2UuXG4gICAqXG4gICAqIEBkZWZhdWx0ICdhY3Rpb25zL3NldHVwLW5vZGVAYTA4NTNjMjQ1NDQ2MjdmNjVkZGYyNTlhYmU3M2IxZDE4YTU5MTQ0NCcgLy8gdjUuMC4wXG4gICAqL1xuICByZWFkb25seSBzZXR1cE5vZGU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBgYXdzLWFjdGlvbnMvY29uZmlndXJlLWF3cy1jcmVkZW50aWFsc2AgYWN0aW9uIHJlZmVyZW5jZS5cbiAgICpcbiAgICogQGRlZmF1bHQgJ2F3cy1hY3Rpb25zL2NvbmZpZ3VyZS1hd3MtY3JlZGVudGlhbHNANzQ3NGJjNDY5MGUyOWE4MzkyYWY2M2M1Yjk4ZTc0NDk1MzZkNWMzYScgLy8gdjQuMy4xXG4gICAqL1xuICByZWFkb25seSBjb25maWd1cmVBd3NDcmVkZW50aWFscz86IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGBwbnBtL2FjdGlvbi1zZXR1cGAgYWN0aW9uIHJlZmVyZW5jZSwgdXNlZCB3aGVuIHRoZSBwcm9qZWN0J3MgcGFja2FnZSBtYW5hZ2VyIGlzIHBucG0uXG4gICAqXG4gICAqIEBkZWZhdWx0ICdwbnBtL2FjdGlvbi1zZXR1cEAwOTc3ZmQ5OTcyNWYxZGI0MDA3Y2NiMjkyOGRiYjRlOTBkMDZjYzg2JyAvLyB2Ni4wLjEwXG4gICAqL1xuICByZWFkb25seSBwbnBtQWN0aW9uU2V0dXA/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBgYWN0aW9ucy9naXRodWItc2NyaXB0YCBhY3Rpb24gcmVmZXJlbmNlLlxuICAgKlxuICAgKiBAZGVmYXVsdCAnYWN0aW9ucy9naXRodWItc2NyaXB0QGQ3NDZmZmUzNTUwOGIxOTE3MzU4NzgzYjQ3OWUwNGZlYmQyYjhmNzEnIC8vIHY5LjAuMFxuICAgKi9cbiAgcmVhZG9ubHkgZ2l0aHViU2NyaXB0Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgYHBldGVyLWV2YW5zL2NyZWF0ZS1wdWxsLXJlcXVlc3RgIGFjdGlvbiByZWZlcmVuY2UsIHVzZWQgYnkgcHJvamVuJ3MgYnVpbHQtaW5cbiAgICogZGVwZW5kZW5jeS11cGdyYWRlIHdvcmtmbG93IHRvIG9wZW4gdGhlIHVwZ3JhZGUgUFIuXG4gICAqXG4gICAqIEBkZWZhdWx0ICdwZXRlci1ldmFucy9jcmVhdGUtcHVsbC1yZXF1ZXN0QDVmNjk3OGZhZjA4OWQ0ZDIwYjAwYzc3NjY5ODlkMDc2YmIyZmM3ZjEnIC8vIHY4LjEuMVxuICAgKi9cbiAgcmVhZG9ubHkgY3JlYXRlUHVsbFJlcXVlc3Q/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBgYWN0aW9ucy91cGxvYWQtYXJ0aWZhY3RgIGFjdGlvbiByZWZlcmVuY2UsIHVzZWQgYnkgcHJvamVuJ3MgYnVpbHQtaW5cbiAgICogZGVwZW5kZW5jeS11cGdyYWRlIHdvcmtmbG93IHRvIHBhc3MgdGhlIHVwZ3JhZGUgcGF0Y2ggYmV0d2VlbiBqb2JzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAnYWN0aW9ucy91cGxvYWQtYXJ0aWZhY3RAMDQzZmI0NmQxYTkzYzc3YWFlNjU2ZTdjMWM2NGE4NzVkMWZjNmEwYScgLy8gdjdcbiAgICovXG4gIHJlYWRvbmx5IHVwbG9hZEFydGlmYWN0Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgYGFjdGlvbnMvZG93bmxvYWQtYXJ0aWZhY3RgIGFjdGlvbiByZWZlcmVuY2UsIHVzZWQgYnkgcHJvamVuJ3MgYnVpbHQtaW5cbiAgICogZGVwZW5kZW5jeS11cGdyYWRlIHdvcmtmbG93IHRvIHBhc3MgdGhlIHVwZ3JhZGUgcGF0Y2ggYmV0d2VlbiBqb2JzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAnYWN0aW9ucy9kb3dubG9hZC1hcnRpZmFjdEAzZTVmNDViMmNmYjkxNzIwNTRiNDA4N2E0MGU4ZTBiNWE1NDYxZTdjJyAvLyB2OFxuICAgKi9cbiAgcmVhZG9ubHkgZG93bmxvYWRBcnRpZmFjdD86IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGBhbWFubm4vYWN0aW9uLXNlbWFudGljLXB1bGwtcmVxdWVzdGAgYWN0aW9uIHJlZmVyZW5jZSwgdXNlZCBieSBwcm9qZW4nc1xuICAgKiBidWlsdC1pbiBwdWxsLXJlcXVlc3QtbGludCB3b3JrZmxvdyB0byB2YWxpZGF0ZSBQUiB0aXRsZXMuXG4gICAqXG4gICAqIEBkZWZhdWx0ICdhbWFubm4vYWN0aW9uLXNlbWFudGljLXB1bGwtcmVxdWVzdEA0OGYyNTYyODRiZDQ2Y2RhYWIxMDQ4YzM3MjEzNjBlODA4MzM1ZDUwJyAvLyB2Ni4xLjFcbiAgICovXG4gIHJlYWRvbmx5IHNlbWFudGljUHVsbFJlcXVlc3Q/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjb25zdCBERUZBVUxUX1dPUktGTE9XX0FDVElPTl9WRVJTSU9OUzogUmVxdWlyZWQ8V29ya2Zsb3dBY3Rpb25WZXJzaW9ucz4gPSB7XG4gIGNoZWNrb3V0OiAnYWN0aW9ucy9jaGVja291dEBmYmM2ZjM5OTJkMjRiNzk2ZDVhMDQ4ZmYyNzNmN2ZjYzRhN2I2YzA5JywgLy8gdjUuMS4wXG4gIHNldHVwTm9kZTogJ2FjdGlvbnMvc2V0dXAtbm9kZUBhMDg1M2MyNDU0NDYyN2Y2NWRkZjI1OWFiZTczYjFkMThhNTkxNDQ0JywgLy8gdjUuMC4wXG4gIGNvbmZpZ3VyZUF3c0NyZWRlbnRpYWxzOiAnYXdzLWFjdGlvbnMvY29uZmlndXJlLWF3cy1jcmVkZW50aWFsc0A3NDc0YmM0NjkwZTI5YTgzOTJhZjYzYzViOThlNzQ0OTUzNmQ1YzNhJywgLy8gdjQuMy4xXG4gIHBucG1BY3Rpb25TZXR1cDogJ3BucG0vYWN0aW9uLXNldHVwQDA5NzdmZDk5NzI1ZjFkYjQwMDdjY2IyOTI4ZGJiNGU5MGQwNmNjODYnLCAvLyB2Ni4wLjEwXG4gIGdpdGh1YlNjcmlwdDogJ2FjdGlvbnMvZ2l0aHViLXNjcmlwdEBkNzQ2ZmZlMzU1MDhiMTkxNzM1ODc4M2I0NzllMDRmZWJkMmI4ZjcxJywgLy8gdjkuMC4wXG4gIGNyZWF0ZVB1bGxSZXF1ZXN0OiAncGV0ZXItZXZhbnMvY3JlYXRlLXB1bGwtcmVxdWVzdEA1ZjY5NzhmYWYwODlkNGQyMGIwMGM3NzY2OTg5ZDA3NmJiMmZjN2YxJywgLy8gdjguMS4xXG4gIHVwbG9hZEFydGlmYWN0OiAnYWN0aW9ucy91cGxvYWQtYXJ0aWZhY3RAMDQzZmI0NmQxYTkzYzc3YWFlNjU2ZTdjMWM2NGE4NzVkMWZjNmEwYScsIC8vIHY3XG4gIGRvd25sb2FkQXJ0aWZhY3Q6ICdhY3Rpb25zL2Rvd25sb2FkLWFydGlmYWN0QDNlNWY0NWIyY2ZiOTE3MjA1NGI0MDg3YTQwZThlMGI1YTU0NjFlN2MnLCAvLyB2OFxuICBzZW1hbnRpY1B1bGxSZXF1ZXN0OiAnYW1hbm5uL2FjdGlvbi1zZW1hbnRpYy1wdWxsLXJlcXVlc3RANDhmMjU2Mjg0YmQ0NmNkYWFiMTA0OGMzNzIxMzYwZTgwODMzNWQ1MCcsIC8vIHY2LjEuMVxufTtcblxuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVBY3Rpb25WZXJzaW9ucyhvdmVycmlkZXM/OiBXb3JrZmxvd0FjdGlvblZlcnNpb25zKTogUmVxdWlyZWQ8V29ya2Zsb3dBY3Rpb25WZXJzaW9ucz4ge1xuICByZXR1cm4ge1xuICAgIC4uLkRFRkFVTFRfV09SS0ZMT1dfQUNUSU9OX1ZFUlNJT05TLFxuICAgIC4uLm92ZXJyaWRlcyxcbiAgfTtcbn1cbiJdfQ==
|
|
@@ -39,7 +39,7 @@ const fs = __importStar(require("fs"));
|
|
|
39
39
|
const path = __importStar(require("path"));
|
|
40
40
|
const projen_1 = require("projen");
|
|
41
41
|
class WorkflowAutoDiscover extends projen_1.Component {
|
|
42
|
-
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.WorkflowAutoDiscover", version: "1.17.
|
|
42
|
+
static [JSII_RTTI_SYMBOL_1] = { fqn: "@macedon-technologies/batman.WorkflowAutoDiscover", version: "1.17.3" };
|
|
43
43
|
constructor(project) {
|
|
44
44
|
super(project);
|
|
45
45
|
}
|