@platform-mesh/portal-server-lib 0.9.72 → 0.9.74
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -14,6 +14,6 @@ jobs:
|
|
|
14
14
|
if: github.event.pull_request.head.repo.full_name == github.repository
|
|
15
15
|
uses: platform-mesh/.github/.github/workflows/job-auto-labeler.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
16
16
|
permissions:
|
|
17
|
-
contents: read
|
|
18
|
-
pull-requests: write
|
|
19
|
-
issues: write
|
|
17
|
+
contents: read # Needed to read repository contents
|
|
18
|
+
pull-requests: write # Needed to add labels to the pull request
|
|
19
|
+
issues: write # Needed to manage labels on the repository
|
package/.github/workflows/ci.yml
CHANGED
|
@@ -16,7 +16,7 @@ concurrency:
|
|
|
16
16
|
jobs:
|
|
17
17
|
build:
|
|
18
18
|
uses: platform-mesh/.github/.github/workflows/job-node-test.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
19
|
-
secrets: inherit
|
|
19
|
+
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
20
20
|
|
|
21
21
|
quality-gate:
|
|
22
22
|
if: always()
|
|
@@ -26,8 +26,10 @@ jobs:
|
|
|
26
26
|
timeout-minutes: 1
|
|
27
27
|
steps:
|
|
28
28
|
- name: Check results
|
|
29
|
+
env:
|
|
30
|
+
BUILD_RESULT: ${{ needs.build.result }}
|
|
29
31
|
run: |
|
|
30
|
-
if [[ "${
|
|
32
|
+
if [[ "${BUILD_RESULT}" != "success" ]]; then
|
|
31
33
|
echo "build failed"
|
|
32
34
|
exit 1
|
|
33
35
|
fi
|
|
@@ -13,7 +13,7 @@ jobs:
|
|
|
13
13
|
scorecard:
|
|
14
14
|
uses: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
15
15
|
permissions:
|
|
16
|
-
security-events: write
|
|
17
|
-
id-token: write
|
|
18
|
-
contents: read
|
|
19
|
-
actions: read
|
|
16
|
+
security-events: write # Needed to upload the Scorecard SARIF to code scanning
|
|
17
|
+
id-token: write # Needed for the OIDC token when publishing Scorecard results
|
|
18
|
+
contents: read # Needed to read repository contents during analysis
|
|
19
|
+
actions: read # Needed by Scorecard to read workflow run metadata
|
|
@@ -15,21 +15,21 @@ concurrency:
|
|
|
15
15
|
jobs:
|
|
16
16
|
build:
|
|
17
17
|
uses: platform-mesh/.github/.github/workflows/job-node-test.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
18
|
-
secrets: inherit
|
|
18
|
+
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
19
19
|
|
|
20
20
|
create-version:
|
|
21
21
|
uses: platform-mesh/.github/.github/workflows/job-create-version.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
22
|
-
secrets: inherit
|
|
22
|
+
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
23
23
|
permissions:
|
|
24
|
-
contents: write
|
|
24
|
+
contents: write # Needed to push the version tag and create the GitHub release
|
|
25
25
|
|
|
26
26
|
publish:
|
|
27
27
|
needs: [create-version, build]
|
|
28
28
|
uses: platform-mesh/.github/.github/workflows/job-node-publish.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
|
|
29
|
-
secrets: inherit
|
|
29
|
+
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
30
30
|
permissions:
|
|
31
|
-
contents: write
|
|
32
|
-
id-token: write
|
|
31
|
+
contents: write # Needed to create the GitHub release for the published version
|
|
32
|
+
id-token: write # Needed for OIDC provenance when publishing to npm
|
|
33
33
|
with:
|
|
34
34
|
version: ${{ needs.create-version.outputs.strictVersion }}
|
|
35
35
|
environment: npmjs:@platform-mesh/portal-server-lib
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
name: Zizmor
|
|
2
|
+
on:
|
|
3
|
+
push:
|
|
4
|
+
branches: [main]
|
|
5
|
+
pull_request:
|
|
6
|
+
branches: [main]
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: '30 4 * * 1'
|
|
9
|
+
workflow_dispatch:
|
|
10
|
+
|
|
11
|
+
permissions:
|
|
12
|
+
contents: read
|
|
13
|
+
|
|
14
|
+
concurrency:
|
|
15
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
16
|
+
cancel-in-progress: true
|
|
17
|
+
|
|
18
|
+
jobs:
|
|
19
|
+
zizmor:
|
|
20
|
+
uses: platform-mesh/.github/.github/workflows/job-zizmor.yml@03e076ff9aebe43ead6b9d77f3bb764a9d411347 # main
|
|
21
|
+
with:
|
|
22
|
+
persona: 'auditor'
|
|
23
|
+
permissions:
|
|
24
|
+
security-events: write # Needed to write to the GitHub Security tab
|
|
25
|
+
contents: read # Needed to read repository contents
|
|
26
|
+
actions: read # Needed to read GitHub Actions workflows
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
# zizmor configuration for portal-server-lib workflows.
|
|
2
|
+
# https://docs.zizmor.sh/configuration/
|
|
3
|
+
rules:
|
|
4
|
+
# Repo convention: jobs are identified by their key (e.g. `build`,
|
|
5
|
+
# `quality-gate`), not a separate display name. Adding `name:` to every job
|
|
6
|
+
# would fight the established style across all workflows here.
|
|
7
|
+
anonymous-definition:
|
|
8
|
+
disable: true
|