actions/actions-hugo
0
0
Fork 0
mirror of https://github.com/peaceiris/actions-hugo.git synced 2026-06-04 10:38:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: harden GitHub Actions workflows

Browse Source 
Pin workflow actions to commit SHAs, set explicit permissions and timeouts, update Ubuntu runners, and include the generated action bundle.

Co-Authored-By: Codex <noreply@openai.com>
This commit is contained in:
peaceiris
2026-05-10 01:18:21 +09:00
parent ba5146cb8a
commit 9b7aa41d20
10 changed files with 11797 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/codeql-analysis.yml
+10 -5
View File
@@ -6,19 +6,24 @@ on:
- main
pull_request:
permissions:
security-events: write
contents: read
jobs:
CodeQL-Build:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 20
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
uses: github/codeql-action/init@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
with:
languages: javascript
- name: Autobuild
uses: github/codeql-action/autobuild@v3
uses: github/codeql-action/autobuild@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
uses: github/codeql-action/analyze@1521896cd211af95be3f02edf6f436e10b819c27 # v3.35.4
.github/workflows/dependency-review.yml
+4 -3
View File
@@ -10,7 +10,8 @@ permissions:
jobs:
dependency-review:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/dependency-review-action@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
.github/workflows/dev-image.yml
+6 -2
View File
@@ -21,11 +21,15 @@ on:
- 'Dockerfile'
- 'Makefile'
permissions:
contents: read
jobs:
dev-image-test:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 30
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- run: make build
- run: make cirun cmd="npm ci"
# - run: make ciall
.github/workflows/label-commenter.yml
+8 -3
View File
@@ -10,16 +10,21 @@ on:
# - labeled
# - unlabeled
permissions:
contents: read
issues: write
jobs:
comment:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: main
- name: Label Commenter
uses: peaceiris/actions-label-commenter@v1.10.0
uses: peaceiris/actions-label-commenter@c74c602750041f04c2bb68d200fc2fdae169a044 # v1.10.0
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
# config_file: .github/label-commenter-config.yml
.github/workflows/purge-readme-image-cache.yml
+10 -7
View File
@@ -4,13 +4,16 @@ on:
schedule:
- cron: '4 18 * * */7'
permissions: {}
jobs:
purge:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- run: >
curl -sL https://github.com/${GITHUB_REPOSITORY} |
grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
sed -e 's/<img src="//' |
xargs -I % curl -sX PURGE %
- name: Purge README image cache
run: >
curl -sL "https://github.com/${GITHUB_REPOSITORY}" |
grep -oE '<img src="https?://camo.githubusercontent.com/[^"]+' |
sed -e 's/<img src="//' |
xargs -I % curl -sX PURGE %
.github/workflows/release.yml
+9 -15
View File
@@ -5,21 +5,15 @@ on:
tags:
- 'v*.*.*'
permissions:
contents: write
jobs:
release:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- name: Dump GitHub context
env:
GITHUB_CONTEXT: ${{ toJson(github) }}
run: echo "${GITHUB_CONTEXT}"
- name: Install github/hub
run: |
export HUB_VERSION="2.14.2"
curl -fsSL https://github.com/github/hub/raw/8d91904208171b013f9a9d1175f4ab39068db047/script/get | bash -s "${HUB_VERSION}"
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Create release
env:
@@ -29,8 +23,8 @@ jobs:
echo "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG_NAME}/CHANGELOG.md) for more details." > ./release_notes.md
RELEASE_NAME="$(jq -r '.name' ./package.json)"
sed -i "1i${RELEASE_NAME} ${TAG_NAME}\n" ./release_notes.md
./bin/hub release create \
gh release create "${TAG_NAME}" \
--draft \
--prerelease \
--file ./release_notes.md \
"${TAG_NAME}"
--notes-file ./release_notes.md \
--title "${RELEASE_NAME} ${TAG_NAME}"
.github/workflows/test-action.yml
+15 -2
View File
@@ -6,15 +6,28 @@ on:
pull_request:
workflow_dispatch:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 20
strategy:
matrix:
hugo-version: ['latest', '0.160.1']
extended: [true, false]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version-file: '.nvmrc'
cache: 'npm'
- run: npm ci
- run: npm run build
- name: Setup Hugo
uses: ./
.github/workflows/test.yml
+12 -10
View File
@@ -10,22 +10,24 @@ on:
paths-ignore:
- '**.md'
permissions:
contents: read
jobs:
test:
runs-on: ${{ matrix.os }}
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
os:
- 'ubuntu-22.04'
- 'ubuntu-20.04'
- 'ubuntu-latest'
- 'ubuntu-24.04'
- 'macos-latest'
- 'windows-latest'
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version-file: '.nvmrc'
cache: 'npm'
@@ -33,23 +35,23 @@ jobs:
- run: npm ci
- name: Run prettier
if: startsWith(matrix.os, 'ubuntu-22.04')
if: matrix.os == 'ubuntu-24.04'
run: npm run format:check
- name: Run eslint
if: startsWith(matrix.os, 'ubuntu-22.04')
if: matrix.os == 'ubuntu-24.04'
run: npm run lint
- name: Run ncc
if: startsWith(matrix.os, 'ubuntu-22.04')
if: matrix.os == 'ubuntu-24.04'
run: npm run build
- run: npm test
- name: Upload test coverage as artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: coverage-${{ matrix.os }}
path: coverage
- uses: codecov/codecov-action@v5
- uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4
.github/workflows/update-major-tag.yml
+6 -3
View File
@@ -4,17 +4,20 @@ on:
release:
types: [released]
permissions:
contents: write
jobs:
update:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Update major tag
run: |
git config user.name "${GITHUB_ACTOR}"
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git"
export TAG_NAME="${GITHUB_REF##refs/tags/}"
export TAG_MAJOR="${TAG_NAME%%.*}"
git tag --force -a "${TAG_MAJOR}" -m "Release ${TAG_NAME}"
lib/index.js
+11717
View File
File diff suppressed because one or more lines are too long