commit 3396d1cc46cc961a8c29f2f9e239aaed01938c46
parent 0c457d7f548ccc0174eeef1fdd6cddad1dcee10d
Author: Marcel <MTRNord@users.noreply.github.com>
Date: Thu, 20 Jan 2022 19:47:17 +0100
Improve code quality by securing supply chain (#7)
* Harden the CI
* Set the correct allowed endpoints
* Pin versions in package.json
* Fixup tests not working due to npm bug
* Allow additional calls for playwright install
* Add more allowed endpoints for playwright.
Diffstat:
4 files changed, 82 insertions(+), 47 deletions(-)
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
@@ -1,4 +1,5 @@
name: Fossa Scan
+permissions: read-all
on:
push:
branches: [main]
@@ -8,7 +9,15 @@ jobs:
fossa-scan:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
- - uses: fossas/fossa-action@main
+ - name: Harden Runner
+ uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1
+ with:
+ allowed-endpoints: "
+ app.fossa.com:443
+ github.com:443
+ objects.githubusercontent.com:443
+ raw.githubusercontent.com:443"
+ - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+ - uses: fossas/fossa-action@3764c5c941b43a8fdce352db1891f7e26e2e3cda # main
with:
api-key: ${{secrets.fossaApiKey}}
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
@@ -1,16 +1,39 @@
name: Playwright Tests
on:
push:
- branches: [main, master]
+ branches: [main]
pull_request:
- branches: [main, master]
+ branches: [main]
+permissions: read-all
+
jobs:
test:
+ permissions:
+ contents: read # for actions/checkout to fetch code
timeout-minutes: 60
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
- - uses: actions/setup-node@v2
+ - name: Harden Runner
+ uses: step-security/harden-runner@14dc64f30986eaa2ad2dddcec073f5aab18e5a24 # v1
+ with:
+ allowed-endpoints: "
+ github.com:22
+ github.com:443
+ registry.npmjs.org:443
+ playwright.azureedge.net:443
+ azure.archive.ubuntu.com:443
+ azure.archive.ubuntu.com:80
+ security.ubuntu.com:80
+ packages.microsoft.com:80
+ packages.microsoft.com:443"
+ - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+ with:
+ persist-credentials: false
+ - name: Reconfigure git to use HTTP authentication
+ run: >
+ git config --global url."https://github.com/".insteadOf
+ ssh://git@github.com/
+ - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
with:
node-version: "14.x"
- name: Install dependencies
@@ -19,7 +42,7 @@ jobs:
run: npx playwright install --with-deps && npx playwright install msedge
- name: Run Playwright tests
run: npx playwright test
- - uses: actions/upload-artifact@v2
+ - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2
if: always()
with:
name: playwright-test-results
diff --git a/package-lock.json b/package-lock.json
@@ -6,33 +6,33 @@
"": {
"name": "matrix-art",
"dependencies": {
- "cors": "^2.8.5",
- "feed": "yshrsmz/feed#custom-elements",
- "lightgallery": "^2.3.0",
+ "cors": "2.8.5",
+ "feed": "yshrsmz/feed#c50d7a82c5b6141039830d615b19b760e173e231",
+ "lightgallery": "2.3.0",
"meilisearch": "^0.23.0",
"next": "12.0.7",
- "node-localstorage": "^2.2.1",
- "pouchdb": "^7.2.2",
+ "node-localstorage": "2.2.1",
+ "pouchdb": "7.2.2",
"react": "17.0.2",
- "react-blurhash": "^0.1.3",
+ "react-blurhash": "0.1.3",
"react-dom": "17.0.2"
},
"devDependencies": {
- "@babel/plugin-transform-typescript": "^7.16.7",
- "@playwright/test": "^1.17.1",
- "@types/cors": "^2.8.12",
+ "@babel/plugin-transform-typescript": "7.16.7",
+ "@playwright/test": "1.17.1",
+ "@types/cors": "2.8.12",
"@types/node": "17.0.8",
- "@types/node-localstorage": "^1.3.0",
- "@types/pouchdb": "^6.4.0",
+ "@types/node-localstorage": "1.3.0",
+ "@types/pouchdb": "6.4.0",
"@types/react": "17.0.38",
- "autoprefixer": "^10.4.1",
- "cross-env": "^7.0.3",
- "eslint": "^8.6.0",
+ "autoprefixer": "10.4.1",
+ "cross-env": "7.0.3",
+ "eslint": "8.6.0",
"eslint-config-next": "12.0.7",
- "eslint-plugin-jsx-a11y": "^6.5.1",
- "eslint-plugin-unicorn": "^40.0.0",
- "postcss": "^8.4.5",
- "tailwindcss": "^3.0.11",
+ "eslint-plugin-jsx-a11y": "6.5.1",
+ "eslint-plugin-unicorn": "40.0.0",
+ "postcss": "8.4.5",
+ "tailwindcss": "3.0.11",
"typescript": "4.5.4"
}
},
@@ -4468,7 +4468,8 @@
},
"node_modules/feed": {
"version": "4.2.2",
- "resolved": "git+ssh://git@github.com/yshrsmz/feed.git#86dffd1837c088fa5077675c8214397dc5284395",
+ "resolved": "git+ssh://git@github.com/yshrsmz/feed.git#c50d7a82c5b6141039830d615b19b760e173e231",
+ "integrity": "sha512-3saxrHixVr8JQZRmlffGF0p0q4xsk+ju25vv7vh5pnaPFJ/ZzpUjsIvUG3lr1oYeHHcruxLFhpQUrVVs3rMvqA==",
"license": "MIT",
"dependencies": {
"xml-js": "^1.6.11"
@@ -11988,8 +11989,9 @@
}
},
"feed": {
- "version": "git+ssh://git@github.com/yshrsmz/feed.git#86dffd1837c088fa5077675c8214397dc5284395",
- "from": "feed@yshrsmz/feed#custom-elements",
+ "version": "git+ssh://git@github.com/yshrsmz/feed.git#c50d7a82c5b6141039830d615b19b760e173e231",
+ "integrity": "sha512-3saxrHixVr8JQZRmlffGF0p0q4xsk+ju25vv7vh5pnaPFJ/ZzpUjsIvUG3lr1oYeHHcruxLFhpQUrVVs3rMvqA==",
+ "from": "feed@yshrsmz/feed#c50d7a82c5b6141039830d615b19b760e173e231",
"requires": {
"xml-js": "^1.6.11"
}
diff --git a/package.json b/package.json
@@ -16,33 +16,33 @@
"lint": "next lint"
},
"dependencies": {
- "cors": "^2.8.5",
- "feed": "yshrsmz/feed#custom-elements",
- "lightgallery": "^2.3.0",
+ "cors": "2.8.5",
+ "feed": "yshrsmz/feed#c50d7a82c5b6141039830d615b19b760e173e231",
+ "lightgallery": "2.3.0",
"meilisearch": "^0.23.0",
"next": "12.0.7",
- "node-localstorage": "^2.2.1",
- "pouchdb": "^7.2.2",
+ "node-localstorage": "2.2.1",
+ "pouchdb": "7.2.2",
"react": "17.0.2",
- "react-blurhash": "^0.1.3",
+ "react-blurhash": "0.1.3",
"react-dom": "17.0.2"
},
"devDependencies": {
- "@babel/plugin-transform-typescript": "^7.16.7",
- "@playwright/test": "^1.17.1",
- "@types/cors": "^2.8.12",
+ "@babel/plugin-transform-typescript": "7.16.7",
+ "@playwright/test": "1.17.1",
+ "@types/cors": "2.8.12",
"@types/node": "17.0.8",
- "@types/node-localstorage": "^1.3.0",
- "@types/pouchdb": "^6.4.0",
+ "@types/node-localstorage": "1.3.0",
+ "@types/pouchdb": "6.4.0",
"@types/react": "17.0.38",
- "autoprefixer": "^10.4.1",
- "cross-env": "^7.0.3",
- "eslint": "^8.6.0",
+ "autoprefixer": "10.4.1",
+ "cross-env": "7.0.3",
+ "eslint": "8.6.0",
"eslint-config-next": "12.0.7",
- "eslint-plugin-jsx-a11y": "^6.5.1",
- "eslint-plugin-unicorn": "^40.0.0",
- "postcss": "^8.4.5",
- "tailwindcss": "^3.0.11",
+ "eslint-plugin-jsx-a11y": "6.5.1",
+ "eslint-plugin-unicorn": "40.0.0",
+ "postcss": "8.4.5",
+ "tailwindcss": "3.0.11",
"typescript": "4.5.4"
}
-}
+}
+\ No newline at end of file
