jcoffey-dev
441fb07cc9
A tag is a mutable pointer. `actions/checkout@v7` is whatever the publisher last moved v7 to, so using one is not trusting the version that was reviewed -- it is trusting every future version, including whatever is pushed by whoever compromises the publisher's account. That is the shape of the tj-actions/changed-files compromise: no repository changed a line, the tags moved underneath them, and the action began dumping runner memory to the logs. Each `uses:` now carries the full 40-character SHA with its release in a trailing comment. Read the comment for the version; the SHA is what runs. Dependabot already covers github-actions weekly and updates both halves together, so keeping current costs nothing. The dataaxiom cleanup action was already pinned -- it is handed `packages: write` and deletes things, so it was worth doing early -- and only picks up the trailing-version convention here. Its comment loses the "rather than a moving major tag" framing, which is no longer what makes it different from its neighbors now that they are all pinned too. The two `uses: ./.github/workflows/...` entries are local paths, not actions: they always resolve within the commit already running and there is no SHA to pin.
40 lines
1.7 KiB
YAML
40 lines
1.7 KiB
YAML
name: CI
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
# Lets CI be run by hand against any ref, including a specific commit.
|
|
# Without this there is no way to re-run a check that never started: a run
|
|
# GitHub queues and then orphans -- as it did to every run created during the
|
|
# Actions outage on 2026-08-26 -- can be neither rerun ("already running")
|
|
# nor canceled ("already completed"), and the workflow has no other trigger
|
|
# to reach for. Useful too for putting a check on a commit that predates a CI
|
|
# change, without pushing an empty commit to move it.
|
|
workflow_dispatch:
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Every `uses:` in this repository is pinned to a full commit SHA, with
|
|
# the release it belongs to in the trailing comment, and the repository
|
|
# requires it -- an unpinned ref fails the run rather than quietly
|
|
# resolving. A tag is a mutable pointer: `@v7` is whatever the publisher
|
|
# last moved it to, so trusting one is trusting every future version of
|
|
# that action, including the one pushed by whoever compromises the
|
|
# account. Read the comment for the version; the SHA is what runs.
|
|
#
|
|
# Dependabot updates both halves together on its weekly github-actions
|
|
# run, so this costs nothing to keep current -- do not "simplify" a pin
|
|
# back to a tag.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 26
|
|
cache: npm
|
|
- run: npm ci --ignore-scripts
|
|
- run: npm run typecheck
|
|
- run: npm test
|
|
- run: npm run build
|
|
- name: Docker build
|
|
run: docker build -t ihasmail:ci .
|