Skip to content

Commit 92e79b4

Browse files
niemyjskiniemyjski
committed
Harden dependency refresh and CI supply chain
1 parent ac3cc6c commit 92e79b4

15 files changed

Lines changed: 664 additions & 522 deletions

‎.github/workflows/build.yml‎

Lines changed: 119 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,31 @@
11
name: Build
22
on: [push, pull_request]
33

4+
concurrency:
5+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
6+
cancel-in-progress: true
7+
48
permissions:
59
contents: read
6-
id-token: write
7-
packages: write
810

911
jobs:
10-
build:
11-
runs-on: ${{ matrix.os }}
12-
strategy:
13-
matrix:
14-
os:
15-
- ubuntu-latest
16-
- macos-latest
17-
- windows-latest
18-
node_version:
19-
- 24
20-
name: Node ${{ matrix.node_version }} on ${{ matrix.os }}
12+
version:
13+
name: Determine build version
14+
runs-on: ubuntu-latest
15+
outputs:
16+
version: ${{ steps.version.outputs.version }}
2117
steps:
2218
- name: Checkout
23-
uses: actions/checkout@v7
19+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2420
with:
2521
fetch-depth: 0
26-
- name: Build Reason
22+
persist-credentials: false
23+
- name: Setup .NET SDK for MinVer
24+
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
25+
with:
26+
dotnet-version: "10.0.x"
27+
- name: Build Version
28+
id: version
2729
shell: bash
2830
run: |
2931
branch=${GITHUB_REF##*/}.
@@ -36,68 +38,127 @@ jobs:
3638
elif [[ "${GITHUB_REF}" = refs/pull* ]]; then
3739
branch=""
3840
fi
39-
echo "GIT_BRANCH_SUFFIX=$branch" >> $GITHUB_ENV
40-
echo "ref: $GITHUB_REF event: $GITHUB_EVENT_NAME branch_suffix: $branch"
41-
- name: Setup Node.js environment
42-
uses: actions/setup-node@v7
43-
with:
44-
node-version: ${{ matrix.node_version }}
45-
registry-url: "https://registry.npmjs.org"
46-
- name: Cache node_modules
47-
uses: actions/cache@v6
48-
with:
49-
path: node_modules
50-
key: ${{ matrix.node_version }}-${{ runner.os }}-node-modules-${{ hashFiles('package-lock.json') }}
51-
- name: Setup .NET SDK for MinVer
52-
uses: actions/setup-dotnet@v6
53-
with:
54-
dotnet-version: "10.0.x"
55-
- name: Build Version
56-
id: version
57-
shell: bash
58-
run: |
41+
5942
dotnet tool install --global minver-cli --version 7.0.0
60-
version=$(minver --tag-prefix v --default-pre-release-identifiers "preview.${GIT_BRANCH_SUFFIX}0" --minimum-major-minor 3.0)
43+
version=$(minver --tag-prefix v --default-pre-release-identifiers "preview.${branch}0" --minimum-major-minor 3.0)
6144
62-
# If on a non-main branch, insert branch name before the height (last numeric segment)
63-
if [ -n "$GIT_BRANCH_SUFFIX" ]; then
64-
branch_name="${GIT_BRANCH_SUFFIX%.}"
45+
if [ -n "$branch" ]; then
46+
branch_name="${branch%.}"
6547
if [[ "$version" != *"$branch_name"* ]]; then
66-
version=$(echo "$version" | sed -E "s/\.([0-9]+)$/.${GIT_BRANCH_SUFFIX}\1/")
48+
version=$(echo "$version" | sed -E "s/\.([0-9]+)$/.${branch}\1/")
6749
fi
6850
fi
6951
70-
echo "version=$version" >> $GITHUB_OUTPUT
52+
echo "version=$version" >> "$GITHUB_OUTPUT"
7153
echo "Version: $version"
72-
echo "### Version: $version" >> $GITHUB_STEP_SUMMARY
54+
echo "### Version: $version" >> "$GITHUB_STEP_SUMMARY"
7355
74-
npm install --global replace-in-files-cli
75-
replace-in-files --string="3.0.0-dev" --replacement=$version packages/core/src/configuration/Configuration.ts
76-
replace-in-files --string="3.0.0-dev" --replacement=$version **/package*.json
77-
npm ci
56+
build:
57+
needs: version
58+
runs-on: ${{ matrix.os }}
59+
strategy:
60+
matrix:
61+
os:
62+
- ubuntu-latest
63+
- macos-latest
64+
- windows-latest
65+
node_version:
66+
- 24
67+
name: Node ${{ matrix.node_version }} on ${{ matrix.os }}
68+
steps:
69+
- name: Checkout
70+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
71+
with:
72+
persist-credentials: false
73+
- name: Setup Node.js environment
74+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
75+
with:
76+
node-version: ${{ matrix.node_version }}
77+
registry-url: "https://registry.npmjs.org"
78+
cache: npm
79+
cache-dependency-path: package-lock.json
80+
- name: Apply Build Version
81+
env:
82+
BUILD_VERSION: ${{ needs.version.outputs.version }}
83+
run: node scripts/set-build-version.mjs
84+
- name: Install Dependencies
85+
run: npm ci
7886
- name: Build
7987
run: npm run build
8088
- name: Lint
8189
run: npm run lint
8290
- name: Run Tests
8391
run: npm test
92+
93+
publish-release:
94+
name: Publish npm release
95+
if: startsWith(github.ref, 'refs/tags/v')
96+
needs: [version, build]
97+
runs-on: ubuntu-latest
98+
permissions:
99+
contents: read
100+
id-token: write # Required for npm trusted publishing.
101+
steps:
102+
- name: Checkout
103+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
104+
with:
105+
persist-credentials: false
106+
- name: Setup Node.js environment
107+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
108+
with:
109+
node-version: 24
110+
registry-url: "https://registry.npmjs.org"
111+
cache: npm
112+
cache-dependency-path: package-lock.json
113+
- name: Apply Build Version
114+
env:
115+
BUILD_VERSION: ${{ needs.version.outputs.version }}
116+
run: node scripts/set-build-version.mjs
117+
- name: Install Dependencies
118+
run: npm ci
119+
- name: Build
120+
run: npm run build
84121
- name: Publish Release Packages
85-
if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'ubuntu-latest'
86122
run: npm publish --workspaces --access public
87-
- name: Setup GitHub CI Node.js environment
88-
if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/heads/') && matrix.os == 'ubuntu-latest' && contains(steps.version.outputs.version, '-')
89-
uses: actions/setup-node@v7
123+
124+
publish-github:
125+
name: Publish GitHub CI packages
126+
if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && contains(needs.version.outputs.version, '-')
127+
needs: [version, build]
128+
runs-on: ubuntu-latest
129+
permissions:
130+
contents: read
131+
packages: write # Required to publish with GITHUB_TOKEN.
132+
steps:
133+
- name: Checkout
134+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
90135
with:
91-
node-version: ${{ matrix.node_version }}
136+
persist-credentials: false
137+
- name: Setup Node.js environment
138+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
139+
with:
140+
node-version: 24
141+
registry-url: "https://registry.npmjs.org"
142+
cache: npm
143+
cache-dependency-path: package-lock.json
144+
- name: Apply Build Version
145+
env:
146+
BUILD_VERSION: ${{ needs.version.outputs.version }}
147+
run: node scripts/set-build-version.mjs
148+
- name: Install Dependencies
149+
run: npm ci
150+
- name: Build
151+
run: npm run build
152+
- name: Setup GitHub Packages registry
153+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
154+
with:
155+
node-version: 24
92156
registry-url: "https://npm.pkg.github.com"
93157
scope: "@exceptionless"
94158
- name: Push GitHub CI Packages
95-
if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/heads/') && matrix.os == 'ubuntu-latest' && contains(steps.version.outputs.version, '-')
96159
shell: bash
97-
run: |
98-
TAG_BRANCH="${GIT_BRANCH_SUFFIX%.}"
99-
TAG_BRANCH="${TAG_BRANCH:-main}"
100-
TAG_BRANCH="${TAG_BRANCH//\//-}"
101-
npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" || true
160+
run: | # zizmor: ignore[use-trusted-publishing] GitHub Packages uses GITHUB_TOKEN.
161+
TAG_BRANCH="${GITHUB_REF##*/}"
162+
npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}"
102163
env:
103-
NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
164+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.npmrc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
legacy-peer-deps=true
22
min-release-age=7
3+
# Security fixes for GHSA-w2rr-34g9-rvrj, GHSA-4w3w-2rp5-g8jm, and GHSA-g53g-w8rj-fmg7.
4+
min-release-age-exclude[]=@xmldom/xmldom

‎eslint.config.mjs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,17 @@ export default defineConfig(
3131
"@typescript-eslint/no-misused-promises": ["error", { checksVoidReturn: false }]
3232
}
3333
},
34+
{
35+
files: ["scripts/**/*.mjs"],
36+
...tseslint.configs.disableTypeChecked,
37+
languageOptions: {
38+
...tseslint.configs.disableTypeChecked.languageOptions,
39+
globals: {
40+
console: "readonly",
41+
process: "readonly"
42+
}
43+
}
44+
},
3445
eslintConfigPrettier,
3546
{
3647
files: ["**/test/**/*.ts"],

‎example/browser/text-area-logger.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ export class TextAreaLogger {
1111
} else {
1212
document.addEventListener("DOMContentLoaded", () => {
1313
this.element = document.getElementById(elementId);
14-
this.element.innerHTML = this.messageBuffer.join("\n") + this.element.innerHTML;
14+
this.element.value = this.messageBuffer.join("\n") + this.element.value;
1515
this.messageBuffer = [];
1616
});
1717
}
@@ -37,7 +37,7 @@ export class TextAreaLogger {
3737
log(level, message) {
3838
const formattedMessage = `${new Date().toISOString()} [${level}] ${message}`;
3939
if (this.element) {
40-
this.element.innerHTML += `\n${formattedMessage}`;
40+
this.element.value += `\n${formattedMessage}`;
4141
} else {
4242
this.messageBuffer.push(formattedMessage);
4343
}

‎example/expo/package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@
1616
"@exceptionless/react-native": "3.0.0-dev",
1717
"@expo/metro-runtime": "~57.0.8",
1818
"@react-native-async-storage/async-storage": "2.2.0",
19-
"expo": "~57.0.9",
19+
"expo": "~57.0.10",
2020
"expo-application": "~57.0.2",
21-
"expo-constants": "~57.0.8",
21+
"expo-constants": "~57.0.9",
2222
"expo-dev-client": "~57.0.10",
2323
"expo-device": "~57.0.1",
2424
"expo-splash-screen": "~57.0.5",
@@ -27,7 +27,7 @@
2727
"react-dom": "19.2.3",
2828
"react-native": "0.86.2",
2929
"react-native-safe-area-context": "~5.7.0",
30-
"react-native-screens": "~4.26.0",
30+
"react-native-screens": "~4.26.2",
3131
"react-native-web": "^0.21.2"
3232
},
3333
"devDependencies": {

‎example/nextjs/AGENTS.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!-- BEGIN:nextjs-agent-rules -->
2+
3+
# This is NOT the Next.js you know
4+
5+
This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
6+
7+
This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
8+
9+
<!-- END:nextjs-agent-rules -->

‎example/nextjs/CLAUDE.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@AGENTS.md

‎example/nextjs/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"dependencies": {
1111
"@exceptionless/browser": "3.0.0-dev",
1212
"@exceptionless/node": "3.0.0-dev",
13-
"next": "^16.2.12",
13+
"next": "^16.3.0",
1414
"react": "19.2.3",
1515
"react-dom": "19.2.3"
1616
},

‎example/react/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"devDependencies": {
2828
"@testing-library/dom": "^10.4.1",
2929
"@testing-library/react": "^16.3.2",
30-
"@testing-library/user-event": "^14.6.1",
30+
"@testing-library/user-event": "^14.6.3",
3131
"@vitejs/plugin-react": "^6.0.5",
3232
"vite": "^8.2.0"
3333
},

‎example/vue/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@
88
"serve": "vite preview"
99
},
1010
"dependencies": {
11-
"vue": "^3.5.40",
11+
"vue": "^3.5.41",
1212
"@exceptionless/vue": "3.0.0-dev"
1313
},
1414
"devDependencies": {
1515
"@vitejs/plugin-vue": "^6.0.8",
16-
"@vue/compiler-sfc": "^3.5.40",
16+
"@vue/compiler-sfc": "^3.5.41",
1717
"vite": "^8.2.0"
1818
},
1919
"type": "module",

0 commit comments

Comments
 (0)