Victor Lyuboslavsky
457aad6db9
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd workflows (catches any future misuse elsewhere). - excessive-permissions and artipacked — fixed and fully enforced (removed from gate). <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Improved CI/CD security by disabling credential persistence across many workflows. * Tightened workflow permissions to least-privilege for selected build and analysis jobs. * Made runner hardening and credential handling explicit in several deployment and test workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
96 lines
3.8 KiB
YAML
96 lines
3.8 KiB
YAML
name: Incubate website dependency changes
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'website/package.json'
|
|
- 'website/package-lock.json'
|
|
schedule:
|
|
- cron: '0 7 * * *' # 7am UTC nightly
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: write # needed for `gh run rerun`
|
|
|
|
concurrency:
|
|
group: incubate-website-deps-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
check-website-dep-changes:
|
|
runs-on: ubuntu-22.04
|
|
env:
|
|
INCUBATION_HOURS: 72
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- name: Checkout
|
|
if: github.event_name == 'pull_request'
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
|
|
with:
|
|
fetch-depth: 0 # full history needed to compute commit timestamp
|
|
persist-credentials: false
|
|
|
|
- name: Verify 72-hour incubation
|
|
if: github.event_name == 'pull_request'
|
|
shell: bash
|
|
env:
|
|
GITHUB_WORKFLOW_NAME: ${{ github.workflow }}
|
|
GITHUB_HEAD_REF: ${{ github.head_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --no-tags origin "${GITHUB_BASE_REF}"
|
|
THRESHOLD_SECONDS=$(( INCUBATION_HOURS * 3600 ))
|
|
# Confirm this PR branch actually touches the dep files.
|
|
HAS_DEP_CHANGE=$(git log -1 --format=%H \
|
|
"origin/${GITHUB_BASE_REF}..HEAD" \
|
|
-- website/package.json website/package-lock.json || true)
|
|
if [ -z "${HAS_DEP_CHANGE}" ]; then
|
|
echo "No website dependency changes on this branch relative to ${GITHUB_BASE_REF}."
|
|
exit 0
|
|
fi
|
|
# Use the wall-clock creation time of the *earliest* run for this workflow
|
|
# on this PR — unaffected by force-pushed commit timestamps.
|
|
EARLIEST_RUN_TS=$(gh run list \
|
|
--repo "${GITHUB_REPOSITORY}" \
|
|
--workflow "${GITHUB_WORKFLOW_NAME}" \
|
|
--event pull_request \
|
|
--branch "${GITHUB_HEAD_REF}" \
|
|
--limit 100 \
|
|
--json databaseId,createdAt \
|
|
--jq 'sort_by(.createdAt) | .[0].createdAt' )
|
|
EARLIEST_RUN_EPOCH=$(date -d "${EARLIEST_RUN_TS}" +%s)
|
|
AGE=$(( $(date +%s) - EARLIEST_RUN_EPOCH ))
|
|
AGE_HOURS=$(( AGE / 3600 ))
|
|
if [ "${AGE}" -lt "${THRESHOLD_SECONDS}" ]; then
|
|
REMAINING=$(( (THRESHOLD_SECONDS - AGE + 3599) / 3600 ))
|
|
echo "::error::Website dependency files were changed ${AGE_HOURS}h ago. Incubation period is ${INCUBATION_HOURS}h. Wait ~${REMAINING}h, then re-run this check."
|
|
exit 1
|
|
fi
|
|
echo "Incubation complete: last website dep change was ${AGE_HOURS}h ago."
|
|
|
|
- name: Re-run previously-failed PR checks (nightly)
|
|
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
|
|
shell: bash
|
|
env:
|
|
GITHUB_WORKFLOW_NAME: ${{ github.workflow }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Find recent failed runs of THIS workflow on pull_request events and re-trigger them.
|
|
# As wall-clock time advances, the git-log age in each rerun grows past the 72h threshold
|
|
# and the run passes — flipping the required check green without requiring a force-push.
|
|
gh run list \
|
|
--repo "${GITHUB_REPOSITORY}" \
|
|
--workflow "${GITHUB_WORKFLOW_NAME}" \
|
|
--event pull_request \
|
|
--status failure \
|
|
--created ">$(date -u -d '7 days ago' '+%Y-%m-%dT%H:%M:%SZ')" \
|
|
--limit 100 \
|
|
--json databaseId \
|
|
--jq '.[].databaseId' \
|
|
| while read -r run_id; do
|
|
echo "Re-running failed run ${run_id}"
|
|
gh run rerun "${run_id}" --repo "${GITHUB_REPOSITORY}" || true
|
|
done
|