Jordan Montgomery
8ae22b5586
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Related to, but does not resolve, #45267 Adds a 12h cooldown period such that when npm is resolving dependencies it will not resolve anything released less than 12 hours ago. This doesn't apply globally within the fleet project because some portions use yarn which #45267 will take care of however this does add it to our CI jobs and the .npmrc files for projects that use npm I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but that won't automatically set it on every runner so leaving it in here for now As far as QA local builds and CI are both green. Tested NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally using the npm package feed https://registry.npmjs.org/-/rss to verify that recently updated packages either chose an older version OR the update was blocked if I tried to choose a newer one # Checklist for submitter ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced npm supply-chain security by implementing package installation policies across build workflows and configuration files to exclude packages released within the last 12 hours. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
84 lines
3.2 KiB
YAML
84 lines
3.2 KiB
YAML
name: Test Fleet website
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "website/**"
|
|
- "docs/**"
|
|
- "handbook/**"
|
|
- "schema/**"
|
|
- "articles/**"
|
|
- ".github/workflows/test-website.yml"
|
|
- "ee/maintained-apps/outputs/**"
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
|
|
NPM_CONFIG_MIN_RELEASE_AGE: 0.5
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
strategy:
|
|
matrix:
|
|
node-version: [20.x]
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
# Set the Node.js version
|
|
- name: Use Node.js ${{ matrix.node-version }}
|
|
uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
|
|
with:
|
|
node-version: ${{ matrix.node-version }}
|
|
|
|
# 2025-08-07: The Storybook steps in website workflows have been temporarily disabled until a compatibility issue with the @storybook/test-runner has been resolved. See https://github.com/fleetdm/fleet/issues/31720 for more information.
|
|
# # Download top-level dependencies and build Storybook in the website's assets/ folder.
|
|
# - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose
|
|
|
|
# Now start building!
|
|
# > …but first, get a little crazy for a sec and delete the top-level package.json file
|
|
# > i.e. the one used by the Fleet server. This is because require() in node will go
|
|
# > hunting in ancestral directories for missing dependencies, and since some of the
|
|
# > bundled transpiler tasks sniff for package availability using require(), this trips
|
|
# > up when it encounters another Node universe in the parent directory.
|
|
- run: rm -rf package.json package-lock.json node_modules/
|
|
# > Turns out there's a similar issue with how eslint plugins are looked up, so we
|
|
# > delete the top level .eslintrc file too.
|
|
- run: rm -f .eslintrc.js
|
|
|
|
# Get dependencies (including dev deps)
|
|
- run: cd website/ && npm install
|
|
|
|
# Run sanity checks
|
|
- run: cd website/ && npm test
|
|
|
|
# Scan for malicious packages
|
|
# - name: Security Scan with Shai-Hulud Detector
|
|
# run: |
|
|
# git clone https://github.com/Cobenian/shai-hulud-detect
|
|
# cd shai-hulud-detect
|
|
# chmod +x shai-hulud-detector.sh
|
|
# # ./shai-hulud-detector.sh --paranoid ../ # Pipeline will automatically fail on exit codes 1 or 2
|
|
|
|
# Compile assets
|
|
- run: cd website/ && BUILD_SCRIPT_ARGS="--githubAccessToken=${{ secrets.FLEET_GITHUB_TOKEN_FOR_WEBSITE_TEST }}" npm run build-for-prod
|