From 23be03d720b94d615a8586424ea40b1c74d9747e Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Sat, 17 May 2025 16:53:13 +0000 Subject: [PATCH 1/3] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci.yml | 16 +++++++++++----- 2 files changed, 22 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..bb85b6f9 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + + - package-ecosystem: npm + directory: / + schedule: + interval: daily diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff3bce76..10e46131 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,9 @@ on: - pull_request - push +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -126,7 +129,7 @@ jobs: node-version: "21.6" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install Node.js ${{ matrix.node-version }} shell: bash -eo pipefail -l {0} @@ -204,7 +207,7 @@ jobs: fi - name: Upload code coverage - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: steps.list_env.outputs.nyc != '' with: name: coverage-${{ matrix.node-version }} @@ -212,17 +215,20 @@ jobs: retention-days: 1 coverage: + permissions: + checks: write # for coverallsapp/github-action to create new checks + contents: read # for actions/checkout to fetch code needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install lcov shell: bash run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: path: ./coverage @@ -231,6 +237,6 @@ jobs: run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info - name: Upload coverage report - uses: coverallsapp/github-action@master + uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master with: github-token: ${{ secrets.GITHUB_TOKEN }} From 1fe271c1d75f98adf8d7ec1374cb422035c750ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Sat, 17 May 2025 18:53:43 +0200 Subject: [PATCH 2/3] Update dependabot.yml --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bb85b6f9..69f2040f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,9 +3,9 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: monthly - package-ecosystem: npm directory: / schedule: - interval: daily + interval: monthly From 8c58a79eb29f62c34fdb83b174381981ce330917 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 17 May 2025 12:28:18 -0500 Subject: [PATCH 3/3] ping supertest versions in CI Signed-off-by: Sebastian Beltran --- .github/workflows/ci.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 10e46131..746b29e1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -82,33 +82,34 @@ jobs: - name: Node.js 8.x node-version: "8.17" - npm-i: mocha@7.2.0 nyc@14.1.1 + npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6 - name: Node.js 9.x node-version: "9.11" - npm-i: mocha@7.2.0 nyc@14.1.1 + npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6 - name: Node.js 10.x node-version: "10.24" - npm-i: mocha@8.4.0 + npm-i: mocha@8.4.0 supertest@6.1.6 - name: Node.js 11.x node-version: "11.15" - npm-i: mocha@8.4.0 + npm-i: mocha@8.4.0 supertest@6.1.6 - name: Node.js 12.x node-version: "12.22" - npm-i: mocha@9.2.2 + npm-i: mocha@9.2.2 supertest@6.1.6 - name: Node.js 13.x node-version: "13.14" - npm-i: mocha@9.2.2 + npm-i: mocha@9.2.2 supertest@6.1.6 - name: Node.js 14.x node-version: "14.21" - name: Node.js 15.x - node-version: "15.14" + node-version: "15.14" + npm-i: supertest@6.1.6 - name: Node.js 16.x node-version: "16.20"