ci: SHA-pin all GitHub Actions in CI workflow #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: [push] | |
| jobs: | |
| test-and-build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: [20.10.0] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Run Snyk to check for vulnerabilities | |
| # Was `@master` — a mutable branch ref on a third-party action running | |
| # with SNYK_TOKEN in scope. Pinned to the v1.0.0 release commit. | |
| # NOTE: this action is Docker-based and still pulls the mutable | |
| # `docker://snyk/snyk:node` image at runtime, so the SHA pin bounds the | |
| # action code but not the scanner image. | |
| uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high --fail-on=upgradable | |
| - name: Lint | |
| run: yarn lint | |
| - name: Test | |
| run: yarn test --coverage | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: segmentio/fql-ts |