svelte

Commit Graph

Author	SHA1	Message	Date
dagecko	e0f925116c	fix: pin 9 actions to commit SHA (#18025 ) Re-submission of #18017. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise. ## Summary This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags. - Pin 9 unpinned actions to full 40-character SHAs - Add version comments for readability ## Changes by file \| File \| Changes \| \|------\|---------\| \| autofix.yml \| Pinned actions to SHA \| \| ci.yml \| Pinned actions to SHA \| \| pkg.pr.new.yml \| Pinned actions to SHA \| \| release.yml \| Pinned actions to SHA \| ## A note on internal action pinning This PR pins all actions including org-owned ones. Best practice is to pin everything — the tj-actions/changed-files attack was an internally maintained action that was compromised, and every repo referencing it by tag silently executed attacker code. That said, it's your codebase. If you'd prefer to leave org-owned actions unpinned, let us know and we'll adjust the PR. ## How to verify Review the diff — each change is mechanical and preserves workflow behavior: - SHA pinning: `action@v3` becomes `action@abc123 # v3` — original version preserved as comment - No workflow logic, triggers, or permissions are modified I wrote a scanner called Runner Guard and open sourced it [here](https://github.com/Vigilant-LLC/runner-guard). If you have any questions, reach out. I'll be monitoring comms. \- Chris Nyhuis (dagecko)	3 weeks ago
Elliott Johnson	f6e8b1d11e	chore: require pr number as input when manually invoking pkg.pr.new (#17797 )	2 months ago
Elliott Johnson	168702d546	chore: compensate for github's complete lack of devex (#17698 ) As far as we can tell, there's no good way to turn off deployment request notifications. This removes automatic pkg.pr.new builds for commits not pushed directly to the svelte repository, meaning forks' commits will have to be manually requested through the GitHub Actions UI. It also makes the drive-by change of deriving the PR number from the commit, which technically is a "breaking change" because there _could_ be multiple PRs associated with a commit... but let's just not do that and we'll be okay.	2 months ago
Elliott Johnson	660c4c12b1	chore: off-by-one in workflow (#17634 )	3 months ago
Elliott Johnson	3970e7a302	chore: fix pkg.pr.new workflow (#17633 )	3 months ago
Pádraic Slattery	6e4820dcf6	chore: Update outdated GitHub Actions versions (#17487 )	3 months ago
Simon H	bb33c555b4	chore: bump some dev deps, harden github actions (#16851 )	7 months ago
Rich Harris	a5240ccfe4	use pnpm/action-setup (#15744 )	1 year ago
Rich Harris	e9a16c4b42	chore: revert corepack override (#15197 ) * Revert "try this (#15196)" This reverts commit `f878736f38`. * upgrade node * upgrade pnpm --------- Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>	1 year ago
Rich Harris	1efad3f6e2	chore: add monitoring to github actions (#15436 ) * chore: add monitoring to github actions * try this	1 year ago
Rich Harris	f878736f38	try this (#15196 )	1 year ago
Paolo Ricciuti	16a40a8bce	fix: use both correct paths (#14157 ) * fix: try to read from right folder * fix: use both correct paths	1 year ago
Paolo Ricciuti	f1f4c29a99	fix: `pkg.pr.new` comment workflow (#14156 ) * fix: `pkg.pr.new` comment workflow * chore: remove path from initial workflow and add ls * chore: add path back since it's mandatory	1 year ago
Paolo Ricciuti	0ce4b559f2	chore: add custom comment with link to playground for `pkg.pr.new` (#14151 ) * chore: add custom comment with link to playground for `pkg.pr.new` * chore: small updates to the script output * chore: refine comment a bit, include multiple packages * tweak comment * chore: two steps workflow * chore: update workflow --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	1 year ago
Paolo Ricciuti	b5750ac667	chore: setup `pkg.pr.new` (#13891 ) * chore: setup `pkg.pr.new` * chore: let's try with this	2 years ago

15 Commits (18479217a736e51fa570b13cf1a4ae035c84e2ff)