GlcoinCore/lightning-terminal
1
0
Fork 0
mirror of https://github.com/lightninglabs/lightning-terminal.git synced 2026-08-13 12:33:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #1306 from erickcestari/harden-ci-workflow

Browse source 
ci: harden main.yml workflow against supply-chain risks
This commit is contained in:
Viktor Torstensson 2026-07-27 11:59:27 +02:00 • committed by GitHub
commit e093948a35
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
.github/workflows/main.yml vendored
View file

@ -13,6 +13,9 @@ concurrency:
group: ${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
defaults:
run:
shell: bash
@ -49,7 +52,7 @@ jobs:
- name: install dependencies
working-directory: ./app
run: yarn
run: yarn install --frozen-lockfile
- name: lint code
working-directory: ./app
@ -153,7 +156,7 @@ jobs:
- name: install dependencies
working-directory: ./app
run: yarn
run: yarn install --frozen-lockfile
- name: run check
run: make rpc-js-compile && make protos-check
@ -183,15 +186,20 @@ jobs:
go-version: '${{ env.GO_VERSION }}'
- name: fetch and rebase on ${{ github.base_ref }}
env:
BASE_REF: ${{ github.base_ref }}
REPOSITORY: ${{ github.repository }}
run: |
git remote add upstream https://github.com/${{ github.repository }}
git remote add upstream "https://github.com/${REPOSITORY}"
git fetch upstream
export GIT_COMMITTER_EMAIL="litd-ci@example.com"
export GIT_COMMITTER_NAME="LiT CI"
git rebase upstream/${{ github.base_ref }}
git rebase "upstream/${BASE_REF}"
- name: check commits
run: scripts/check-each-commit.sh upstream/${{ github.base_ref }}
env:
BASE_REF: ${{ github.base_ref }}
run: scripts/check-each-commit.sh "upstream/${BASE_REF}"
#######################
# sql model generation
@ -201,7 +209,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: git checkout
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: setup go ${{ env.GO_VERSION }}
uses: ./.github/actions/setup-go
@ -209,7 +217,7 @@ jobs:
go-version: '${{ env.GO_VERSION }}'
- name: docker image cache
uses: jpribyl/action-docker-layer-caching@v0.1.1
uses: jpribyl/action-docker-layer-caching@c632825d12ec837065f49726ea27ddd40bcc7894 # v0.1.1
continue-on-error: true
- name: Generate sql models
@ -329,7 +337,7 @@ jobs:
- name: install dependencies
working-directory: ./app
run: yarn
run: yarn install --frozen-lockfile
- name: run itest ${{ matrix.name }}
run: make ${{ matrix.args }}