Skip to content

Commit 4148d56

Browse files
ryanleecoderyanleecode
authored
fix: security issues with CI (#2501)
prevents getting pwned: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
1 parent 5f83e4e commit 4148d56

File tree

3 files changed

+123
-91
lines changed

3 files changed

+123
-91
lines changed

‎.github/workflows/ci.yml

+17-91
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
1-
name: Substrate Connect CI
1+
name: Continuous Integration and Deployment
22

33
on:
44
push:
55
branches: [ main ]
6-
pull_request:
7-
branches: [ main ]
86

97
permissions:
108
contents: write
@@ -13,82 +11,13 @@ permissions:
1311
pull-requests: write
1412

1513
jobs:
16-
build:
17-
runs-on: ubuntu-latest
18-
19-
strategy:
20-
matrix:
21-
node-version: [18.x, 20.x]
22-
23-
steps:
24-
- uses: actions/checkout@v4.1.7
25-
- uses: ./.github/actions/turbo-build
26-
with:
27-
node-version: ${{ matrix.node-version }}
28-
29-
playwright-test-extension:
30-
needs: [build]
31-
timeout-minutes: 10
32-
runs-on: ubuntu-latest
33-
steps:
34-
- uses: actions/checkout@v4.1.7
35-
- uses: ./.github/actions/turbo-build
36-
- name: Build extension with Manifest v3 for Chrome
37-
run: pnpm build:chrome
38-
working-directory: ./projects/extension
39-
- run: pnpm playwright:install
40-
working-directory: ./projects/extension
41-
- name: Test projects/extension
42-
run: pnpm playwright:chromium --trace on
43-
working-directory: ./projects/extension
44-
- uses: actions/upload-artifact@v4
45-
if: failure()
46-
with:
47-
name: playwright-report-substrate-connect-extension-mv3-chrome
48-
path: ./projects/extension/playwright-report
49-
50-
playwright-test-examples:
51-
needs: [build]
52-
timeout-minutes: 10
53-
runs-on: ubuntu-latest
54-
steps:
55-
- uses: actions/checkout@v4.1.7
56-
- uses: ./.github/actions/turbo-build
57-
- run: pnpm playwright:install
58-
working-directory: ./examples/light-client-extension-helpers-extension
59-
- name: Test examples/light-client-extension-helpers-extension
60-
run: pnpm playwright:chromium --trace on
61-
working-directory: ./examples/light-client-extension-helpers-extension
62-
- uses: actions/upload-artifact@v4
63-
if: failure()
64-
with:
65-
name: playwright-report-light-client-extension-helpers-extension-mv3-chrome
66-
path: ./examples/light-client-extension-helpers-extension/playwright-report
67-
68-
playwright-test-wallet-template:
69-
needs: [build]
70-
timeout-minutes: 10
71-
runs-on: ubuntu-latest
72-
steps:
73-
- uses: actions/checkout@v4.1.7
74-
- uses: ./.github/actions/turbo-build
75-
- name: Build extension with Manifest v3 for Chrome
76-
run: pnpm build:chrome
77-
working-directory: ./projects/wallet-template
78-
- run: pnpm playwright:install
79-
working-directory: ./projects/wallet-template
80-
- name: Test projects/wallet-template
81-
run: pnpm playwright:chromium --trace on
82-
working-directory: ./projects/wallet-template
83-
- uses: actions/upload-artifact@v4
84-
if: failure()
85-
with:
86-
name: playwright-report-substrate-connect-wallet-template-mv3-chrome
87-
path: ./projects/wallet-template/playwright-report
14+
run-ci:
15+
uses: ./.github/workflows/reusable-ci.yml
16+
with:
17+
upload-artifacts: true
8818

8919
changesets:
90-
if: github.ref == 'refs/heads/main'
91-
needs: [build]
20+
needs: [run-ci]
9221
runs-on: ubuntu-latest
9322
steps:
9423
- name: Generate a token
@@ -109,8 +38,7 @@ jobs:
10938
GITHUB_TOKEN: ${{ steps.gen_token.outputs.token }}
11039

11140
npm-publish:
112-
if: github.ref == 'refs/heads/main'
113-
needs: [build]
41+
needs: [run-ci]
11442
runs-on: ubuntu-latest
11543
steps:
11644
- uses: actions/checkout@v4.1.7
@@ -167,8 +95,7 @@ jobs:
16795
package-directory: ./packages/smoldot-discovery-connector
16896

16997
upload-extension-artifacts:
170-
if: github.ref == 'refs/heads/main'
171-
needs: [build]
98+
needs: [run-ci]
17299
runs-on: ubuntu-latest
173100
steps:
174101
- uses: actions/checkout@v4.1.7
@@ -189,32 +116,31 @@ jobs:
189116
path: ./projects/extension/dist
190117

191118
docs:
192-
if: github.ref == 'refs/heads/main'
193-
needs: [build]
119+
needs: [run-ci]
194120
runs-on: ubuntu-latest
195121
steps:
196122
- uses: actions/checkout@v4.1.7
197123
- uses: ./.github/actions/turbo-build
198124
- name: Generate API Docs
199125
run: pnpm api-docs
200-
201126
- name: Setup Pages
202127
uses: actions/configure-pages@v3
203-
204128
- name: Upload artifact
205129
uses: actions/upload-pages-artifact@v2
206130
with:
207-
# Upload entire repository
208131
path: './docs'
209-
210132
- name: Deploy to GitHub Pages
211133
id: deployment
212134
uses: actions/deploy-pages@v2
213135

214136
all:
215-
# This dummy job depends on all the mandatory checks. It succeeds if and only if all CI checks
216-
# are successful.
217-
needs: [build, playwright-test-extension, playwright-test-examples, playwright-test-wallet-template]
137+
needs: [run-ci, changesets, npm-publish, upload-extension-artifacts, docs]
218138
runs-on: ubuntu-latest
139+
if: always()
219140
steps:
220-
- run: echo Success
141+
- name: Check job status
142+
if: contains(needs.*.result, 'failure')
143+
run: exit 1
144+
- name: All jobs completed successfully
145+
if: success()
146+
run: echo "All jobs completed successfully!"

‎.github/workflows/pr-ci.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Pull Request CI
2+
3+
on:
4+
pull_request:
5+
branches: [ main ]
6+
7+
permissions: read-all
8+
9+
jobs:
10+
run-ci:
11+
uses: ./.github/workflows/reusable-ci.yml
12+
with:
13+
upload-artifacts: false

‎.github/workflows/reusable-ci.yml

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Reusable CI Workflow
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
upload-artifacts:
7+
type: boolean
8+
default: false
9+
required: false
10+
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
strategy:
15+
matrix:
16+
node-version: [18.x, 20.x]
17+
steps:
18+
- uses: actions/checkout@v4.1.7
19+
- uses: ./.github/actions/turbo-build
20+
with:
21+
node-version: ${{ matrix.node-version }}
22+
23+
playwright-test-extension:
24+
needs: [build]
25+
timeout-minutes: 10
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@v4.1.7
29+
- uses: ./.github/actions/turbo-build
30+
- name: Build extension with Manifest v3 for Chrome
31+
run: pnpm build:chrome
32+
working-directory: ./projects/extension
33+
- run: pnpm playwright:install
34+
working-directory: ./projects/extension
35+
- name: Test projects/extension
36+
run: pnpm playwright:chromium --trace on
37+
working-directory: ./projects/extension
38+
- uses: actions/upload-artifact@v4
39+
if: failure() || inputs.upload-artifacts
40+
with:
41+
name: playwright-report-substrate-connect-extension-mv3-chrome
42+
path: ./projects/extension/playwright-report
43+
44+
playwright-test-examples:
45+
needs: [build]
46+
timeout-minutes: 10
47+
runs-on: ubuntu-latest
48+
steps:
49+
- uses: actions/checkout@v4.1.7
50+
- uses: ./.github/actions/turbo-build
51+
- run: pnpm playwright:install
52+
working-directory: ./examples/light-client-extension-helpers-extension
53+
- name: Test examples/light-client-extension-helpers-extension
54+
run: pnpm playwright:chromium --trace on
55+
working-directory: ./examples/light-client-extension-helpers-extension
56+
- uses: actions/upload-artifact@v4
57+
if: failure() || inputs.upload-artifacts
58+
with:
59+
name: playwright-report-light-client-extension-helpers-extension-mv3-chrome
60+
path: ./examples/light-client-extension-helpers-extension/playwright-report
61+
62+
playwright-test-wallet-template:
63+
needs: [build]
64+
timeout-minutes: 10
65+
runs-on: ubuntu-latest
66+
steps:
67+
- uses: actions/checkout@v4.1.7
68+
- uses: ./.github/actions/turbo-build
69+
- name: Build extension with Manifest v3 for Chrome
70+
run: pnpm build:chrome
71+
working-directory: ./projects/wallet-template
72+
- run: pnpm playwright:install
73+
working-directory: ./projects/wallet-template
74+
- name: Test projects/wallet-template
75+
run: pnpm playwright:chromium --trace on
76+
working-directory: ./projects/wallet-template
77+
- uses: actions/upload-artifact@v4
78+
if: failure() || inputs.upload-artifacts
79+
with:
80+
name: playwright-report-substrate-connect-wallet-template-mv3-chrome
81+
path: ./projects/wallet-template/playwright-report
82+
83+
all:
84+
needs: [build, playwright-test-extension, playwright-test-examples, playwright-test-wallet-template]
85+
runs-on: ubuntu-latest
86+
if: always()
87+
steps:
88+
- name: Check job status
89+
if: contains(needs.*.result, 'failure')
90+
run: exit 1
91+
- name: All jobs completed successfully
92+
if: success()
93+
run: echo "All jobs completed successfully!"

0 commit comments

Comments
 (0)