From ddfffccf188146d1f0b2137c3dbcbd8c45405af0 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Mon, 27 Jul 2026 00:47:37 +0000 Subject: [PATCH 1/4] chore: pin actions/checkout using commit hash --- .github/workflows/asset-size.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/tests.yml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/asset-size.yml b/.github/workflows/asset-size.yml index 4b7edad1b..a1ab65d47 100644 --- a/.github/workflows/asset-size.yml +++ b/.github/workflows/asset-size.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: chrysanthos/simple-asset-size-reporter@1.0.2 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1cf34bb70..015107636 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,7 +15,7 @@ jobs: environment: npm-publish # binds this job to the approval-gated env steps: - name: Checkout the tagged commit - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.release.tag_name }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 806319bd7..af6d5cd20 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -24,7 +24,7 @@ jobs: git config --global core.autocrlf false git config --global core.symlinks true if: runner.os == 'Windows' - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@v7 with: @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-node@v7 with: node-version: 22 @@ -73,7 +73,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-node@v7 with: node-version: 22 From 218db550abf3ad0fdd2375de20a0e506f1f46b61 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Mon, 27 Jul 2026 00:49:15 +0000 Subject: [PATCH 2/4] chore: pin actions/setup-node using commit hash --- .github/workflows/publish.yml | 2 +- .github/workflows/tests.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 015107636..bbba0ce89 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -20,7 +20,7 @@ jobs: ref: ${{ github.event.release.tag_name }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index af6d5cd20..9adafac55 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -26,7 +26,7 @@ jobs: if: runner.os == 'Windows' - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} - name: Pin npm version @@ -50,7 +50,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - name: Pin npm version @@ -74,7 +74,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - name: Pin npm version From 81d5c0032c5e43f703e938c058ddf524c3ed9e43 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Mon, 27 Jul 2026 00:51:41 +0000 Subject: [PATCH 3/4] chore: pin actions/cache using commit hash --- .github/workflows/tests.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 9adafac55..b9e821259 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -32,7 +32,7 @@ jobs: - name: Pin npm version run: npm install -g npm@11.10.0 - name: Cache node modules - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.npm key: v2-${{ runner.os }}-node-${{ matrix.node-version }}-npm-${{ hashFiles('**/package-lock.json') }} @@ -56,7 +56,7 @@ jobs: - name: Pin npm version run: npm install -g npm@11.10.0 - name: Cache node modules - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.npm key: v2-npm-${{ hashFiles('**/package-lock.json') }} @@ -80,7 +80,7 @@ jobs: - name: Pin npm version run: npm install -g npm@11.10.0 - name: Cache node modules - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.npm key: v2-npm-${{ hashFiles('**/package-lock.json') }} From 395029afb6798c389d5ea5238f54a316d8312545 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Mon, 27 Jul 2026 00:57:42 +0000 Subject: [PATCH 4/4] chore: add '--ignore-scripts' flag for 'npm ci' command --- .github/workflows/publish.yml | 2 +- .github/workflows/tests.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bbba0ce89..fe5100931 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: run: npm install -g npm@11.10.0 - name: Install dependencies (honor lockfile) - run: npm ci + run: npm ci --ignore-scripts - name: Build dist artifacts run: npm run build diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index b9e821259..7d6a01448 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -62,7 +62,7 @@ jobs: key: v2-npm-${{ hashFiles('**/package-lock.json') }} restore-keys: | v2-npm- - - run: npm ci + - run: npm ci --ignore-scripts - run: npm run benchmark env: CI: true @@ -86,7 +86,7 @@ jobs: key: v2-npm-${{ hashFiles('**/package-lock.json') }} restore-keys: | v2-npm- - - run: npm ci + - run: npm ci --ignore-scripts - run: npx tsc -p tsconfig.check.json env: CI: true