From 1a0d1abb686c5c45c4986ef3db32e1059bdcdccc Mon Sep 17 00:00:00 2001 From: Max Milton Date: Fri, 16 Oct 2026 08:13:54 +1100 Subject: [PATCH 1/2] ci: Hardening; add actionlint, osv-scanner, harden other workflows --- .github/renovate.json | 1 + .github/workflows/actionlint.yml | 76 +++++++++++++++++++++++++++++++ .github/workflows/audit.yml | 17 ++++--- .github/workflows/ci.yml | 34 +++++++------- .github/workflows/codeql.yml | 26 +++++------ .github/workflows/osv-scanner.yml | 58 +++++++++++++++++++++++ .github/workflows/semgrep-pro.yml | 10 ++-- .github/workflows/semgrep.yml | 10 ++-- .github/workflows/sherif.yml | 4 +- .github/workflows/typos.yml | 5 +- .github/workflows/zizmor.yml | 7 ++- 11 files changed, 192 insertions(+), 56 deletions(-) create mode 100644 .github/workflows/actionlint.yml create mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/renovate.json b/.github/renovate.json index c7e29254..bb382a6f 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -5,6 +5,7 @@ "config:js-lib", "github>maxmilton/renovate-config", "github>maxmilton/renovate-config:auto", + "github>maxmilton/renovate-config:manual", "schedule:monthly" ] } diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml new file mode 100644 index 00000000..b8b995df --- /dev/null +++ b/.github/workflows/actionlint.yml @@ -0,0 +1,76 @@ +name: actionlint + +on: + push: + branches: + - master + - next + paths: + - ".github/**" + pull_request: + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true + +permissions: {} + +defaults: + run: + shell: bash + +jobs: + actionlint: + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + steps: + - name: Install ShellCheck + env: + # renovate: depName=koalaman/shellcheck + SHELLCHECK_VERSION: v0.11.0 + SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198 + run: | + tool_dir="$RUNNER_TEMP/shellcheck" + mkdir -p "$tool_dir" + curl --fail --silent --show-error --location --retry 3 \ + "https://github.com/koalaman/shellcheck/releases/download/$SHELLCHECK_VERSION/shellcheck-$SHELLCHECK_VERSION.linux.x86_64.tar.xz" \ + --output "$tool_dir/archive.tar.xz" + printf '%s %s\n' "$SHELLCHECK_SHA256" "$tool_dir/archive.tar.xz" | sha256sum --check --strict + tar -xJf "$tool_dir/archive.tar.xz" -C "$tool_dir" --strip-components=1 \ + "shellcheck-$SHELLCHECK_VERSION/shellcheck" + echo "$tool_dir" >> "$GITHUB_PATH" + "$tool_dir/shellcheck" --version + - name: Install actionlint + env: + # renovate: depName=rhysd/actionlint + ACTIONLINT_VERSION: v1.7.12 + ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 + run: | + tool_dir="$RUNNER_TEMP/actionlint" + version="${ACTIONLINT_VERSION#v}" + mkdir -p "$tool_dir" + curl --fail --silent --show-error --location --retry 3 \ + "https://github.com/rhysd/actionlint/releases/download/$ACTIONLINT_VERSION/actionlint_${version}_linux_amd64.tar.gz" \ + --output "$tool_dir/archive.tar.gz" + printf '%s %s\n' "$ACTIONLINT_SHA256" "$tool_dir/archive.tar.gz" | sha256sum --check --strict + tar -xzf "$tool_dir/archive.tar.gz" -C "$tool_dir" actionlint + echo "$tool_dir" >> "$GITHUB_PATH" + "$tool_dir/actionlint" -version + curl --fail --silent --show-error --location --retry 3 \ + https://raw.githubusercontent.com/rhysd/actionlint/main/.github/actionlint-matcher.json \ + --output "$RUNNER_TEMP/actionlint-matcher.json" + - run: pipx install "ruff==${RUFF_VERSION}" + env: + # renovate: datasource=pypi depName=ruff + RUFF_VERSION: 0.17.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Check workflow files + run: | + echo "::add-matcher::$RUNNER_TEMP/actionlint-matcher.json" + actionlint -color -verbose -shellcheck shellcheck -pyflakes 'ruff check --isolated --select F,B,UP,SIM,PERF,RUF --output-format concise --stdin-filename "" -' + - run: shellcheck --norc -a .github/scripts/*.sh diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index fd489e96..31842a5b 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -10,7 +10,6 @@ on: - "bun.lock" - "package.json" pull_request: - merge_group: workflow_dispatch: schedule: - cron: "23 21 * * 3" @@ -21,6 +20,10 @@ concurrency: permissions: {} +defaults: + run: + shell: bash + jobs: audit: runs-on: ubuntu-latest @@ -28,10 +31,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun audit @@ -42,10 +45,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - name: Enable bun security scanner @@ -60,10 +63,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun dedupe --check diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b68e02f6..60c41728 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,15 +22,15 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun install --frozen-lockfile - run: bun run build - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build path: | @@ -51,21 +51,21 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build path: packages - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun install --frozen-lockfile - run: bun run test:ci --coverage-reporter=text --coverage-reporter=lcov - name: Report coverage if: ${{ matrix.platform == 'ubuntu-latest' && github.repository_owner == 'maxmilton' }} - uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2 + uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0 with: oidc: true files: coverage/lcov.info @@ -96,17 +96,17 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build path: packages - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun install --frozen-lockfile @@ -116,7 +116,7 @@ jobs: if: ${{ matrix.node-version == 26 && matrix.platform == 'ubuntu-latest' }} - name: Report coverage if: ${{ matrix.platform == 'ubuntu-latest' && github.repository_owner == 'maxmilton' }} - uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2 + uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0 with: oidc: true files: coverage/lcov.info @@ -129,10 +129,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 permissions: - contents: read id-token: write steps: - - uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2 + - name: Report coverage complete + uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0 if: ${{ github.repository_owner == 'maxmilton' }} with: oidc: true @@ -145,14 +145,14 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build path: packages - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bun install --frozen-lockfile diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f3115c5b..0f66c5e9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -9,16 +9,23 @@ on: merge_group: workflow_dispatch: schedule: - - cron: "28 6 * * 4" + - cron: "25 14 * * 3" concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.head.label || github.run_id }} + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: {} jobs: analyze: + strategy: + fail-fast: false + matrix: + include: + - language: actions + - language: javascript-typescript + packs: githubsecuritylab/codeql-javascript-queries name: analyze (${{ matrix.language }}) runs-on: ubuntu-latest timeout-minutes: 10 @@ -27,25 +34,18 @@ jobs: contents: read packages: read security-events: write - strategy: - fail-fast: false - matrix: - include: - - language: actions - - language: javascript-typescript - # https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/main/configs/synthetics.yml - packs: githubsecuritylab/codeql-javascript-queries steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: none queries: security-and-quality + # https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/main/configs/synthetics.yml packs: ${{ matrix.packs }} # https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options#extending-codeql-coverage-with-threat-models config: | threat-models: local - - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml new file mode 100644 index 00000000..00721308 --- /dev/null +++ b/.github/workflows/osv-scanner.yml @@ -0,0 +1,58 @@ +name: osv-scanner + +on: + push: + branches: + - master + - next + pull_request: + workflow_dispatch: + schedule: + - cron: "25 14 * * 3" + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +permissions: {} + +jobs: + analyze: + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + actions: read + contents: read + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + # Runs the binary directly, bypassing the image's exit_code_redirect.sh + # (raw exit codes, no 128→0 rewrite). + # Gating: PRs → "Require code scanning results" ruleset (tool: osv-scanner); + # push → upload only (refreshes alerts + ruleset base); schedule/dispatch → fail on vulns. + - name: Scan + id: scan + env: + OSV_IMAGE: ghcr.io/google/osv-scanner-action:v2.7.0@sha256:d54770fe0b09493894e76a02aaed9f51a0513fa57c5186452a755d257b0068a6 + run: | + out="$RUNNER_TEMP/osv" + mkdir -p "$out" + rc=0 + docker run --rm -e GOTOOLCHAIN=auto \ + -v "$GITHUB_WORKSPACE:/github/workspace:ro" -w "/github/workspace" \ + -v "$out:/out" \ + --entrypoint /root/osv-scanner "$OSV_IMAGE" \ + --include-git-root \ + --x-flag-deprecated-packages \ + --format=sarif --output=/out/results.sarif -r . || rc=$? + echo "rc=$rc" >> "$GITHUB_OUTPUT" + [ "$rc" -le 1 ] || { echo "::error::osv-scanner exited $rc (127=error, 128=no packages, 129=OSV API failure, 130=invalid config; 125-127 may also be docker)"; exit "$rc"; } + - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + with: + sarif_file: ${{ runner.temp }}/osv/results.sarif + category: osv-scanner + - name: Fail on vulnerabilities + if: steps.scan.outputs.rc == '1' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') + run: exit 1 diff --git a/.github/workflows/semgrep-pro.yml b/.github/workflows/semgrep-pro.yml index 87d55982..9a0cd145 100644 --- a/.github/workflows/semgrep-pro.yml +++ b/.github/workflows/semgrep-pro.yml @@ -12,8 +12,8 @@ on: - cron: "27 14 * * 3" concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: {} @@ -23,20 +23,20 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 container: - image: semgrep/semgrep@sha256:acaac22ffc7b7cc5926de0751b223bce0b2491c33d18422fa72f632c78d81198 + image: semgrep/semgrep@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b permissions: actions: read contents: read security-events: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - run: semgrep ci --sarif-output=semgrep.sarif env: # zizmor: ignore[secrets-outside-env] SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 if: ${{ !cancelled() }} with: sarif_file: semgrep.sarif diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 488b8fce..06565b9d 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -12,8 +12,8 @@ on: - cron: "24 14 * * 3" concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: {} @@ -22,19 +22,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 container: - image: semgrep/semgrep@sha256:acaac22ffc7b7cc5926de0751b223bce0b2491c33d18422fa72f632c78d81198 + image: semgrep/semgrep@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b permissions: actions: read contents: read security-events: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - run: semgrep ci --sarif-output=semgrep.sarif env: SEMGREP_RULES: p/default p/owasp-top-ten p/cwe-top-25 p/gitleaks p/r2c-security-audit - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 if: ${{ !cancelled() }} with: sarif_file: semgrep.sarif diff --git a/.github/workflows/sherif.yml b/.github/workflows/sherif.yml index bb524a1b..64f2bcbe 100644 --- a/.github/workflows/sherif.yml +++ b/.github/workflows/sherif.yml @@ -22,10 +22,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: .bun-version - run: bunx sherif@latest diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml index f4ff7178..9b630ce0 100644 --- a/.github/workflows/typos.yml +++ b/.github/workflows/typos.yml @@ -6,7 +6,6 @@ on: - master - next pull_request: - merge_group: workflow_dispatch: concurrency: @@ -22,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: crate-ci/typos@53821664afd79bb88fcdd22fdc2f49d8d3f6cac9 # v1 + - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 4f78f9e4..eda69339 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -6,12 +6,11 @@ on: - master - next pull_request: - merge_group: workflow_dispatch: concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: {} @@ -24,7 +23,7 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 From c06a7ed6375427d1c553d557371cbfaac49af277 Mon Sep 17 00:00:00 2001 From: Max Milton Date: Fri, 16 Oct 2026 08:17:41 +1100 Subject: [PATCH 2/2] ci: Fix actionlint workflow --- .github/workflows/actionlint.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index b8b995df..21baad9c 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -73,4 +73,5 @@ jobs: run: | echo "::add-matcher::$RUNNER_TEMP/actionlint-matcher.json" actionlint -color -verbose -shellcheck shellcheck -pyflakes 'ruff check --isolated --select F,B,UP,SIM,PERF,RUF --output-format concise --stdin-filename "" -' - - run: shellcheck --norc -a .github/scripts/*.sh + # TODO: Uncomment once we have npm publishing automation script/s. + # - run: shellcheck --norc -a .github/scripts/*.sh