chore(release): prepare @hasna/contracts 0.10.4 #264
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| jobs: | |
| secret-scan: | |
| name: Secret scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - name: Install pinned gitleaks | |
| env: | |
| GITLEAKS_VERSION: "8.24.3" | |
| GITLEAKS_SHA256: "9991e0b2903da4c8f6122b5c3186448b927a5da4deef1fe45271c3793f4ee29c" | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/gitleaks.tar.gz" | |
| checksum_file="$RUNNER_TEMP/gitleaks.sha256" | |
| curl --fail --silent --show-error --location \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| --output "$archive" | |
| printf '%s %s\n' "$GITLEAKS_SHA256" "$archive" > "$checksum_file" | |
| sha256sum --check "$checksum_file" | |
| tar -xzf "$archive" -C "$RUNNER_TEMP" gitleaks | |
| - name: Scan repository with redacted output | |
| env: | |
| BASE_SHA: ${{ github.event.before || github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.after || github.event.pull_request.head.sha || github.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "$BASE_SHA" =~ ^0+$ ]]; then | |
| log_opts="$HEAD_SHA" | |
| else | |
| log_opts="$BASE_SHA..$HEAD_SHA" | |
| fi | |
| "$RUNNER_TEMP/gitleaks" detect \ | |
| --source . \ | |
| --log-opts "$log_opts" \ | |
| --redact \ | |
| --no-banner | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run typecheck | |
| - run: bun test | |
| # The loopback security suites and both publish gates are fail-closed. | |
| # Pinning every seam to empty here means CI can never inherit an | |
| # environment that downgrades them: a runner that loses bind capability | |
| # or registry access breaks the build instead of going green with the | |
| # credential-boundary or dependency-resolution coverage silently | |
| # missing. | |
| - run: bun run verify:release | |
| env: | |
| CONTRACTS_ALLOW_LOOPBACK_SKIP: "" | |
| CONTRACTS_LOOPBACK_PROBE_DENY: "" | |
| CONTRACTS_ALLOW_PACK_INSTALL_FALLBACK: "" | |
| CONTRACTS_PACK_INSTALL_DENY: "" |