Skip to content

Commit e785e14

Browse files
KTrain5169KTrain5169
committed
add zizmor config + harden CI pipelines
1 parent 56567e0 commit e785e14

10 files changed

Lines changed: 107 additions & 38 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
version: 2
22
updates:
33
- package-ecosystem: "npm"
4+
cooldown:
5+
default-days: 1
6+
exclude: ['neuro-game-sdk']
47
directory: "/"
58
schedule:
69
interval: "weekly"
@@ -32,6 +35,8 @@ updates:
3235
applies-to: security-updates
3336
dependency-type: development
3437
- package-ecosystem: "github-actions"
38+
cooldown:
39+
default-days: 2
3540
directory: /
3641
schedule:
3742
interval: monthly

‎.github/workflows/api-flow.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,27 +18,30 @@ on:
1818
description: Whether or not this is a prerelease
1919
default: false
2020

21+
permissions: {}
22+
2123
jobs:
22-
publiah:
24+
publish:
2325
runs-on: ubuntu-latest
2426
environment:
2527
name: npm registry (API types)
2628
url: https://npmx.dev/package/@vsc-neuropilot/api-types
29+
permissions:
30+
id-token: write
31+
contents: read
2732
steps:
2833
- name: Checkout
2934
uses: actions/checkout@v6
35+
with:
36+
persist-credentials: false
3037

3138
- name: Setup pnpm
3239
uses: pnpm/action-setup@v6
33-
with:
34-
version: 10.33.0
3540

3641
- name: Setup Node.js
3742
uses: actions/setup-node@v6
3843
with:
39-
node-version: 24.15.0
40-
cache: "pnpm"
41-
cache-dependency-path: "./pnpm-lock.yaml"
44+
node-version-file: ./package.json
4245
registry-url: https://registry.npmjs.org
4346

4447
- name: Install deps

‎.github/workflows/builds.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ on:
2626
default: "0"
2727
options: ["0", "1"]
2828

29+
permissions: {}
30+
2931
jobs:
3032
build:
3133
name: Build extension
@@ -36,16 +38,15 @@ jobs:
3638
with:
3739
ref: ${{ github.sha }}
3840
submodules: true
41+
persist-credentials: false
3942

4043
- name: Setup pnpm
4144
uses: pnpm/action-setup@v6
42-
with:
43-
version: 10.14.0
4445

4546
- name: Setup Node.js
4647
uses: actions/setup-node@v6
4748
with:
48-
node-version: 22.x.x
49+
node-version-file: ./package.json
4950
cache: 'pnpm'
5051
cache-dependency-path: './pnpm-lock.yaml'
5152

‎.github/workflows/changelog.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
uses: actions/checkout@v6
2828
with:
2929
fetch-depth: 1
30+
persist-credentials: false
3031
- name: Check that changelog is updated
3132
env:
3233
PR_NUMBER: ${{ github.event.pull_request.number }}

‎.github/workflows/linter.yml‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,24 @@ on:
44
push:
55
pull_request:
66

7+
permissions: {}
8+
79
jobs:
810
type-check:
911
name: Type checker
1012
runs-on: ubuntu-latest
1113
steps:
12-
- uses: actions/checkout@v6
14+
- uses: actions/checkout@v8
15+
with:
16+
persist-credentials: false
1317

1418
- name: Setup pnpm
1519
uses: pnpm/action-setup@v6
16-
with:
17-
version: 10.33.0
1820

1921
- name: Setup Node.js
2022
uses: actions/setup-node@v6
2123
with:
22-
node-version: 22.14.0
24+
node-version-file: ./package.json
2325
cache: 'pnpm'
2426
cache-dependency-path: './pnpm-lock.yaml'
2527

@@ -28,21 +30,22 @@ jobs:
2830

2931
- name: type check
3032
run: pnpm types
33+
3134
lint-check:
3235
name: Lint checker
3336
runs-on: ubuntu-latest
3437
steps:
35-
- uses: actions/checkout@v6
38+
- uses: actions/checkout@v8
39+
with:
40+
persist-credentials: false
3641

3742
- name: Setup pnpm
3843
uses: pnpm/action-setup@v6
39-
with:
40-
version: 10.33.0
4144

4245
- name: Setup Node.js
4346
uses: actions/setup-node@v6
4447
with:
45-
node-version: 22.14.0
48+
node-version-file: ./package.json
4649
cache: 'pnpm'
4750
cache-dependency-path: './pnpm-lock.yaml'
4851

@@ -51,3 +54,17 @@ jobs:
5154

5255
- name: lint check
5356
run: pnpm eslint src/
57+
58+
zizmor:
59+
name: Zizmor checks
60+
runs-on: ubuntu-latest
61+
permissions:
62+
security-events: write
63+
contents: read
64+
actions: read
65+
steps:
66+
- uses: actions/checkout@v8
67+
with:
68+
persist-credentials: false
69+
70+
- uses: zizmorcore/zizmor-action@v0.5.6

‎.github/workflows/publish.yml‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Publish Extension
22

3-
permissions:
4-
contents: write
3+
permissions: {}
54

65
on:
76
workflow_dispatch:
@@ -21,24 +20,23 @@ jobs:
2120
build:
2221
name: Build VSIX file
2322
runs-on: ubuntu-latest
23+
permissions:
24+
contents: write
2425
outputs:
2526
VERSION: ${{ steps.build.outputs.VERSION }}
2627
steps:
2728
- uses: actions/checkout@v6
2829
with:
2930
submodules: true
31+
persist-credentials: true
3032

3133
- name: Setup pnpm
3234
uses: pnpm/action-setup@v6
33-
with:
34-
version: 10.14.0
3535

3636
- name: Setup Node.js
3737
uses: actions/setup-node@v6
3838
with:
39-
node-version: 'latest'
40-
cache: 'pnpm'
41-
cache-dependency-path: './pnpm-lock.yaml'
39+
node-version-file: ./package.json
4240

4341
- name: Install deps
4442
run: pnpm install --frozen-lockfile
@@ -86,23 +84,26 @@ jobs:
8684
steps:
8785
- name: Checkout repo # why
8886
uses: actions/checkout@v6
87+
with:
88+
persist-credentials: false
8989

9090
- name: Download VSIX
9191
id: vsce-vsix-down
9292
uses: actions/download-artifact@v8
9393

9494
- name: Setup pnpm
9595
uses: pnpm/action-setup@v6
96-
with:
97-
version: 10.14.0
9896

9997
- name: Setup Node.js
10098
uses: actions/setup-node@v6
10199
with:
102-
node-version: 'latest'
100+
node-version-file: ./package.json
103101

104102
- name: Publish VSIX to VS Marketplace
105-
run: ls && pnpm dlx @vscode/vsce publish -p ${{ secrets.MARKETPLACE_TOKEN }} --packagePath "${{ steps.vsce-vsix-down.outputs.download-path }}/neuropilot-base-${{ needs.build.outputs.VERSION }}.vsix"
103+
env:
104+
VERSION: ${{ needs.build.outputs.VERSION }}
105+
ARTIFACT_PATH: ${{ steps.vsce-vsix-down.outputs.download-path }}
106+
run: ls && pnpm dlx @vscode/vsce publish -p ${{ secrets.MARKETPLACE_TOKEN }} --packagePath "${ARTIFACT_PATH}/neuropilot-base-${VERSION}.vsix"
106107

107108
ovsx-publish:
108109
name: Publish to Open VSX
@@ -114,20 +115,23 @@ jobs:
114115
steps:
115116
- name: Checkout repo # why
116117
uses: actions/checkout@v6
118+
with:
119+
persist-credentials: false
117120

118121
- name: Download VSIX
119122
id: ovsx-vsix-down
120123
uses: actions/download-artifact@v8
121124

122125
- name: Setup pnpm
123126
uses: pnpm/action-setup@v6
124-
with:
125-
version: 10.14.0
126127

127128
- name: Setup Node.js
128129
uses: actions/setup-node@v6
129130
with:
130-
node-version: 'latest'
131+
node-version-file: ./package.json
131132

132133
- name: Publish VSIX to Open VSX
133-
run: ls && pnpm dlx ovsx publish -p ${{ secrets.REGISTRY_TOKEN }} --packagePath "${{ steps.ovsx-vsix-down.outputs.download-path }}/neuropilot-base-${{ needs.build.outputs.VERSION }}.vsix"
134+
env:
135+
VERSION: ${{ needs.build.outputs.VERSION }}
136+
ARTIFACT_PATH: ${{ steps.ovsx-vsix-down.outputs.download-path }}
137+
run: ls && pnpm dlx ovsx publish -p ${{ secrets.REGISTRY_TOKEN }} --packagePath "${ARTIFACT_PATH}/neuropilot-base-${VERSION}.vsix"

‎.github/workflows/synchronise-dev.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ jobs:
2020
with:
2121
ref: 'master'
2222
fetch-depth: 0
23+
persist-credentials: true
2324

2425
- name: Merge
2526
run: |

‎.github/workflows/tests.yml‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
pull_request:
1010
workflow_dispatch: # in case we need to regenerate test coverage
1111

12+
permissions: {}
13+
1214
jobs:
1315
desktop-tests:
1416
name: Desktop (Electron) tests
@@ -26,27 +28,33 @@ jobs:
2628
steps:
2729
- name: Checkout
2830
uses: actions/checkout@v6
31+
with:
32+
persist-credentials: false
33+
2934
- name: Cache VS Code test downloads
3035
uses: actions/cache@v5
3136
with:
3237
key: neuropilot-tests-vscode-${{ github.repository }}-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
3338
restore-keys: |
3439
neuropilot-tests-vscode-${{ github.repository }}-${{ runner.os }}-
3540
path: .vscode-test/
41+
3642
- name: Setup pnpm
3743
uses: pnpm/action-setup@v6
38-
with:
39-
version: 10.14.0
44+
4045
- name: Install Node.js
4146
uses: actions/setup-node@v6
4247
with:
43-
node-version: 22.x
48+
node-version-file: ./package.json
4449
cache: 'pnpm'
4550
cache-dependency-path: './pnpm-lock.yaml'
51+
4652
- run: pnpm install --frozen-lockfile
53+
4754
- name: Run desktop tests (Linux)
4855
run: xvfb-run -a pnpm run test:desktop
4956
if: runner.os == 'Linux'
57+
5058
- name: Run desktop tests (macOS/Windows)
5159
run: pnpm run test:desktop
5260
if: runner.os != 'Linux'
@@ -61,30 +69,38 @@ jobs:
6169
steps:
6270
- name: Checkout
6371
uses: actions/checkout@v6
72+
with:
73+
persist-credentials: false
74+
6475
- name: Cache VS Code web test downloads
6576
uses: actions/cache@v5
6677
with:
6778
key: neuropilot-tests-vscode-web-v2-${{ github.repository }}-${{ runner.os }}
6879
path: .vscode-test-web/
80+
6981
- name: Cache Playwright browsers
7082
uses: actions/cache@v5
7183
with:
7284
key: neuropilot-playwright-v2-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
7385
path: ~/.cache/ms-playwright
86+
7487
- name: Setup pnpm
7588
uses: pnpm/action-setup@v6
76-
with:
77-
version: 10.14.0
89+
7890
- name: Install Node.js
7991
uses: actions/setup-node@v6
8092
with:
81-
node-version: 22.x
93+
node-version-file: ./package.json
8294
cache: 'pnpm'
8395
cache-dependency-path: './pnpm-lock.yaml'
96+
8497
- run: pnpm install --frozen-lockfile
98+
8599
- name: Ensure Playwright browsers are installed (Chromium, Firefox, WebKit)
86100
run: pnpm exec playwright install --with-deps
101+
87102
- name: Build web extension and test bundle (browser)
88103
run: pnpm run build:web && pnpm run test:web:browser:esbuild
104+
89105
- name: Run web tests (headless)
90106
run: pnpm exec vscode-test-web --headless --browser=${{ matrix.browser }} --extensionDevelopmentPath=. --extensionTestsPath=out/web/test/browser.js test-playground

‎package.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@
1212
"engines": {
1313
"vscode": "^1.95.0"
1414
},
15+
"devEngines": {
16+
"runtime": {
17+
"name": "node",
18+
"onFail": "error",
19+
"version": "24.16.0"
20+
}
21+
},
22+
"packageManager": "pnpm@11.5.0",
1523
"categories": [
1624
"AI",
1725
"Programming Languages",

‎zizmor.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
rules:
2+
use-trusted-publishing:
3+
ignore:
4+
- publish.yml
5+
template-injection:
6+
ignore:
7+
- publish.yml
8+
dependabot-config:
9+
config:
10+
days: 1
11+
dangerous-triggers:
12+
ignore:
13+
- autoclose.yml

0 commit comments

Comments
 (0)