Skip to content
Closed
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 33 additions & 33 deletions .github/workflows/unit-test.yml
Original file line number Diff line number Diff line change
@@ -1,35 +1,35 @@
# name: Unit Test
name: Unit Test

# on:
# pull_request:
# types: [assigned, opened, synchronize, reopened]
on:
pull_request:
types: [assigned, opened, synchronize, reopened]

# jobs:
# unit-test:
# permissions: write-all
# runs-on: ubuntu-latest
# steps:
# - uses: actions/checkout@v1
# - name: Setup GitHub Action
# uses: actions/setup-node@v1
# with:
# node-version: 14.18
# - name: Install dependencies
# run: npm install
# - name: Test
# run: npm run unit_test:ci
# env:
# FYLE_CLIENT_ID: "lolo"
# CALLBACK_URI: "http://lolo.fyle.tech/callback"
# API_URL: "http://lolo.fyle.tech"
# FYLE_APP_URL: "http://lolo.fyle.tech"
# SI_API_URL: "http://lolo.fyle.tech"
# SAGE300_API_URL: "http://lolo.fyle.tech"
# - name: Unit Test Coverage
# uses: fylein/comment-test-coverage@master
# with:
# token: ${{ secrets.GITHUB_TOKEN }}
# path: coverage/coverage-summary.json
# title: Unit Test Coverage
# - name: Upload coverage to Codecov
# uses: codecov/codecov-action@v3
jobs:
unit-test:
permissions: write-all
runs-on: ubuntu-latest
Comment on lines +7 to +10
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

Yo, unit-test.yml, permissions way too broad,
Write-all's a stretch, it's a security fraud.
Let's slim it down, keep it precise,
Lock it down tight, make it nice.

-    permissions: write-all
+    permissions:
+      contents: read
+      checks: write
🔗 Analysis chain

Yo, hold up! We're givin' out permissions like they're free CDs!

The job setup's lookin' good, no lie,
But them permissions, they're set sky-high!
"write-all" for unit tests? That's overkill, my friend,
Let's lock it down, make security transcend!

Check if we really need all them write perms, ya dig?
Maybe we can slim it down, make it not so big.

If it comes back clean, let's tighten up our act:

-    permissions: write-all
+    permissions:
+      contents: read
+      checks: write  # Needed for test results

Now that's a flow that's secure and slick!


Yo, check it, we gotta keep it tight,
Permissions on point, make sure it's right.
Unit tests don’t need all the write,
Let’s scope it down, keep the flow in sight.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Let's see what other workflows are usin' for permissions
rg -i 'permissions:' .github/workflows

Length of output: 5891


Script:

#!/bin/bash
# Extracting permissions from all GitHub workflow files
rg -i '^permissions:' .github/workflows --context 2

Length of output: 520

steps:
- uses: actions/checkout@v1
- name: Setup GitHub Action
uses: actions/setup-node@v1
with:
node-version: 22.2.0
Comment on lines +13 to +16
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Yo, we gotta upgrade this beat, make it elite!

Node version's fresh, but the action's old news,
Time to level up, can't afford to lose.
Let's bump it up, make it crisp and clean,
v3's the latest, know what I mean?

Here's the remix:

-    - uses: actions/setup-node@v1
+    - uses: actions/setup-node@v3
     with:
       node-version: 22.2.0

Now we're droppin' beats with the latest heat!

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Setup GitHub Action
uses: actions/setup-node@v1
with:
node-version: 22.2.0
- name: Setup GitHub Action
uses: actions/setup-node@v3
with:
node-version: 22.2.0
🧰 Tools
🪛 actionlint

14-14: the runner of "actions/setup-node@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

- name: Install dependencies
run: npm install
- name: Test
run: npm run unit_test:ci
env:
FYLE_CLIENT_ID: "lolo"
CALLBACK_URI: "http://lolo.fyle.tech/callback"
API_URL: "http://lolo.fyle.tech"
FYLE_APP_URL: "http://lolo.fyle.tech"
SI_API_URL: "http://lolo.fyle.tech"
SAGE300_API_URL: "http://lolo.fyle.tech"
- name: Unit Test Coverage
uses: fylein/comment-test-coverage@master
with:
token: ${{ secrets.GITHUB_TOKEN }}
path: coverage/coverage-summary.json
title: Unit Test Coverage
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v3
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"build": "npm run setup:env && npm run setup:branding && ng build && npm run sentry:sourcemaps",
"watch": "ng build --watch --configuration development",
"test": "ng test",
"unit_test:ci": "npm run setup:env && ng test --watch=false --browsers=ChromeHeadlessCustom",
"unit_test:ci": "npm run setup:env && npm run setup:branding && ng test --watch=false --browsers=ChromeHeadlessCustom",
"setup:env": "node scripts/setup_env.js",
"setup:branding": "node scripts/setup_branding_config.js",
"lint": "ng lint",
Expand Down
Loading