From cd0454f86c0d1905f751574ba0d2cef3c3121a3b Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 15:51:12 +0000 Subject: [PATCH 01/11] Created linting across actions and project with composite npm install --- .github/actions/npm-setup/action.yml | 25 +++++++++++++ .github/workflows/reusable-lint.yml | 34 ++++++++++++++++++ .github/workflows/reusable-workflow-lint.yml | 37 ++++++++++++++++++++ 3 files changed, 96 insertions(+) create mode 100644 .github/actions/npm-setup/action.yml create mode 100644 .github/workflows/reusable-lint.yml create mode 100644 .github/workflows/reusable-workflow-lint.yml diff --git a/.github/actions/npm-setup/action.yml b/.github/actions/npm-setup/action.yml new file mode 100644 index 00000000..56e18ab8 --- /dev/null +++ b/.github/actions/npm-setup/action.yml @@ -0,0 +1,25 @@ +name: "npm setup" +description: "Sets up NodeJS with npm caching and dependencies installed" + +inputs: + node-version: + description: "NodeJS version" + required: false + default: "24" + install-command: + description: "Dependency installation command" + required: false + default: "npm clean-install" + +runs: + using: "composite" + steps: + - name: "Install node ${{ inputs.node-version }}" + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: ${{ inputs.node-version }} + cache: "npm" + + - name: "Install dependencies" + shell: bash + run: ${{ inputs.install-command }} diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml new file mode 100644 index 00000000..12e2ed6e --- /dev/null +++ b/.github/workflows/reusable-lint.yml @@ -0,0 +1,34 @@ +name: "Lint" +on: + workflow_call: + +permissions: + contents: read + +jobs: + lint: + runs-on: ubuntu-latest + steps: + - name: "Checkout pulp-ui (${{ github.ref }})" + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: "NPM Setup" + uses: $/.github/actions/npm-setup + with: + install-command: "npm install" + + - name: "Fail if npm install changed package-lock.json" + run: git diff --exit-code package-lock.json + + - name: "Install python 3.13" + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + with: + python-version: "3.13" + + - name: "Install lint dependencies" + run: npm run lint-setup + + - name: Run lint + run: npm run lint diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml new file mode 100644 index 00000000..54a0cc0f --- /dev/null +++ b/.github/workflows/reusable-workflow-lint.yml @@ -0,0 +1,37 @@ +name: "Workflow lint" +on: + workflow_call: + +permissions: + contents: read + +jobs: + workflow-lint: + runs-on: ubuntu-latest + steps: + - name: "Checkout pulp-ui (${{ github.ref }})" + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: "Install uv" + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + + - name: "Run zizmor" + env: + GH_TOKEN: ${{ github.token }} + run: uvx zizmor@1.31.1 --format=sarif --output=zizmor-results.sarif . + + - name: "Fail on findings" + run: | + count=$(jq '[.runs[].results[]] | length' zizmor-results.sarif) + echo "zizmor found $count issue(s)" + [ "$count" -eq 0 ] + + - name: "Upload SARIF artifact" + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: zizmor-results + path: zizmor-results.sarif + retention-days: 1 From 439aa5b7d75587b550a26cbd2510d53ea12bfff4 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 19:45:19 +0000 Subject: [PATCH 02/11] Added build and test workflows with secret scanning using gitleaks --- .github/workflows/reusable-build.yml | 21 ++++++++++++++++++++ .github/workflows/reusable-lint.yml | 10 +++++----- .github/workflows/reusable-secrets-scan.yml | 21 ++++++++++++++++++++ .github/workflows/reusable-test.yml | 21 ++++++++++++++++++++ .github/workflows/reusable-workflow-lint.yml | 12 +++++------ 5 files changed, 74 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/reusable-build.yml create mode 100644 .github/workflows/reusable-secrets-scan.yml create mode 100644 .github/workflows/reusable-test.yml diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml new file mode 100644 index 00000000..7ed21022 --- /dev/null +++ b/.github/workflows/reusable-build.yml @@ -0,0 +1,21 @@ +name: Build +on: + workflow_call: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Build UI + run: npm run build diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml index 12e2ed6e..a336dafb 100644 --- a/.github/workflows/reusable-lint.yml +++ b/.github/workflows/reusable-lint.yml @@ -1,4 +1,4 @@ -name: "Lint" +name: Lint on: workflow_call: @@ -9,12 +9,12 @@ jobs: lint: runs-on: ubuntu-latest steps: - - name: "Checkout pulp-ui (${{ github.ref }})" + - name: Checkout pulp-ui (${{ github.ref }}) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: "NPM Setup" + - name: npm Setup uses: $/.github/actions/npm-setup with: install-command: "npm install" @@ -22,12 +22,12 @@ jobs: - name: "Fail if npm install changed package-lock.json" run: git diff --exit-code package-lock.json - - name: "Install python 3.13" + - name: Install python 3.13 uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - - name: "Install lint dependencies" + - name: Install lint dependencies run: npm run lint-setup - name: Run lint diff --git a/.github/workflows/reusable-secrets-scan.yml b/.github/workflows/reusable-secrets-scan.yml new file mode 100644 index 00000000..539e913f --- /dev/null +++ b/.github/workflows/reusable-secrets-scan.yml @@ -0,0 +1,21 @@ +name: Secret Scanning +on: + workflow_call: + +permissions: + contents: read + +jobs: + secret-scanning: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Run Gitleaks + uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 + env: + GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/reusable-test.yml b/.github/workflows/reusable-test.yml new file mode 100644 index 00000000..82efdfff --- /dev/null +++ b/.github/workflows/reusable-test.yml @@ -0,0 +1,21 @@ +name: Test +on: + workflow_call: + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Run tests + run: npm run test diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index 54a0cc0f..318e4e8c 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -1,4 +1,4 @@ -name: "Workflow lint" +name: Workflow lint on: workflow_call: @@ -9,26 +9,26 @@ jobs: workflow-lint: runs-on: ubuntu-latest steps: - - name: "Checkout pulp-ui (${{ github.ref }})" + - name: Checkout pulp-ui (${{ github.ref }}) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: "Install uv" + - name: Install uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - - name: "Run zizmor" + - name: Run zizmor env: GH_TOKEN: ${{ github.token }} run: uvx zizmor@1.31.1 --format=sarif --output=zizmor-results.sarif . - - name: "Fail on findings" + - name: Fail on findings run: | count=$(jq '[.runs[].results[]] | length' zizmor-results.sarif) echo "zizmor found $count issue(s)" [ "$count" -eq 0 ] - - name: "Upload SARIF artifact" + - name: Upload SARIF artifact if: always() uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: From d14c1429dd401d910fd09887748e05c1e26c8dad Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 20:37:02 +0000 Subject: [PATCH 03/11] Added further workflows with main pull request workflow --- .github/workflows/pull-request.yml | 56 +++++++++++++++++++ .../workflows/reusable-dependency-review.yml | 20 +++++++ .github/workflows/reusable-sast.yml | 43 ++++++++++++++ .github/workflows/reusable-sca.yml | 32 +++++++++++ 4 files changed, 151 insertions(+) create mode 100644 .github/workflows/pull-request.yml create mode 100644 .github/workflows/reusable-dependency-review.yml create mode 100644 .github/workflows/reusable-sast.yml create mode 100644 .github/workflows/reusable-sca.yml diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml new file mode 100644 index 00000000..a32a857d --- /dev/null +++ b/.github/workflows/pull-request.yml @@ -0,0 +1,56 @@ +name: Pull Request +on: + pull_request: + branches: ["main"] + +concurrency: + group: pr-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + actions: read + +jobs: + workflow-lint: + uses: $/.github/workflows/reusable-workflow-lint.yml + + linting: + uses: $/.github/workflows/reusable-lint.yml + + dependency-review: + uses: $/.github/workflows/reusable-dependency-review.yml + + secret-scanning: + uses: $/.github/workflows/reusable-secrets-scan.yml + + software-composition-analysis: + uses: $/.github/workflows/reusable-sca.yml + + sast-quality: + uses: $/.github/workflows/reusable-sast.yml + + build: + uses: $/.github/workflows/reusable-build.yml + + test: + uses: $/.github/workflows/reusable-test.yml + + merge-commits: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + fetch-depth: 128 + ref: ${{ github.event.pull_request.head.sha }} + + - name: Fail on merge commits + run: | + # fail on merge commits in the PR + # since squash&merge doesn't create merge commits, + # and the last non-squash merges were in Jul 2019, + # we can just look for any merge commits since 2020 + count=`git log --min-parents=2 --since 2020-01-01 | tee /dev/stderr | wc -l` + [ "$count" = 0 ] diff --git a/.github/workflows/reusable-dependency-review.yml b/.github/workflows/reusable-dependency-review.yml new file mode 100644 index 00000000..45794fcf --- /dev/null +++ b/.github/workflows/reusable-dependency-review.yml @@ -0,0 +1,20 @@ +name: Dependency Review +on: + workflow_call: + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Dependency Review + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: high diff --git a/.github/workflows/reusable-sast.yml b/.github/workflows/reusable-sast.yml new file mode 100644 index 00000000..077dc7d1 --- /dev/null +++ b/.github/workflows/reusable-sast.yml @@ -0,0 +1,43 @@ +name: SAST quality +on: + workflow_call: + +permissions: + contents: read + +jobs: + codeql: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Initialize CodeQL + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + with: + languages: javascript-typescript + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + with: + upload: never + output: sarif-results + + - name: Fail on findings + run: | + count=$(jq -s '[.[] | .runs[].results[]] | length' sarif-results/*.sarif) + echo "CodeQL found $count issue(s)" + [ "$count" -eq 0 ] + + - name: Upload SARIF artifact + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: codeql-results + path: sarif-results + retention-days: 1 diff --git a/.github/workflows/reusable-sca.yml b/.github/workflows/reusable-sca.yml new file mode 100644 index 00000000..3cc22f92 --- /dev/null +++ b/.github/workflows/reusable-sca.yml @@ -0,0 +1,32 @@ +name: SCA +on: + workflow_call: + +permissions: + contents: read + actions: read + +jobs: + osv-scanner: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run OSV-Scanner + uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + with: + scan-args: |- + --lockfile=package-lock.json + --format=sarif + --output=osv-results.sarif + + - name: Upload SARIF artifact + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: osv-results + path: osv-results.sarif + retention-days: 1 From 771e5652b695a76606b0c9129279549f20ca7528 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 20:49:31 +0000 Subject: [PATCH 04/11] Added SARIF upload with actions.lock for dependencies --- .github/actions/npm-setup/action.yml | 2 +- .github/workflows/actions.lock | 112 ++++++++++++++++++ .github/workflows/codeql-upload.yml | 36 ++++++ .github/workflows/cron-release.yml | 6 +- .github/workflows/cypress.yml | 10 +- .github/workflows/pr-checks.yml | 76 ------------ .github/workflows/pull-request.yml | 2 +- .github/workflows/reusable-build.yml | 2 +- .../workflows/reusable-dependency-review.yml | 4 +- .github/workflows/reusable-lint.yml | 4 +- .github/workflows/reusable-sast.yml | 8 +- .github/workflows/reusable-sca.yml | 6 +- .github/workflows/reusable-secrets-scan.yml | 4 +- .github/workflows/reusable-test.yml | 2 +- .github/workflows/reusable-workflow-lint.yml | 6 +- .github/workflows/stale.yml | 2 +- 16 files changed, 177 insertions(+), 105 deletions(-) create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/codeql-upload.yml delete mode 100644 .github/workflows/pr-checks.yml diff --git a/.github/actions/npm-setup/action.yml b/.github/actions/npm-setup/action.yml index 56e18ab8..84c8ce70 100644 --- a/.github/actions/npm-setup/action.yml +++ b/.github/actions/npm-setup/action.yml @@ -15,7 +15,7 @@ runs: using: "composite" steps: - name: "Install node ${{ inputs.node-version }}" - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + uses: actions/setup-node@v7.1.0 with: node-version: ${{ inputs.node-version }} cache: "npm" diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..ef27c9c9 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,112 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/codeql-upload.yml': + - 'actions/download-artifact@v8.0.2' + - 'github/codeql-action@v4.39.1' + '.github/workflows/cron-release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.1.0' + '.github/workflows/cypress.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + '.github/workflows/pull-request.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/reusable-build.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + '.github/workflows/reusable-dependency-review.yml': + - 'actions/checkout@v7.0.1' + - 'actions/dependency-review-action@v5.0.0' + '.github/workflows/reusable-lint.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.1.0' + '.github/workflows/reusable-sast.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + - 'github/codeql-action@v4.39.1' + '.github/workflows/reusable-sca.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.2' + - 'google/osv-scanner-action@v2.7.0' + '.github/workflows/reusable-secrets-scan.yml': + - 'actions/checkout@v7.0.1' + - 'gitleaks/gitleaks-action@v3.0.0' + '.github/workflows/reusable-test.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + '.github/workflows/reusable-workflow-lint.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.2' + - 'astral-sh/setup-uv@v10.3.3' + '.github/workflows/stale.yml': + - 'actions/stale@v11.0.0' +dependencies: + 'actions/cache@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/dependency-review-action@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294' + owner_id: 44036562 + repo_id: 476372928 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-node@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1' + owner_id: 44036562 + repo_id: 189476904 + 'actions/setup-python@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0' + owner_id: 44036562 + repo_id: 192625525 + 'actions/stale@v11.0.0': + ref: 'v11.0.0' + commit: 'sha1-4391f3da665fdf50b6810c1a66712fb9ba21aa93' + owner_id: 44036562 + repo_id: 200437066 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v10.3.3': + ref: 'v10.3.3' + commit: 'sha1-68559e99cc807c1eb7e9238fd43a15bba460eec2' + owner_id: 115962839 + repo_id: 846733598 + 'github/codeql-action@v4.39.1': + ref: 'v4.39.1' + commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' + owner_id: 9919 + repo_id: 259445878 + 'gitleaks/gitleaks-action@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e' + owner_id: 90395851 + repo_id: 242854909 + 'google/osv-scanner-action@v2.7.0': + ref: 'v2.7.0' + commit: 'sha1-b1d267aea5211fa648d9d442fa64b90dbdcbdd36' + owner_id: 1342004 + repo_id: 736073144 diff --git a/.github/workflows/codeql-upload.yml b/.github/workflows/codeql-upload.yml new file mode 100644 index 00000000..9234b66a --- /dev/null +++ b/.github/workflows/codeql-upload.yml @@ -0,0 +1,36 @@ +name: Upload SARIF osv-results +on: + workflow_run: + workflows: ["Pull Request"] + types: [completed] + +permissions: + contents: read + actions: read + security-events: write + +jobs: + upload-sarif: + if: ${{ !github.event.workflow_run.head_repository.fork }} + runs-on: ubuntu-latest + steps: + - name: Download CodeQL SARIF + uses: actions/download-artifact@v8.0.2 + with: + name: codeql-results + path: ./sarif-input + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + + - name: Download zizmor SARIF + uses: actions/download-artifact@v8.0.2 + with: + name: zizmor-results + path: ./sarif-input + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + + - name: Upload all SARIF results + uses: github/codeql-action/upload-sarif@v4.39.1 + with: + sarif_file: ./sarif-input diff --git a/.github/workflows/cron-release.yml b/.github/workflows/cron-release.yml index c6039009..7f4c24d0 100644 --- a/.github/workflows/cron-release.yml +++ b/.github/workflows/cron-release.yml @@ -14,7 +14,7 @@ jobs: contents: write steps: - name: 'Checkout pulp-ui (main)' - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: ref: 'main' fetch-depth: 128 @@ -30,14 +30,14 @@ jobs: - name: 'Install node 24' if: ${{ env.SKIP == 'no' }} - uses: actions/setup-node@v7 + uses: actions/setup-node@v7.1.0 with: node-version: '24' cache: 'npm' - name: 'Install python 3.13' if: ${{ env.SKIP == 'no' }} - uses: actions/setup-python@v7 + uses: actions/setup-python@v7.1.0 with: python-version: '3.13' diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml index 56563ca1..e10b6c73 100644 --- a/.github/workflows/cypress.yml +++ b/.github/workflows/cypress.yml @@ -22,7 +22,7 @@ jobs: steps: - name: 'Checkout pulp-ui (${{ github.ref }})' - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: 'backend setup' run: | @@ -42,17 +42,17 @@ jobs: docker.io/pulp/pulp - name: 'Install node 24' - uses: actions/setup-node@v7 + uses: actions/setup-node@v7.1.0 with: node-version: '24' - name: 'Install python 3.13' - uses: actions/setup-python@v7 + uses: actions/setup-python@v7.1.0 with: python-version: '3.13' - name: 'Cache ~/.npm & ~/.cache/Cypress' - uses: actions/cache@v6 + uses: actions/cache@v6.1.0 with: path: | ~/.npm @@ -126,7 +126,7 @@ jobs: run: | npm run cypress:chrome - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 if: failure() with: name: screenshots_and_videos diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml deleted file mode 100644 index af64769d..00000000 --- a/.github/workflows/pr-checks.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: 'PR checks' - -on: - pull_request: - branches: ['main'] - -jobs: - docs: - # The workflow tag and the pulpdocs_ref must match. - uses: 'pulp/pulp-docs/.github/workflows/docs-ci.yml@main' - with: - pulpdocs_ref: 'main' - - pr-checks: - runs-on: ubuntu-latest - steps: - - name: 'Checkout pulp-ui (${{ github.ref }})' - uses: actions/checkout@v7 - - - name: 'Install node 24' - uses: actions/setup-node@v7 - with: - node-version: '24' - cache: 'npm' - - - name: 'Install python 3.13' - uses: actions/setup-python@v7 - with: - python-version: '3.13' - - - name: 'Checks' - run: | - # fail if npm install had to change package-lock.json - npm install - git diff --exit-code package-lock.json - - # dependencies - npm run lint-setup - - # run linters - npm run lint - - # uses `this` but not `class` - sudo apt install -y ripgrep - rg '\bclass\b' src/ | cut -d: -f1 | sort -u > src.class - rg '\bthis[\.,)\]}]\b' src/ | cut -d: -f1 | sort -u > src.this - if [ `comm -13 src.class src.this | wc -l` -ne 0 ]; then - echo - echo "Files using this but not class:" - echo - comm -13 src.class src.this - echo - rg '\bthis[\.,)\]}]\b' `comm -13 src.class src.this` - echo - exit 1 - fi - - merge-commits: - runs-on: ubuntu-latest - steps: - # need to checkout out head, the merge commit won't have any merges in history - # also need more than 1 commit, assuming no PR will have more than 128 - - name: 'Checkout pulp-ui HEAD' - uses: actions/checkout@v7 - with: - fetch-depth: 128 - ref: ${{ github.event.pull_request.head.sha }} - - - name: 'Ensure no merge commits' - run: | - # fail on merge commits in the PR - # since squash&merge doesn't create merge commits, - # and the last non-squash merges were in Jul 2019, - # we can just look for any merge commits since 2020 - count=`git log --min-parents=2 --since 2020-01-01 | tee /dev/stderr | wc -l` - [ "$count" = 0 ] diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index a32a857d..31a62df0 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false fetch-depth: 128 diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml index 7ed21022..e8a43c0b 100644 --- a/.github/workflows/reusable-build.yml +++ b/.github/workflows/reusable-build.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-dependency-review.yml b/.github/workflows/reusable-dependency-review.yml index 45794fcf..c3e58c24 100644 --- a/.github/workflows/reusable-dependency-review.yml +++ b/.github/workflows/reusable-dependency-review.yml @@ -10,11 +10,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Dependency Review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + uses: actions/dependency-review-action@v5.0.0 with: fail-on-severity: high diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml index a336dafb..90707b75 100644 --- a/.github/workflows/reusable-lint.yml +++ b/.github/workflows/reusable-lint.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false @@ -23,7 +23,7 @@ jobs: run: git diff --exit-code package-lock.json - name: Install python 3.13 - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/reusable-sast.yml b/.github/workflows/reusable-sast.yml index 077dc7d1..7508bd84 100644 --- a/.github/workflows/reusable-sast.yml +++ b/.github/workflows/reusable-sast.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false @@ -18,12 +18,12 @@ jobs: uses: $/.github/actions/npm-setup - name: Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + uses: github/codeql-action/init@v4.39.1 with: languages: javascript-typescript - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + uses: github/codeql-action/analyze@v4.39.1 with: upload: never output: sarif-results @@ -36,7 +36,7 @@ jobs: - name: Upload SARIF artifact if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: codeql-results path: sarif-results diff --git a/.github/workflows/reusable-sca.yml b/.github/workflows/reusable-sca.yml index 3cc22f92..e25e56cc 100644 --- a/.github/workflows/reusable-sca.yml +++ b/.github/workflows/reusable-sca.yml @@ -11,12 +11,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Run OSV-Scanner - uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + uses: google/osv-scanner-action/osv-scanner-action@v2.7.0 with: scan-args: |- --lockfile=package-lock.json @@ -25,7 +25,7 @@ jobs: - name: Upload SARIF artifact if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: osv-results path: osv-results.sarif diff --git a/.github/workflows/reusable-secrets-scan.yml b/.github/workflows/reusable-secrets-scan.yml index 539e913f..8b767a31 100644 --- a/.github/workflows/reusable-secrets-scan.yml +++ b/.github/workflows/reusable-secrets-scan.yml @@ -10,12 +10,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false fetch-depth: 0 - name: Run Gitleaks - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 + uses: gitleaks/gitleaks-action@v3.0.0 env: GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/reusable-test.yml b/.github/workflows/reusable-test.yml index 82efdfff..a2e4b379 100644 --- a/.github/workflows/reusable-test.yml +++ b/.github/workflows/reusable-test.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index 318e4e8c..f14c35ef 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -10,12 +10,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 - name: Run zizmor env: @@ -30,7 +30,7 @@ jobs: - name: Upload SARIF artifact if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: zizmor-results path: zizmor-results.sarif diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index f7c9253e..73301e3b 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -11,7 +11,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v11 + - uses: actions/stale@v11.0.0 with: days-before-issue-stale: 384 days-before-pr-stale: 192 From 8f27f527f9a5e7e3f33c0c4a2e527ea3650c1ad1 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 20:57:23 +0000 Subject: [PATCH 05/11] Checking approved external actions --- .github/workflows/pull-request.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 31a62df0..6aa0fe5b 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -21,8 +21,8 @@ jobs: dependency-review: uses: $/.github/workflows/reusable-dependency-review.yml - secret-scanning: - uses: $/.github/workflows/reusable-secrets-scan.yml + # secret-scanning: + # uses: $/.github/workflows/reusable-secrets-scan.yml software-composition-analysis: uses: $/.github/workflows/reusable-sca.yml From ec0298941ef139dbf9eb2e66ca7616fd23221ad2 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Thu, 29 Oct 2026 21:10:58 +0000 Subject: [PATCH 06/11] Fixed issues with failed workflows and confirmed gitleaks issue --- .github/workflows/reusable-sca.yml | 2 +- .github/workflows/reusable-workflow-lint.yml | 2 +- .../workflows/{codeql-upload.yml => sarif-upload.yml} | 10 +++++++++- 3 files changed, 11 insertions(+), 3 deletions(-) rename .github/workflows/{codeql-upload.yml => sarif-upload.yml} (76%) diff --git a/.github/workflows/reusable-sca.yml b/.github/workflows/reusable-sca.yml index e25e56cc..513670d2 100644 --- a/.github/workflows/reusable-sca.yml +++ b/.github/workflows/reusable-sca.yml @@ -21,7 +21,7 @@ jobs: scan-args: |- --lockfile=package-lock.json --format=sarif - --output=osv-results.sarif + --output-file=osv-results.sarif - name: Upload SARIF artifact if: always() diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index f14c35ef..1fac70e2 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -20,7 +20,7 @@ jobs: - name: Run zizmor env: GH_TOKEN: ${{ github.token }} - run: uvx zizmor@1.31.1 --format=sarif --output=zizmor-results.sarif . + run: uvx zizmor@1.31.1 --format=sarif . > zizmor-results.sarif - name: Fail on findings run: | diff --git a/.github/workflows/codeql-upload.yml b/.github/workflows/sarif-upload.yml similarity index 76% rename from .github/workflows/codeql-upload.yml rename to .github/workflows/sarif-upload.yml index 9234b66a..e9476923 100644 --- a/.github/workflows/codeql-upload.yml +++ b/.github/workflows/sarif-upload.yml @@ -1,4 +1,4 @@ -name: Upload SARIF osv-results +name: Upload SARIF results on: workflow_run: workflows: ["Pull Request"] @@ -30,6 +30,14 @@ jobs: run-id: ${{ github.event.workflow_run.id }} github-token: ${{ github.token }} + - name: Download osv SARIF + uses: actions/download-artifact@v8.0.2 + with: + name: osv-results + path: ./sarif-input + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + - name: Upload all SARIF results uses: github/codeql-action/upload-sarif@v4.39.1 with: From f6004e1eb1e39559b8e48eec74e7ce7640b633ce Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Fri, 30 Oct 2026 10:15:35 +0000 Subject: [PATCH 07/11] Added zizmor configuration to ignore known accepted violations --- .github/actions/npm-setup/action.yml | 20 ++++++++++---------- .github/workflows/pull-request.yml | 2 +- .github/workflows/reusable-lint.yml | 6 +++--- .github/workflows/reusable-workflow-lint.yml | 13 +++++++++++++ .github/workflows/sarif-upload.yml | 2 +- .github/zizmor.yml | 8 ++++++++ 6 files changed, 36 insertions(+), 15 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/actions/npm-setup/action.yml b/.github/actions/npm-setup/action.yml index 84c8ce70..f8a88d4d 100644 --- a/.github/actions/npm-setup/action.yml +++ b/.github/actions/npm-setup/action.yml @@ -1,25 +1,25 @@ -name: "npm setup" -description: "Sets up NodeJS with npm caching and dependencies installed" +name: 'npm setup' +description: 'Sets up NodeJS with npm caching and dependencies installed' inputs: node-version: - description: "NodeJS version" + description: 'NodeJS version' required: false - default: "24" + default: '24' install-command: - description: "Dependency installation command" + description: 'Dependency installation command' required: false - default: "npm clean-install" + default: 'npm clean-install' runs: - using: "composite" + using: 'composite' steps: - - name: "Install node ${{ inputs.node-version }}" + - name: 'Install node ${{ inputs.node-version }}' uses: actions/setup-node@v7.1.0 with: node-version: ${{ inputs.node-version }} - cache: "npm" + cache: 'npm' - - name: "Install dependencies" + - name: 'Install dependencies' shell: bash run: ${{ inputs.install-command }} diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 6aa0fe5b..9d5f6473 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -1,7 +1,7 @@ name: Pull Request on: pull_request: - branches: ["main"] + branches: ['main'] concurrency: group: pr-${{ github.ref }} diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml index 90707b75..6125b6f3 100644 --- a/.github/workflows/reusable-lint.yml +++ b/.github/workflows/reusable-lint.yml @@ -17,15 +17,15 @@ jobs: - name: npm Setup uses: $/.github/actions/npm-setup with: - install-command: "npm install" + install-command: 'npm install' - - name: "Fail if npm install changed package-lock.json" + - name: 'Fail if npm install changed package-lock.json' run: git diff --exit-code package-lock.json - name: Install python 3.13 uses: actions/setup-python@v7.1.0 with: - python-version: "3.13" + python-version: '3.13' - name: Install lint dependencies run: npm run lint-setup diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index 1fac70e2..85ad12c4 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -35,3 +35,16 @@ jobs: name: zizmor-results path: zizmor-results.sarif retention-days: 1 + + actions-lock: + runs-on: ubuntu-latest + steps: + - name: Install gh-actions-lock extension + env: + GH_TOKEN: ${{ github.token }} + run: gh extension install github/gh-actions-lock + + - name: Verify actions.lock is up to date + env: + GH_TOKEN: ${{ github.token }} + run: gh actions-lock --verify diff --git a/.github/workflows/sarif-upload.yml b/.github/workflows/sarif-upload.yml index e9476923..965be714 100644 --- a/.github/workflows/sarif-upload.yml +++ b/.github/workflows/sarif-upload.yml @@ -1,7 +1,7 @@ name: Upload SARIF results on: workflow_run: - workflows: ["Pull Request"] + workflows: ['Pull Request'] types: [completed] permissions: diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..09646f46 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,8 @@ +rules: + unpinned-uses: + config: + policies: + "*": ref-pin + dangerous-triggers: + ignore: + - sarif-upload.yml:3 \ No newline at end of file From 732e31c1fd7870f3c121417aee0f92624a857b15 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Fri, 30 Oct 2026 10:58:02 +0000 Subject: [PATCH 08/11] Condensed workflow files and addressed issues from zizmor and other workflows --- .github/actions/npm-setup/action.yml | 22 ++--- .github/dependabot.yml | 4 + .../{reusable-build.yml => _build.yml} | 0 ...ency-review.yml => _dependency-review.yml} | 0 .../{reusable-lint.yml => _lint.yml} | 0 .github/workflows/_security-scans.yml | 84 +++++++++++++++++++ .github/workflows/_test.yml | 35 ++++++++ ...e-workflow-lint.yml => _workflow-lint.yml} | 7 +- .github/workflows/actions.lock | 49 +++++------ .github/workflows/cron-release.yml | 2 +- .github/workflows/cypress.yml | 11 +-- .github/workflows/pull-request.yml | 20 ++--- .github/workflows/reusable-sast.yml | 43 ---------- .github/workflows/reusable-sca.yml | 32 ------- .github/workflows/reusable-secrets-scan.yml | 21 ----- .github/workflows/reusable-test.yml | 21 ----- .github/zizmor.yml | 7 +- package-lock.json | 2 +- package.json | 2 +- 19 files changed, 184 insertions(+), 178 deletions(-) rename .github/workflows/{reusable-build.yml => _build.yml} (100%) rename .github/workflows/{reusable-dependency-review.yml => _dependency-review.yml} (100%) rename .github/workflows/{reusable-lint.yml => _lint.yml} (100%) create mode 100644 .github/workflows/_security-scans.yml create mode 100644 .github/workflows/_test.yml rename .github/workflows/{reusable-workflow-lint.yml => _workflow-lint.yml} (89%) delete mode 100644 .github/workflows/reusable-sast.yml delete mode 100644 .github/workflows/reusable-sca.yml delete mode 100644 .github/workflows/reusable-secrets-scan.yml delete mode 100644 .github/workflows/reusable-test.yml diff --git a/.github/actions/npm-setup/action.yml b/.github/actions/npm-setup/action.yml index f8a88d4d..f94aa5da 100644 --- a/.github/actions/npm-setup/action.yml +++ b/.github/actions/npm-setup/action.yml @@ -1,25 +1,27 @@ -name: 'npm setup' -description: 'Sets up NodeJS with npm caching and dependencies installed' +name: npm setup +description: Sets up NodeJS with npm caching and dependencies installed inputs: node-version: - description: 'NodeJS version' + description: NodeJS version required: false - default: '24' + default: 24 install-command: - description: 'Dependency installation command' + description: Dependency installation command required: false - default: 'npm clean-install' + default: npm clean-install runs: - using: 'composite' + using: composite steps: - - name: 'Install node ${{ inputs.node-version }}' + - name: Install node ${{ inputs.node-version }} uses: actions/setup-node@v7.1.0 with: node-version: ${{ inputs.node-version }} cache: 'npm' - - name: 'Install dependencies' + - name: Install dependencies shell: bash - run: ${{ inputs.install-command }} + env: + INSTALL_COMMAND: ${{ inputs.install-command }} + run: $INSTALL_COMMAND diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 21a69666..2b1e198a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,8 @@ version: 2 updates: - package-ecosystem: 'npm' + cooldown: + default-days: 7 directory: '/' schedule: interval: 'weekly' @@ -31,6 +33,8 @@ updates: - 'version-update:semver-major' - package-ecosystem: 'github-actions' + cooldown: + default-days: 7 directory: '/' schedule: interval: 'weekly' diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/_build.yml similarity index 100% rename from .github/workflows/reusable-build.yml rename to .github/workflows/_build.yml diff --git a/.github/workflows/reusable-dependency-review.yml b/.github/workflows/_dependency-review.yml similarity index 100% rename from .github/workflows/reusable-dependency-review.yml rename to .github/workflows/_dependency-review.yml diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/_lint.yml similarity index 100% rename from .github/workflows/reusable-lint.yml rename to .github/workflows/_lint.yml diff --git a/.github/workflows/_security-scans.yml b/.github/workflows/_security-scans.yml new file mode 100644 index 00000000..611f2445 --- /dev/null +++ b/.github/workflows/_security-scans.yml @@ -0,0 +1,84 @@ +name: Security Scans +on: + workflow_call: + +permissions: + contents: read + actions: read + +jobs: + # TODO(#398): Currently blocked by pulp organisation actions allow-list - gitleaks-action isn't permitted. + # secret-scanning: + # if: false + # runs-on: ubuntu-latest + # steps: + # - name: Checkout pulp-ui (${{ github.ref }}) + # uses: actions/checkout@v7.0.1 + # with: + # persist-credentials: false + # fetch-depth: 0 + + # - name: Run Gitleaks + # uses: gitleaks/gitleaks-action@v3.0.0 + # env: + # GITHUB_TOKEN: ${{ github.token }} + + software-composition-analysis: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: Run OSV-Scanner + uses: google/osv-scanner-action/osv-scanner-action@v2.7.0 + with: + scan-args: |- + --lockfile=package-lock.json + --format=sarif + --output-file=osv-results.sarif + + - name: Upload SARIF artifact + if: always() + uses: actions/upload-artifact@v7.0.2 + with: + name: osv-results + path: osv-results.sarif + retention-days: 1 + + static-application-security-testing: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4.39.1 + with: + languages: javascript-typescript + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4.39.1 + with: + upload: never + output: sarif-results + + - name: Fail on findings + run: | + count=$(jq -s '[.[] | .runs[].results[]] | length' sarif-results/*.sarif) + echo "CodeQL found $count issue(s)" + [ "$count" -eq 0 ] + + - name: Upload SARIF artifact + if: always() + uses: actions/upload-artifact@v7.0.2 + with: + name: codeql-results + path: sarif-results + retention-days: 1 diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml new file mode 100644 index 00000000..111a612f --- /dev/null +++ b/.github/workflows/_test.yml @@ -0,0 +1,35 @@ +name: Test +on: + workflow_call: + +permissions: + contents: read + +jobs: + integration-tests: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Run tests + run: npm run test:integration + + unit-tests: + runs-on: ubuntu-latest + steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: npm Setup + uses: $/.github/actions/npm-setup + + - name: Run tests + run: npm run test:unit diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/_workflow-lint.yml similarity index 89% rename from .github/workflows/reusable-workflow-lint.yml rename to .github/workflows/_workflow-lint.yml index 85ad12c4..f692cf08 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/_workflow-lint.yml @@ -6,7 +6,7 @@ permissions: contents: read jobs: - workflow-lint: + zizmor: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) @@ -39,6 +39,11 @@ jobs: actions-lock: runs-on: ubuntu-latest steps: + - name: Checkout pulp-ui (${{ github.ref }}) + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Install gh-actions-lock extension env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index ef27c9c9..f751f019 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,50 +3,45 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.3' workflows: - '.github/workflows/codeql-upload.yml': - - 'actions/download-artifact@v8.0.2' - - 'github/codeql-action@v4.39.1' - '.github/workflows/cron-release.yml': + '.github/workflows/_build.yml': - 'actions/checkout@v7.0.1' - 'actions/setup-node@v7.1.0' - - 'actions/setup-python@v7.1.0' - '.github/workflows/cypress.yml': - - 'actions/cache@v6.1.0' - - 'actions/checkout@v7.0.1' - - 'actions/setup-node@v7.1.0' - - 'actions/setup-python@v7.1.0' - - 'actions/upload-artifact@v7.0.2' - '.github/workflows/pull-request.yml': - - 'actions/checkout@v7.0.1' - '.github/workflows/reusable-build.yml': - - 'actions/checkout@v7.0.1' - - 'actions/setup-node@v7.1.0' - '.github/workflows/reusable-dependency-review.yml': + '.github/workflows/_dependency-review.yml': - 'actions/checkout@v7.0.1' - 'actions/dependency-review-action@v5.0.0' - '.github/workflows/reusable-lint.yml': + '.github/workflows/_lint.yml': - 'actions/checkout@v7.0.1' - 'actions/setup-node@v7.1.0' - 'actions/setup-python@v7.1.0' - '.github/workflows/reusable-sast.yml': + '.github/workflows/_security-scans.yml': - 'actions/checkout@v7.0.1' - 'actions/setup-node@v7.1.0' - 'actions/upload-artifact@v7.0.2' - 'github/codeql-action@v4.39.1' - '.github/workflows/reusable-sca.yml': - - 'actions/checkout@v7.0.1' - - 'actions/upload-artifact@v7.0.2' - - 'google/osv-scanner-action@v2.7.0' - '.github/workflows/reusable-secrets-scan.yml': - - 'actions/checkout@v7.0.1' - 'gitleaks/gitleaks-action@v3.0.0' - '.github/workflows/reusable-test.yml': + - 'google/osv-scanner-action@v2.7.0' + '.github/workflows/_test.yml': - 'actions/checkout@v7.0.1' - 'actions/setup-node@v7.1.0' - '.github/workflows/reusable-workflow-lint.yml': + '.github/workflows/_workflow-lint.yml': - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.2' - 'astral-sh/setup-uv@v10.3.3' + '.github/workflows/cron-release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.1.0' + '.github/workflows/cypress.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + '.github/workflows/pull-request.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/sarif-upload.yml': + - 'actions/download-artifact@v8.0.2' + - 'github/codeql-action@v4.39.1' '.github/workflows/stale.yml': - 'actions/stale@v11.0.0' dependencies: diff --git a/.github/workflows/cron-release.yml b/.github/workflows/cron-release.yml index 7f4c24d0..baf00e87 100644 --- a/.github/workflows/cron-release.yml +++ b/.github/workflows/cron-release.yml @@ -13,7 +13,7 @@ jobs: permissions: contents: write steps: - - name: 'Checkout pulp-ui (main)' + - name: Checkout pulp-ui (${{ github.ref }}) uses: actions/checkout@v7.0.1 with: ref: 'main' diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml index e10b6c73..6218ee91 100644 --- a/.github/workflows/cypress.yml +++ b/.github/workflows/cypress.yml @@ -13,16 +13,17 @@ concurrency: group: cypress-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: cypress: runs-on: ubuntu-latest - - strategy: - fail-fast: false - steps: - - name: 'Checkout pulp-ui (${{ github.ref }})' + - name: Checkout pulp-ui (${{ github.ref }}) uses: actions/checkout@v7.0.1 + with: + persist-credentials: false - name: 'backend setup' run: | diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 9d5f6473..06cd9004 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -13,28 +13,22 @@ permissions: jobs: workflow-lint: - uses: $/.github/workflows/reusable-workflow-lint.yml + uses: $/.github/workflows/_workflow-lint.yml linting: - uses: $/.github/workflows/reusable-lint.yml + uses: $/.github/workflows/_lint.yml dependency-review: - uses: $/.github/workflows/reusable-dependency-review.yml + uses: $/.github/workflows/_dependency-review.yml - # secret-scanning: - # uses: $/.github/workflows/reusable-secrets-scan.yml - - software-composition-analysis: - uses: $/.github/workflows/reusable-sca.yml - - sast-quality: - uses: $/.github/workflows/reusable-sast.yml + security-scans: + uses: $/.github/workflows/_security-scans.yml build: - uses: $/.github/workflows/reusable-build.yml + uses: $/.github/workflows/_build.yml test: - uses: $/.github/workflows/reusable-test.yml + uses: $/.github/workflows/_test.yml merge-commits: runs-on: ubuntu-latest diff --git a/.github/workflows/reusable-sast.yml b/.github/workflows/reusable-sast.yml deleted file mode 100644 index 7508bd84..00000000 --- a/.github/workflows/reusable-sast.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: SAST quality -on: - workflow_call: - -permissions: - contents: read - -jobs: - codeql: - runs-on: ubuntu-latest - steps: - - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - - name: npm Setup - uses: $/.github/actions/npm-setup - - - name: Initialize CodeQL - uses: github/codeql-action/init@v4.39.1 - with: - languages: javascript-typescript - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.39.1 - with: - upload: never - output: sarif-results - - - name: Fail on findings - run: | - count=$(jq -s '[.[] | .runs[].results[]] | length' sarif-results/*.sarif) - echo "CodeQL found $count issue(s)" - [ "$count" -eq 0 ] - - - name: Upload SARIF artifact - if: always() - uses: actions/upload-artifact@v7.0.2 - with: - name: codeql-results - path: sarif-results - retention-days: 1 diff --git a/.github/workflows/reusable-sca.yml b/.github/workflows/reusable-sca.yml deleted file mode 100644 index 513670d2..00000000 --- a/.github/workflows/reusable-sca.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: SCA -on: - workflow_call: - -permissions: - contents: read - actions: read - -jobs: - osv-scanner: - runs-on: ubuntu-latest - steps: - - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - - name: Run OSV-Scanner - uses: google/osv-scanner-action/osv-scanner-action@v2.7.0 - with: - scan-args: |- - --lockfile=package-lock.json - --format=sarif - --output-file=osv-results.sarif - - - name: Upload SARIF artifact - if: always() - uses: actions/upload-artifact@v7.0.2 - with: - name: osv-results - path: osv-results.sarif - retention-days: 1 diff --git a/.github/workflows/reusable-secrets-scan.yml b/.github/workflows/reusable-secrets-scan.yml deleted file mode 100644 index 8b767a31..00000000 --- a/.github/workflows/reusable-secrets-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: Secret Scanning -on: - workflow_call: - -permissions: - contents: read - -jobs: - secret-scanning: - runs-on: ubuntu-latest - steps: - - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - fetch-depth: 0 - - - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v3.0.0 - env: - GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/reusable-test.yml b/.github/workflows/reusable-test.yml deleted file mode 100644 index a2e4b379..00000000 --- a/.github/workflows/reusable-test.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: Test -on: - workflow_call: - -permissions: - contents: read - -jobs: - test: - runs-on: ubuntu-latest - steps: - - name: Checkout pulp-ui (${{ github.ref }}) - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - - name: npm Setup - uses: $/.github/actions/npm-setup - - - name: Run tests - run: npm run test diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 09646f46..4b974012 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -2,7 +2,10 @@ rules: unpinned-uses: config: policies: - "*": ref-pin + '*': ref-pin dangerous-triggers: ignore: - - sarif-upload.yml:3 \ No newline at end of file + - sarif-upload.yml:3 + artipacked: + ignore: + - cron-release.yml:17 diff --git a/package-lock.json b/package-lock.json index 5123d004..16777ed7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -30,7 +30,7 @@ "react-dom": "^18.3.1", "react-markdown": "^10.1.0", "react-router": "^7.18.2", - "zod": "4.6.5" + "zod": "4.6.7" }, "devDependencies": { "@babel/core": "^7.29.6", diff --git a/package.json b/package.json index e98df306..cc770755 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "react-dom": "^18.3.1", "react-markdown": "^10.1.0", "react-router": "^7.18.2", - "zod": "4.6.5" + "zod": "4.6.7" }, "devDependencies": { "@babel/core": "^7.29.6", From 435ebd8a5dc248fe6f8ff7b821803e9a27ca567f Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Fri, 30 Oct 2026 11:32:25 +0000 Subject: [PATCH 09/11] Updated packages with flagged vulns and added new osv configuration for known vuln tracking --- .github/workflows/actions.lock | 6 - .github/zizmor.yml | 5 +- osv-scanner.toml | 3 + package-lock.json | 209 ++++++++++++++------------------- package.json | 22 ++-- 5 files changed, 110 insertions(+), 135 deletions(-) create mode 100644 osv-scanner.toml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f751f019..8a706e20 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -18,7 +18,6 @@ workflows: - 'actions/setup-node@v7.1.0' - 'actions/upload-artifact@v7.0.2' - 'github/codeql-action@v4.39.1' - - 'gitleaks/gitleaks-action@v3.0.0' - 'google/osv-scanner-action@v2.7.0' '.github/workflows/_test.yml': - 'actions/checkout@v7.0.1' @@ -95,11 +94,6 @@ dependencies: commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' owner_id: 9919 repo_id: 259445878 - 'gitleaks/gitleaks-action@v3.0.0': - ref: 'v3.0.0' - commit: 'sha1-e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e' - owner_id: 90395851 - repo_id: 242854909 'google/osv-scanner-action@v2.7.0': ref: 'v2.7.0' commit: 'sha1-b1d267aea5211fa648d9d442fa64b90dbdcbdd36' diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 4b974012..86184f32 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,4 +8,7 @@ rules: - sarif-upload.yml:3 artipacked: ignore: - - cron-release.yml:17 + - cron-release.yml:16 + adhoc-packages: + ignore: + - cypress.yml:86 diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 00000000..337ecd67 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,3 @@ +[[IgnoredVulns]] +id = "CVE-2026-93753" +reason = "deepmerge: no fixed version avaliable" diff --git a/package-lock.json b/package-lock.json index 16777ed7..71eda13f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,7 +19,9 @@ "@patternfly/react-core": "^5.4.14", "@patternfly/react-table": "^5.4.16", "@pulp-ui/sdk": "0.0.1", + "@vitest/mocker": "5.0.5", "axios": "^1.20.0", + "body-parser": "2.4.0", "classnames": "^2.5.1", "compare-versions": "^6.1.1", "file-saver": "^2.0.5", @@ -30,7 +32,7 @@ "react-dom": "^18.3.1", "react-markdown": "^10.1.0", "react-router": "^7.18.2", - "zod": "4.6.7" + "systeminformation": "5.33.16" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -59,7 +61,7 @@ "eslint-plugin-react": "^7.37.5", "fork-ts-checker-webpack-plugin": "^9.1.0", "globals": "^16.5.0", - "happy-dom": "20.14.5", + "happy-dom": "21.0.4", "html-webpack-plugin": "^5.6.5", "mini-css-extract-plugin": "^2.9.4", "msw": "2.15.0", @@ -77,11 +79,11 @@ "typescript-eslint": "^8.71.1", "url-join": "^5.0.0", "vite": "8.3.4", - "vitest": "5.0.1", + "vitest": "5.0.5", "webpack": "5.110.3", "webpack-cli": "7.2.3", "webpack-dev-server": "6.0.0", - "zod": "4.6.5" + "zod": "4.6.7" }, "engines": { "node": ">=22.32.2", @@ -2885,7 +2887,6 @@ "version": "3.1.2", "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==", - "dev": true, "engines": { "node": ">=6.0.0" } @@ -2904,14 +2905,12 @@ "version": "1.6.0", "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz", "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==", - "dev": true, "license": "MIT" }, "node_modules/@jridgewell/trace-mapping": { "version": "0.3.31", "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz", "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==", - "dev": true, "license": "MIT", "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", @@ -6269,22 +6268,21 @@ } }, "node_modules/@vitest/mocker": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.1.tgz", - "integrity": "sha512-6K1DoBNAPGvuOcSsGA4D6x+5zEEff/KmOOP3uetT2TrGpVfI+HRHRnJJfKi5ib/g1vx8IYHQD8s0pbJz8WQI7Q==", - "dev": true, + "version": "5.0.5", + "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.5.tgz", + "integrity": "sha512-xLL3lkDegJZw+MGoGaCCsFayDZthGgpAtr3Vziyfc4p7xH89K7KRPcRBBh/kEYm0Aqkt5DtTmkYpBtRV/FrHZg==", "license": "MIT", "dependencies": { "@jridgewell/trace-mapping": "0.3.31", - "@vitest/spy": "5.0.1", + "@vitest/spy": "5.0.5", "estree-walker": "^3.0.3", - "magic-string": "^1.2.3" + "magic-string": "^1.4.3" }, "funding": { "url": "https://opencollective.com/vitest" }, "peerDependencies": { - "msw": "^2.4.9", + "msw": "^2.4.9 || ^3.0.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "peerDependenciesMeta": { @@ -6297,10 +6295,9 @@ } }, "node_modules/@vitest/spy": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.1.tgz", - "integrity": "sha512-rbto/mF/SGERxEgYOek7Xm6B9b+y+mVoo+f4b2LymYO8zM1b7uB5nHuhVMTP2hxdzgxvGiZYGxGIaMvL5y180Q==", - "dev": true, + "version": "5.0.5", + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.5.tgz", + "integrity": "sha512-lwJRExuH417257Q5wv9QYugN9IMJkoxcrKrYxGPQkBzl7wlNpTUxD/5yNX4ESKVUIShKPgkGchYPFMWOOk0wzw==", "license": "MIT", "funding": { "url": "https://opencollective.com/vitest" @@ -7128,19 +7125,18 @@ "dev": true }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", - "dev": true, + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -7156,7 +7152,6 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", - "dev": true, "license": "MIT", "engines": { "node": ">=18" @@ -7303,7 +7298,6 @@ "version": "3.1.2", "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -7378,7 +7372,6 @@ "version": "1.0.4", "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", - "dev": true, "license": "MIT", "dependencies": { "call-bind-apply-helpers": "^1.0.2", @@ -7460,9 +7453,9 @@ } }, "node_modules/chai": { - "version": "6.2.2", - "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz", - "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==", + "version": "6.3.0", + "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz", + "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==", "dev": true, "license": "MIT", "engines": { @@ -8716,7 +8709,6 @@ "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -8894,7 +8886,6 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", - "dev": true, "license": "MIT" }, "node_modules/electron-to-chromium": { @@ -9655,7 +9646,6 @@ "version": "3.0.3", "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz", "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==", - "dev": true, "license": "MIT", "dependencies": { "@types/estree": "^1.0.0" @@ -10846,9 +10836,9 @@ } }, "node_modules/happy-dom": { - "version": "20.14.5", - "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-20.14.5.tgz", - "integrity": "sha512-x/RzkpWO40bTjIoT30iQtt64FLLmH/iRcUCN2X//bLx7H3ifkdfPXyqsro/OYtqzIAhiLMMA7mmiOR9C3NOKjQ==", + "version": "21.0.4", + "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-21.0.4.tgz", + "integrity": "sha512-tFm+GaLBgo6o0awHnvHaNoraVo27qJ+2tZEtZ+cIa08hXbeitrxAJajLI05hsUy/2/YTKcUjQYzHe5mCcraLBw==", "dev": true, "license": "MIT", "dependencies": { @@ -11190,7 +11180,6 @@ "version": "2.0.1", "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", - "dev": true, "license": "MIT", "dependencies": { "depd": "~2.0.0", @@ -11283,7 +11272,6 @@ "version": "0.7.3", "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", - "dev": true, "license": "MIT", "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" @@ -11404,8 +11392,7 @@ "node_modules/inherits": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", - "dev": true + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" }, "node_modules/ini": { "version": "1.3.8", @@ -13265,10 +13252,9 @@ } }, "node_modules/magic-string": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.1.tgz", - "integrity": "sha512-8lyCu36ErXR0J9uaGKlKQoiLZKmtI63YGLE8G2o9jyRPdr4X47LusSOwgOJOzcVtp81fTAAjxR7BwKz682Jhow==", - "dev": true, + "version": "1.4.5", + "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz", + "integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==", "license": "MIT", "dependencies": { "@jridgewell/sourcemap-codec": "^1.6.0" @@ -13462,7 +13448,6 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz", "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -14518,7 +14503,6 @@ "version": "1.13.4", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.4" @@ -14628,7 +14612,6 @@ "version": "2.4.1", "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", - "dev": true, "license": "MIT", "dependencies": { "ee-first": "1.1.1" @@ -15840,7 +15823,6 @@ "version": "6.17.0", "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz", "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==", - "dev": true, "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -15891,7 +15873,6 @@ "version": "3.0.2", "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz", "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==", - "dev": true, "license": "MIT", "dependencies": { "bytes": "~3.1.2", @@ -16562,8 +16543,7 @@ "node_modules/safer-buffer": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", - "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", - "dev": true + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" }, "node_modules/sass": { "version": "1.97.1", @@ -16945,7 +16925,6 @@ "version": "1.2.0", "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", - "dev": true, "license": "ISC" }, "node_modules/shallow-clone": { @@ -16999,7 +16978,6 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", - "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", @@ -17019,7 +16997,6 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", - "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", @@ -17036,7 +17013,6 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", - "dev": true, "license": "MIT", "dependencies": { "call-bound": "^1.0.2", @@ -17055,7 +17031,6 @@ "version": "1.0.2", "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", - "dev": true, "license": "MIT", "dependencies": { "call-bound": "^1.0.2", @@ -17071,13 +17046,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/siginfo": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz", - "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==", - "dev": true, - "license": "ISC" - }, "node_modules/signal-exit": { "version": "3.0.7", "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz", @@ -17281,27 +17249,19 @@ "node": ">=0.10.0" } }, - "node_modules/stackback": { - "version": "0.0.2", - "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz", - "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==", - "dev": true, - "license": "MIT" - }, "node_modules/statuses": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" } }, "node_modules/std-env": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz", - "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz", + "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==", "dev": true, "license": "MIT" }, @@ -17848,10 +17808,9 @@ "dev": true }, "node_modules/systeminformation": { - "version": "5.33.1", - "resolved": "https://registry.npmjs.org/systeminformation/-/systeminformation-5.33.1.tgz", - "integrity": "sha512-DEN6ICHk3Tk0Uf/hrAHh7xlt7iL5CJFBtPZinA0H62DrGG/KPKqq/Nzj6lCXPS4Ay/sf/14zNnk9LpqKzBIc+w==", - "dev": true, + "version": "5.33.16", + "resolved": "https://registry.npmjs.org/systeminformation/-/systeminformation-5.33.16.tgz", + "integrity": "sha512-R+Lh69IJXfJj6bfyH1In5cIR9FTr4hBS39YvlZHZjsK1p9cuELPq7hplZZIb56ZESMMb+DzdKqqE6Iomi01Mvg==", "license": "MIT", "os": [ "darwin", @@ -17982,9 +17941,9 @@ "license": "MIT" }, "node_modules/tinybench": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.1.4.tgz", - "integrity": "sha512-9APumHG7r4yOk4X4WlkmE71aZcv1gvin1czO3OQ1U9iJcFA5Ja/ygyb0vPOVHTthFozUYs8CLoLUlM8grb2lTQ==", + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.2.tgz", + "integrity": "sha512-nIZ2N2dFpjBsg2hgitKu7mA+FvsIJuGJOwysRngmVRRmWgR/UyPjwJj8c/fT/dhm8EkHnF5EOogRf+0Z2qrimA==", "dev": true, "license": "MIT", "engines": { @@ -17992,9 +17951,9 @@ } }, "node_modules/tinyexec": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz", - "integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==", + "version": "1.3.1", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz", + "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==", "dev": true, "license": "MIT", "engines": { @@ -18115,7 +18074,6 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", - "dev": true, "license": "MIT", "engines": { "node": ">=0.6" @@ -18269,7 +18227,6 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", - "dev": true, "license": "MIT", "dependencies": { "content-type": "^2.0.0", @@ -18288,7 +18245,6 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", - "dev": true, "license": "MIT", "engines": { "node": ">=18" @@ -18302,7 +18258,6 @@ "version": "1.54.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz", "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.6" @@ -18312,7 +18267,6 @@ "version": "3.0.2", "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz", "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==", - "dev": true, "license": "MIT", "dependencies": { "mime-db": "^1.54.0" @@ -18629,7 +18583,6 @@ "version": "1.0.0", "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", - "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -18875,25 +18828,25 @@ } }, "node_modules/vitest": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.1.tgz", - "integrity": "sha512-iA95lQbKEkvrtTkdAgnWbXfbipWiiWe/hDl2P5tMi6WFwD76G0NxXAGp/M9EOcYupeGJRr6wppMc7CoA41TQjg==", + "version": "5.0.5", + "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.5.tgz", + "integrity": "sha512-cPODOMF8YnkiiYtDdHo6n4wWmBrOBBbOIYH2d33M4l3CdNn72h+qMmO6uXffUN6A5AZFXNND/d+krS9mgkXRfg==", "dev": true, "license": "MIT", "dependencies": { "@types/chai": "^5.2.2", - "@vitest/mocker": "5.0.1", - "chai": "^6.2.2", + "@vitest/mocker": "5.0.5", + "chai": "^6.3.0", "es-module-lexer": "^2.3.2", "expect-type": "^1.4.0", - "magic-string": "^1.2.3", - "obug": "^2.1.4", + "magic-string": "^1.4.3", + "obug": "^3.0.0", "picomatch": "^4.0.7", - "std-env": "^4.2.0", - "tinybench": "6.1.4", - "tinyexec": "1.3.0", + "std-env": "^4.3.0", + "tinybench": "^6.2.2", + "tinyexec": "^1.3.1", "tinyglobby": "^0.2.17", - "why-is-node-running": "^2.3.0" + "why-is-node-running": "3.2.1" }, "bin": { "vitest": "vitest.mjs" @@ -18908,12 +18861,12 @@ "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^22.0.0 || >=24.0.0", - "@vitest/browser-playwright": "5.0.1", - "@vitest/browser-preview": "5.0.1", + "@vitest/browser-playwright": "5.0.5", + "@vitest/browser-preview": "5.0.5", "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0", - "@vitest/coverage-istanbul": "5.0.1", - "@vitest/coverage-v8": "5.0.1", - "@vitest/ui": "5.0.1", + "@vitest/coverage-istanbul": "5.0.5", + "@vitest/coverage-v8": "5.0.5", + "@vitest/ui": "5.0.5", "happy-dom": "*", "jsdom": "*", "vite": "^6.4.0 || ^7.0.0 || ^8.0.0" @@ -18957,6 +18910,20 @@ } } }, + "node_modules/vitest/node_modules/obug": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/obug/-/obug-3.0.0.tgz", + "integrity": "sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==", + "dev": true, + "funding": [ + "https://github.com/sponsors/sxzz", + "https://opencollective.com/debug" + ], + "license": "MIT", + "engines": { + "node": ">=12.20.0" + } + }, "node_modules/vitest/node_modules/picomatch": { "version": "4.0.7", "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", @@ -19375,20 +19342,16 @@ } }, "node_modules/why-is-node-running": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz", - "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==", + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz", + "integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==", "dev": true, "license": "MIT", - "dependencies": { - "siginfo": "^2.0.0", - "stackback": "0.0.2" - }, "bin": { "why-is-node-running": "cli.js" }, "engines": { - "node": ">=8" + "node": ">=20.11" } }, "node_modules/wildcard": { @@ -19644,9 +19607,9 @@ } }, "node_modules/zod": { - "version": "4.6.5", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz", - "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "dev": true, "license": "MIT", "funding": { @@ -19709,6 +19672,16 @@ "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" } + }, + "packages/sdk/node_modules/zod": { + "version": "4.6.5", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz", + "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==", + "dev": true, + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/colinhacks" + } } } } diff --git a/package.json b/package.json index cc770755..5edc7e50 100644 --- a/package.json +++ b/package.json @@ -11,8 +11,10 @@ "@patternfly/patternfly": "^5.4.2", "@patternfly/react-core": "^5.4.14", "@patternfly/react-table": "^5.4.16", - "axios": "^1.20.0", "@pulp-ui/sdk": "0.0.1", + "@vitest/mocker": "5.0.5", + "axios": "^1.20.0", + "body-parser": "2.4.0", "classnames": "^2.5.1", "compare-versions": "^6.1.1", "file-saver": "^2.0.5", @@ -23,7 +25,7 @@ "react-dom": "^18.3.1", "react-markdown": "^10.1.0", "react-router": "^7.18.2", - "zod": "4.6.7" + "systeminformation": "5.33.16" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -37,8 +39,11 @@ "@ls-lint/ls-lint": "^2.3.1", "@trivago/prettier-plugin-sort-imports": "^6.0.0", "@types/react": "^18.3.2", + "@vitest/coverage-v8": "5.0.1", + "ajv": "8.20.0", "babel-loader": "^10.0.0", "clean-webpack-plugin": "^4.0.0", + "commander": "15.0.0", "copy-webpack-plugin": "^14.0.0", "css-loader": "^7.1.2", "cypress": "16.0.0", @@ -49,8 +54,10 @@ "eslint-plugin-react": "^7.37.5", "fork-ts-checker-webpack-plugin": "^9.1.0", "globals": "^16.5.0", + "happy-dom": "21.0.4", "html-webpack-plugin": "^5.6.5", "mini-css-extract-plugin": "^2.9.4", + "msw": "2.15.0", "npm-run-all": "^4.1.5", "postcss": "^8.5.26", "prettier": "^3.9.10", @@ -64,17 +71,12 @@ "typescript": "^5.9.3", "typescript-eslint": "^8.71.1", "url-join": "^5.0.0", + "vite": "8.3.4", + "vitest": "5.0.5", "webpack": "5.110.3", "webpack-cli": "7.2.3", "webpack-dev-server": "6.0.0", - "ajv": "8.20.0", - "commander": "15.0.0", - "vite": "8.3.4", - "zod": "4.6.5", - "msw": "2.15.0", - "vitest": "5.0.1", - "@vitest/coverage-v8": "5.0.1", - "happy-dom": "20.14.5" + "zod": "4.6.7" }, "scripts": { "prepare": "npm run build -w @pulp-ui/sdk", From bfcb493a993c197f9241408ec79b54b01c509151 Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Fri, 30 Oct 2026 11:43:13 +0000 Subject: [PATCH 10/11] Updated flagged zod package within SDK --- .github/workflows/_security-scans.yml | 2 +- package-lock.json | 61 +++++++++++++++++++-------- package.json | 8 ++-- packages/sdk/package.json | 4 +- 4 files changed, 50 insertions(+), 25 deletions(-) diff --git a/.github/workflows/_security-scans.yml b/.github/workflows/_security-scans.yml index 611f2445..9cc67fdd 100644 --- a/.github/workflows/_security-scans.yml +++ b/.github/workflows/_security-scans.yml @@ -47,7 +47,7 @@ jobs: path: osv-results.sarif retention-days: 1 - static-application-security-testing: + codeql: runs-on: ubuntu-latest steps: - name: Checkout pulp-ui (${{ github.ref }}) diff --git a/package-lock.json b/package-lock.json index 71eda13f..f1f38f96 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,9 +19,7 @@ "@patternfly/react-core": "^5.4.14", "@patternfly/react-table": "^5.4.16", "@pulp-ui/sdk": "0.0.1", - "@vitest/mocker": "5.0.5", "axios": "^1.20.0", - "body-parser": "2.4.0", "classnames": "^2.5.1", "compare-versions": "^6.1.1", "file-saver": "^2.0.5", @@ -31,8 +29,7 @@ "react": "^18.3.1", "react-dom": "^18.3.1", "react-markdown": "^10.1.0", - "react-router": "^7.18.2", - "systeminformation": "5.33.16" + "react-router": "^7.18.2" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -47,8 +44,10 @@ "@trivago/prettier-plugin-sort-imports": "^6.0.0", "@types/react": "^18.3.2", "@vitest/coverage-v8": "5.0.1", + "@vitest/mocker": "5.0.5", "ajv": "8.20.0", "babel-loader": "^10.0.0", + "body-parser": "2.4.0", "clean-webpack-plugin": "^4.0.0", "commander": "15.0.0", "copy-webpack-plugin": "^14.0.0", @@ -75,6 +74,7 @@ "stylelint": "^16.26.1", "stylelint-config-recommended-scss": "^16.0.2", "stylelint-scss": "^6.14.0", + "systeminformation": "5.33.16", "typescript": "^5.9.3", "typescript-eslint": "^8.71.1", "url-join": "^5.0.0", @@ -2887,6 +2887,7 @@ "version": "3.1.2", "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==", + "dev": true, "engines": { "node": ">=6.0.0" } @@ -2905,12 +2906,14 @@ "version": "1.6.0", "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz", "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==", + "dev": true, "license": "MIT" }, "node_modules/@jridgewell/trace-mapping": { "version": "0.3.31", "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz", "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==", + "dev": true, "license": "MIT", "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", @@ -6271,6 +6274,7 @@ "version": "5.0.5", "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.5.tgz", "integrity": "sha512-xLL3lkDegJZw+MGoGaCCsFayDZthGgpAtr3Vziyfc4p7xH89K7KRPcRBBh/kEYm0Aqkt5DtTmkYpBtRV/FrHZg==", + "dev": true, "license": "MIT", "dependencies": { "@jridgewell/trace-mapping": "0.3.31", @@ -6298,6 +6302,7 @@ "version": "5.0.5", "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.5.tgz", "integrity": "sha512-lwJRExuH417257Q5wv9QYugN9IMJkoxcrKrYxGPQkBzl7wlNpTUxD/5yNX4ESKVUIShKPgkGchYPFMWOOk0wzw==", + "dev": true, "license": "MIT", "funding": { "url": "https://opencollective.com/vitest" @@ -7128,6 +7133,7 @@ "version": "2.4.0", "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", + "dev": true, "license": "MIT", "dependencies": { "bytes": "^3.1.2", @@ -7152,6 +7158,7 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", + "dev": true, "license": "MIT", "engines": { "node": ">=18" @@ -7298,6 +7305,7 @@ "version": "3.1.2", "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -7372,6 +7380,7 @@ "version": "1.0.4", "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", + "dev": true, "license": "MIT", "dependencies": { "call-bind-apply-helpers": "^1.0.2", @@ -8709,6 +8718,7 @@ "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -8886,6 +8896,7 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", + "dev": true, "license": "MIT" }, "node_modules/electron-to-chromium": { @@ -9646,6 +9657,7 @@ "version": "3.0.3", "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz", "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==", + "dev": true, "license": "MIT", "dependencies": { "@types/estree": "^1.0.0" @@ -11180,6 +11192,7 @@ "version": "2.0.1", "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "dev": true, "license": "MIT", "dependencies": { "depd": "~2.0.0", @@ -11272,6 +11285,7 @@ "version": "0.7.3", "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", + "dev": true, "license": "MIT", "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" @@ -11392,7 +11406,8 @@ "node_modules/inherits": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "dev": true }, "node_modules/ini": { "version": "1.3.8", @@ -13255,6 +13270,7 @@ "version": "1.4.5", "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz", "integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==", + "dev": true, "license": "MIT", "dependencies": { "@jridgewell/sourcemap-codec": "^1.6.0" @@ -13448,6 +13464,7 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz", "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -14503,6 +14520,7 @@ "version": "1.13.4", "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.4" @@ -14612,6 +14630,7 @@ "version": "2.4.1", "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "dev": true, "license": "MIT", "dependencies": { "ee-first": "1.1.1" @@ -15823,6 +15842,7 @@ "version": "6.17.0", "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz", "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==", + "dev": true, "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -15873,6 +15893,7 @@ "version": "3.0.2", "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz", "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==", + "dev": true, "license": "MIT", "dependencies": { "bytes": "~3.1.2", @@ -16543,7 +16564,8 @@ "node_modules/safer-buffer": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", - "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "dev": true }, "node_modules/sass": { "version": "1.97.1", @@ -16925,6 +16947,7 @@ "version": "1.2.0", "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", + "dev": true, "license": "ISC" }, "node_modules/shallow-clone": { @@ -16978,6 +17001,7 @@ "version": "1.1.1", "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", + "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", @@ -16997,6 +17021,7 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", + "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", @@ -17013,6 +17038,7 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", + "dev": true, "license": "MIT", "dependencies": { "call-bound": "^1.0.2", @@ -17031,6 +17057,7 @@ "version": "1.0.2", "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", + "dev": true, "license": "MIT", "dependencies": { "call-bound": "^1.0.2", @@ -17253,6 +17280,7 @@ "version": "2.0.2", "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -17811,6 +17839,7 @@ "version": "5.33.16", "resolved": "https://registry.npmjs.org/systeminformation/-/systeminformation-5.33.16.tgz", "integrity": "sha512-R+Lh69IJXfJj6bfyH1In5cIR9FTr4hBS39YvlZHZjsK1p9cuELPq7hplZZIb56ZESMMb+DzdKqqE6Iomi01Mvg==", + "dev": true, "license": "MIT", "os": [ "darwin", @@ -18074,6 +18103,7 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "dev": true, "license": "MIT", "engines": { "node": ">=0.6" @@ -18227,6 +18257,7 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", + "dev": true, "license": "MIT", "dependencies": { "content-type": "^2.0.0", @@ -18245,6 +18276,7 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", + "dev": true, "license": "MIT", "engines": { "node": ">=18" @@ -18258,6 +18290,7 @@ "version": "1.54.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz", "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.6" @@ -18267,6 +18300,7 @@ "version": "3.0.2", "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz", "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==", + "dev": true, "license": "MIT", "dependencies": { "mime-db": "^1.54.0" @@ -18583,6 +18617,7 @@ "version": "1.0.0", "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "dev": true, "license": "MIT", "engines": { "node": ">= 0.8" @@ -19632,10 +19667,10 @@ "devDependencies": { "orval": "8.35.0", "typescript": "7.0.2", - "zod": "4.6.5" + "zod": "4.6.7" }, "peerDependencies": { - "zod": "^4.6.5" + "zod": "^4.6.7" } }, "packages/sdk/node_modules/typescript": { @@ -19672,16 +19707,6 @@ "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" } - }, - "packages/sdk/node_modules/zod": { - "version": "4.6.5", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz", - "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==", - "dev": true, - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/colinhacks" - } } } } diff --git a/package.json b/package.json index 5edc7e50..039ce672 100644 --- a/package.json +++ b/package.json @@ -12,9 +12,7 @@ "@patternfly/react-core": "^5.4.14", "@patternfly/react-table": "^5.4.16", "@pulp-ui/sdk": "0.0.1", - "@vitest/mocker": "5.0.5", "axios": "^1.20.0", - "body-parser": "2.4.0", "classnames": "^2.5.1", "compare-versions": "^6.1.1", "file-saver": "^2.0.5", @@ -24,8 +22,7 @@ "react": "^18.3.1", "react-dom": "^18.3.1", "react-markdown": "^10.1.0", - "react-router": "^7.18.2", - "systeminformation": "5.33.16" + "react-router": "^7.18.2" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -42,6 +39,7 @@ "@vitest/coverage-v8": "5.0.1", "ajv": "8.20.0", "babel-loader": "^10.0.0", + "body-parser": "2.4.0", "clean-webpack-plugin": "^4.0.0", "commander": "15.0.0", "copy-webpack-plugin": "^14.0.0", @@ -68,11 +66,13 @@ "stylelint": "^16.26.1", "stylelint-config-recommended-scss": "^16.0.2", "stylelint-scss": "^6.14.0", + "systeminformation": "5.33.16", "typescript": "^5.9.3", "typescript-eslint": "^8.71.1", "url-join": "^5.0.0", "vite": "8.3.4", "vitest": "5.0.5", + "@vitest/mocker": "5.0.5", "webpack": "5.110.3", "webpack-cli": "7.2.3", "webpack-dev-server": "6.0.0", diff --git a/packages/sdk/package.json b/packages/sdk/package.json index 9af01777..809a6cf1 100644 --- a/packages/sdk/package.json +++ b/packages/sdk/package.json @@ -18,10 +18,10 @@ "devDependencies": { "orval": "8.35.0", "typescript": "7.0.2", - "zod": "4.6.5" + "zod": "4.6.7" }, "peerDependencies": { - "zod": "^4.6.5" + "zod": "^4.6.7" }, "exports": { "./core/*": { From f6e4774f3567193c132980f4e8b93806675c1faa Mon Sep 17 00:00:00 2001 From: Redtigercod4 <76014409+Redtigercod4@users.noreply.github.com> Date: Fri, 30 Oct 2026 12:38:52 +0000 Subject: [PATCH 11/11] Addressed highlighted issues from peer review of github actions implementation --- .github/workflows/_security-scans.yml | 1 - .github/workflows/_workflow-lint.yml | 2 +- .github/workflows/pull-request.yml | 6 ++++++ .github/workflows/sarif-upload.yml | 7 +++++++ osv-scanner.toml | 3 ++- 5 files changed, 16 insertions(+), 3 deletions(-) diff --git a/.github/workflows/_security-scans.yml b/.github/workflows/_security-scans.yml index 9cc67fdd..4f5e7aa5 100644 --- a/.github/workflows/_security-scans.yml +++ b/.github/workflows/_security-scans.yml @@ -9,7 +9,6 @@ permissions: jobs: # TODO(#398): Currently blocked by pulp organisation actions allow-list - gitleaks-action isn't permitted. # secret-scanning: - # if: false # runs-on: ubuntu-latest # steps: # - name: Checkout pulp-ui (${{ github.ref }}) diff --git a/.github/workflows/_workflow-lint.yml b/.github/workflows/_workflow-lint.yml index f692cf08..bcec44de 100644 --- a/.github/workflows/_workflow-lint.yml +++ b/.github/workflows/_workflow-lint.yml @@ -47,7 +47,7 @@ jobs: - name: Install gh-actions-lock extension env: GH_TOKEN: ${{ github.token }} - run: gh extension install github/gh-actions-lock + run: gh extension install github/gh-actions-lock --pin v0.4.0 - name: Verify actions.lock is up to date env: diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 06cd9004..857d0621 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -12,6 +12,12 @@ permissions: actions: read jobs: + docs: + # NOTE: The workflow tag and the pulpdocs_ref must match. + uses: 'pulp/pulp-docs/.github/workflows/docs-ci.yml@main' + with: + pulpdocs_ref: 'main' + workflow-lint: uses: $/.github/workflows/_workflow-lint.yml diff --git a/.github/workflows/sarif-upload.yml b/.github/workflows/sarif-upload.yml index 965be714..da726165 100644 --- a/.github/workflows/sarif-upload.yml +++ b/.github/workflows/sarif-upload.yml @@ -38,6 +38,13 @@ jobs: run-id: ${{ github.event.workflow_run.id }} github-token: ${{ github.token }} + - name: Validate downloaded SARIF files + run: | + for f in ./sarif-input/*.sarif; do + echo "Validating $f" + jq -e '.version and .runs' "$f" > /dev/null || { echo "::error::$f is not valid SARIF"; exit 1; } + done + - name: Upload all SARIF results uses: github/codeql-action/upload-sarif@v4.39.1 with: diff --git a/osv-scanner.toml b/osv-scanner.toml index 337ecd67..7c2747da 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,3 +1,4 @@ [[IgnoredVulns]] id = "CVE-2026-93753" -reason = "deepmerge: no fixed version avaliable" +ignoreUntil = 2027-01-30 +reason = "deepmerge: no fixed version available (https://github.com/TehShrike/deepmerge/issues/285)"