mirror of
https://github.com/NoFxAiOS/nofx.git
synced 2026-07-27 22:12:52 +08:00
c5277c0fb9
pr-checks-comment.yml runs in the privileged workflow_run context with a write token while consuming artifacts produced by the untrusted PR workflow. Seven spots template-interpolated that untrusted data (and the fork-controlled head branch name) directly into github-script source — a crafted artifact could escape the string literal and run arbitrary JS with the privileged token (CodeQL actions/code-injection, critical). - All untrusted values now flow through env vars and process.env; the PR number is parsed and validated before use - test.yml / docker-build.yml gain workflow-level 'permissions: contents: read' (CodeQL actions/missing-workflow-permissions); publish jobs keep their job-level packages:write
59 lines
1.2 KiB
YAML
59 lines
1.2 KiB
YAML
name: Test
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
pull_request:
|
|
branches: [main, dev]
|
|
|
|
# Least privilege: these jobs only read the repo.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backend-tests:
|
|
name: Backend Tests
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true # Don't block PRs
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.23'
|
|
|
|
- name: Download dependencies
|
|
run: go mod download
|
|
|
|
- name: Run tests
|
|
run: go test -v ./...
|
|
|
|
- name: Generate coverage
|
|
run: go test -coverprofile=coverage.out ./...
|
|
continue-on-error: true
|
|
|
|
frontend-tests:
|
|
name: Frontend Tests
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true # Don't block PRs
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: web/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: cd web && npm ci
|
|
|
|
- name: Run tests
|
|
run: cd web && npm run test
|