-
-
Notifications
You must be signed in to change notification settings - Fork 562
Open
Labels
Description
Problem
It seems currently there is no GitHub workflow which verifies that dist/index.js is up to date, this is problematic because:
- it could lead to a stale version of the action being released by accident
- a malicious user could try to inject additional code in
dist/index.js, and hope that it is overlooked during pull request review
Related:
Potential solution
Could you please either uncomment this step in the main.yml workflow again:
action-gh-release/.github/workflows/main.yml
Lines 26 to 32 in 5be0e66
| # - name: "check for uncommitted changes" | |
| # # Ensure no changes, but ignore node_modules dir since dev/fresh ci deps installed. | |
| # run: | | |
| # git diff --exit-code --stat -- . ':!node_modules' \ | |
| # || (echo "##[error] found changed files after build. please 'npm run build && npm run fmt'" \ | |
| # "and check in all changes" \ | |
| # && exit 1) |
(I think that should work as check to verify that dist/index.js is up to date)
Or use a dedicated workflow, for example https://github.com/actions/typescript-action/blob/main/.github/workflows/check-dist.yml (with build steps adjusted), and remove the commented-out step from main.yml mentioned above.