mirror of
https://github.com/jquery/jquery.git
synced 2026-04-20 03:01:22 -04:00
c909d6b1ff
Add explicit permissions section[^1] to workflows. This is a security best practice because by default workflows run with extended set of permissions[^2] (except from `on: pull_request` from external forks[^3]. By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection[^4] or compromised third party tool or action) is restricted. It is recommended to have most strict permissions on the top level[^5] and grant write permissions on job level[^6] on a case by case basis. [^1]: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions [^2]: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token [^3]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ [^4]: https://securitylab.github.com/research/github-actions-untrusted-input/ [^5]: https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions [^6]: https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs Closes gh-5119
80 lines
2.7 KiB
YAML
80 lines
2.7 KiB
YAML
name: CI
|
|
|
|
on: [push, pull_request]
|
|
|
|
permissions:
|
|
contents: read # to fetch code (actions/checkout)
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# Node.js 10 is required by jQuery infra
|
|
# Do not remove 16.x until jsdom tests are re-enabled on newer Node.js versions.
|
|
NODE_VERSION: [10.x, 14.x, 16.x, 18.x, 19.x]
|
|
NPM_SCRIPT: ["test:browserless"]
|
|
include:
|
|
- NAME: "Browser tests: full build, Chrome & Firefox stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:browser"
|
|
BROWSERS: "ChromeHeadless,FirefoxHeadless"
|
|
- NAME: "Browser tests: slim build, Chrome stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:slim"
|
|
BROWSERS: "ChromeHeadless"
|
|
- NAME: "Browser tests: no-deprecated build, Chrome stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:no-deprecated"
|
|
BROWSERS: "ChromeHeadless"
|
|
- NAME: "Browser tests: selector-native build, Chrome stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:selector-native"
|
|
BROWSERS: "ChromeHeadless"
|
|
- NAME: "Browser tests: ES modules build, Chrome stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:esmodules"
|
|
BROWSERS: "ChromeHeadless"
|
|
- NAME: "Browser tests: AMD build, Chrome stable"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:amd"
|
|
BROWSERS: "ChromeHeadless"
|
|
- NAME: "Browser tests: full build, Firefox ESR"
|
|
NODE_VERSION: "16.x"
|
|
NPM_SCRIPT: "test:browser"
|
|
BROWSERS: "FirefoxHeadless"
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.npm
|
|
key: ${{ runner.os }}-node-${{ matrix.NODE_VERSION }}-npm-lock-${{ hashFiles('**/package-lock.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-${{ matrix.NODE_VERSION }}-npm-lock-
|
|
|
|
- name: Use Node.js ${{ matrix.NODE_VERSION }}
|
|
uses: actions/setup-node@v3.5.1
|
|
with:
|
|
node-version: ${{ matrix.NODE_VERSION }}
|
|
|
|
- name: Install firefox ESR
|
|
run: |
|
|
export FIREFOX_SOURCE_URL='https://download.mozilla.org/?product=firefox-esr-latest&lang=en-US&os=linux64'
|
|
wget --no-verbose $FIREFOX_SOURCE_URL -O - | tar -jx -C ${HOME}
|
|
if: "contains(matrix.NAME, 'Firefox ESR')"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
npm install
|
|
|
|
- name: Run tests
|
|
env:
|
|
BROWSERS: ${{ matrix.BROWSERS }}
|
|
run: |
|
|
export PATH=${HOME}/firefox:$PATH
|
|
npm run ${{ matrix.NPM_SCRIPT }}
|