mirror of
https://github.com/morluto/rea.git
synced 2026-11-04 22:06:10 +00:00
Lluís Ariñoandmorluto
c6503edfc4
* ci: pin GitHub Actions to full commit SHAs Replace every third-party `uses: owner/repo@vN` reference in .github/workflows with the 40-character commit SHA that the tag currently resolves to, keeping the exact release as a trailing comment. Each pin was checked with `git ls-remote --tags`: the floating major tag and the commented release dereference to the same commit. Local reusable workflows are unchanged. Re-pin reactivecircus/android-emulator-runner from the SHA of the annotated `v2` tag object (4c44018e) to the commit it points to (a421e438, v2.38.0); Actions resolves both, but only the commit SHA is an immutable reference that tooling can compare with the release. Update the Windows Ghidra workflow trust-boundary test to require SHA-pinned setup-node and upload-artifact references instead of the previous floating tags. Validation: actionlint v1.7.7 (-shellcheck= -pyflakes=, as in CI), YAML parse of all workflows, no remaining unpinned third-party `uses:`, and the workflow boundary/conformance tests. * style(ci): format action identity assertion Retain formatting edits produced before the user stopped validation. Source inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally. --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
51 lines
1.7 KiB
TypeScript
51 lines
1.7 KiB
TypeScript
import { readFile } from "node:fs/promises";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
import { parse } from "yaml";
|
|
|
|
describe("real Windows Ghidra workflow trust boundary", () => {
|
|
it("runs only default-branch code on the fixed self-hosted environment", async () => {
|
|
const workflow = parse(
|
|
await readFile(
|
|
new URL(
|
|
"../../../../.github/workflows/real-ghidra-windows.yml",
|
|
import.meta.url,
|
|
),
|
|
"utf8",
|
|
),
|
|
);
|
|
|
|
expect(workflow.on).toEqual({
|
|
repository_dispatch: { types: ["real-ghidra-windows"] },
|
|
});
|
|
expect(workflow.permissions).toEqual({ contents: "read" });
|
|
expect(workflow).toMatchObject({
|
|
jobs: {
|
|
verify: {
|
|
if: "github.ref == 'refs/heads/main'",
|
|
environment: "real-ghidra-windows",
|
|
"runs-on": expect.arrayContaining(["self-hosted", "Windows", "x64"]),
|
|
steps: expect.arrayContaining([
|
|
expect.objectContaining({
|
|
uses: expect.stringMatching(/^actions\/setup-node@[0-9a-f]{40}$/),
|
|
}),
|
|
expect.objectContaining({ run: "npm ci" }),
|
|
expect.objectContaining({
|
|
env: { REA_ANALYSIS_PROVIDER: "ghidra" },
|
|
run: "npm run verify:ghidra:windows | Tee-Object -FilePath windows-ghidra-proof.log",
|
|
}),
|
|
expect.objectContaining({
|
|
uses: expect.stringMatching(
|
|
/^actions\/upload-artifact@[0-9a-f]{40}$/,
|
|
),
|
|
with: expect.objectContaining({
|
|
path: expect.stringContaining("windows-ghidra-proof.log"),
|
|
}),
|
|
}),
|
|
]),
|
|
},
|
|
},
|
|
});
|
|
});
|
|
});
|