inteligr8/alfresco-ng2-components
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-ng2-components.git synced 2025-09-24 14:31:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

[ACS-10100][Security] Remove npx usage from CI/CD and shell scripts to mitigate supply chain risks (#11201)

Browse Source
This commit is contained in:
dominikiwanekhyland
2025-09-16 13:52:56 +02:00
committed by GitHub
parent 4f2b5329c6
commit 1c8181fca8
3 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.github/workflows/release-branch.yml vendored
View File

@@ -58,8 +58,8 @@ jobs:
- name: install - name: install
run: | run: |
npm ci npm ci
nx run js-api:bundle npm run bundle:js-api
nx run cli:bundle npm run bundle:cli
- uses: ./.github/actions/upload-node-modules-and-artifacts - uses: ./.github/actions/upload-node-modules-and-artifacts
release-npm: release-npm:
@@ -95,15 +95,15 @@ jobs:
setMigrations(); setMigrations();
- name: Build libraries - name: Build libraries
run: | run: |
nx run-many --target=build --prod --skip-nx-cache npm run build:libs
nx run-many --target=build-schematics npm run build:schematics
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
name: release libraries GH registry name: release libraries GH registry
with: with:
node-version-file: '.nvmrc' node-version-file: '.nvmrc'
registry-url: 'https://npm.pkg.github.com' registry-url: 'https://npm.pkg.github.com'
scope: '@alfresco' scope: '@alfresco'
- run: nx run-many -t npm-publish --tag=branch || exit 1 - run: npm run publish -- --tag=branch || exit 1
env: env:
NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }} NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -112,7 +112,7 @@ jobs:
node-version-file: '.nvmrc' node-version-file: '.nvmrc'
registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}' registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
scope: '@alfresco' scope: '@alfresco'
- run: nx run-many -t npm-publish --tag=branch || exit 1 - run: npm run publish -- --tag=branch || exit 1
env: env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }} NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

12
.github/workflows/release.yml vendored
View File

@@ -65,8 +65,8 @@ jobs:
- name: install - name: install
run: | run: |
npm ci npm ci
nx run js-api:bundle npm run bundle:js-api
nx run cli:bundle npm run bundle:cli
- uses: ./.github/actions/upload-node-modules-and-artifacts - uses: ./.github/actions/upload-node-modules-and-artifacts
release-npm: release-npm:
@@ -106,15 +106,15 @@ jobs:
setMigrations(); setMigrations();
- name: build libraries - name: build libraries
run: | run: |
nx run-many -t build --prod --skip-nx-cache npm run build:libs
nx run-many -t build-schematics npm run build:schematics
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
name: release libraries GH registry name: release libraries GH registry
with: with:
node-version-file: '.nvmrc' node-version-file: '.nvmrc'
registry-url: 'https://npm.pkg.github.com' registry-url: 'https://npm.pkg.github.com'
scope: '@alfresco' scope: '@alfresco'
- run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1 - run: npm run publish -- --tag=$TAG_NPM || exit 1
env: env:
NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }} NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -123,7 +123,7 @@ jobs:
node-version-file: '.nvmrc' node-version-file: '.nvmrc'
registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}' registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
scope: '@alfresco' scope: '@alfresco'
- run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1 - run: npm run publish -- --tag=$TAG_NPM || exit 1
env: env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }} NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

3
package.json
View File

@@ -13,6 +13,9 @@
"lint:affected": "nx affected:lint", "lint:affected": "nx affected:lint",
"build:affected": "nx affected:build", "build:affected": "nx affected:build",
"affected:libs": "nx affected:libs", "affected:libs": "nx affected:libs",
"build:libs": "nx run-many -t build --prod --skip-nx-cache",
"build:schematics": "nx run-many -t build-schematics",
"publish": "nx run-many -t npm-publish",
"clean": "rimraf dist node_modules dist/libs" "clean": "rimraf dist node_modules dist/libs"
}, },
"repository": { "repository": {