Pin cached Gitea workflow actions

2026-09-04 03:43:31 -04:00
parent 4104b921f2
commit 485cb08b71
8 changed files with 37 additions and 10 deletions
@@ -227,6 +227,8 @@ for (const path of [
  '.gitea/workflows/production-blog.yml',
 ]) {
  const text = await readFile(path, 'utf8');
+  assert(text.includes('uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4'), `${path} must pin checkout v4 to its reviewed commit.`);
+  assert(text.includes('uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4'), `${path} must pin setup-node v4 to its reviewed commit.`);
  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
  assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install with quiet, cache-friendly npm options.`);
 }