🛠️ Build Dependabot updates #298
Conversation
All of our TypeScript builds have failed in this project because we check to see if the `dist/` directory matches what is in the pull request. Dependabot will open a pull request with changes to the manifest/lock files, but it won't build the dependencies. By building them and committing, we should be able to pass the check we're enforcing. Note: I'm using `[dependabot skip]` in the commit message as it will allow Dependabot to rebase/recreate changes. Without that, the PR will be left open (and new changes will not be proposed).
|
The issue here is that it runs arbitrary, unreviewed code in a trusted context (with GH tokens that have escalated permissions). For this to be safe, it needs to be split into multiple jobs. Anything running arbitrary code needs to have restricted permissions (e.g. no write), and that job can save the updated output as an artifact that a dependent job can download and then push, so long as the dependent job doesn't execute any code from the dependencies in the updated |
The commit stage requires access to GITHUB_TOKEN, which has elevated permissions. `npm run build` has the potential to run scripts that execute arbitrary code, so we need to ensure that step does not have access to GITHUB_TOKEN.
`npm run all` ran tests and linting. That behavior is fine, but a failure in this step due to those concerns would be misleading.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@segiddins Can you take another look? I've split the workflows to guard ensure |
Co-authored-by: Samuel Giddins <segiddins@segiddins.me>
|
@segiddins @colby-swandale I don't have merge rights in this repo. Could one of you take care of that? 🙇 |
3 participants
All of our TypeScript builds have failed in this project because we check to see if the
dist/directory matches what is in the pull request. Dependabot will open a pull request with changes to the manifest/lock files, but it won't build the dependencies. By building them and committing, we should be able to pass the check we're enforcing.Note: I'm using
[dependabot skip]in the commit message as it will allow Dependabot to rebase/recreate changes. Without that, the PR will be left open (and new changes will not be proposed).