37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
name: Caterium One-Time NPM Lock Refresh
|
|
on:
|
|
push:
|
|
branches: ["fix/npm-security-v1774"]
|
|
permissions:
|
|
contents: write
|
|
concurrency:
|
|
group: caterium-npm-lock-refresh-v1774
|
|
cancel-in-progress: false
|
|
jobs:
|
|
refresh:
|
|
if: ${{ !contains(github.event.head_commit.message, '[npm-lock-refresh]') }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: fix/npm-security-v1774
|
|
fetch-depth: 0
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
- run: npm install --package-lock-only
|
|
- run: npm audit --audit-level=high
|
|
- name: Commit refreshed lockfile
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
if git diff --quiet -- package-lock.json; then
|
|
echo "No lockfile change required"
|
|
exit 0
|
|
fi
|
|
git add package-lock.json
|
|
git commit -m "security: refresh npm lockfile [npm-lock-refresh]"
|
|
git push origin HEAD:fix/npm-security-v1774
|