mirror of
https://github.com/astral-sh/setup-uv.git
synced 2026-10-25 00:37:44 +00:00
zaniebotandzaniebot
f8c88970fc
CI installs the locked npm dependency tree without running lifecycle scripts, but it does not verify registry signatures or available provenance attestations. Run `npm audit signatures` after installation in both the test and checksum-update workflows, before `npm run all` executes dependency tooling. The check follows npm's registry-signature support and verifies attestations when present; it does not require every dependency to publish provenance. Related: astral-sh/ruff-action#402 adds the same signature and provenance verification. astral-sh/setup-uv#1026 separately hardens `npm` install defaults. Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
name: "Update known checksums"
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 4 * * *" # Run every day at 4am UTC
|
|
repository_dispatch:
|
|
types: [ pypi_release ]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-24.04-arm
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: true
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
- name: Update known checksums
|
|
id: update-known-checksums
|
|
run:
|
|
node dist/update-known-checksums/index.cjs
|
|
src/download/checksum/known-checksums.json
|
|
- name: Check for changes
|
|
id: changes-exist
|
|
run: |
|
|
git status --porcelain
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo "changes-exist=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changes-exist=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: Compile changes
|
|
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
|
|
run: |
|
|
npm ci --ignore-scripts
|
|
npm audit signatures
|
|
npm run all
|
|
- name: Create Pull Request
|
|
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
|
|
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
|
|
with:
|
|
commit-message: "chore: update known checksums"
|
|
title:
|
|
"chore: update known checksums for ${{
|
|
steps.update-known-checksums.outputs.latest-version }}"
|
|
body:
|
|
"chore: update known checksums for ${{
|
|
steps.update-known-checksums.outputs.latest-version }}"
|
|
base: main
|
|
labels: "automated-pr,update-known-checksums"
|
|
branch: update-known-checksums-pr
|
|
delete-branch: true
|