Skip to content

Commit 0eba3f1

Browse files
jdaltonjdalton
committed
chore(ci): replace pnpm/action-setup with socket-registry/setup, update SHAs
Replace pnpm/action-setup with SocketDev/socket-registry setup action which installs pnpm (native binary, checksum-verified), sfw-free with shims for all supported ecosystems, and Node.js. Remove cache: pnpm from actions/setup-node to eliminate cache-poisoning vectors flagged by zizmor. Update all socket-registry action SHAs to latest post-cascade main.
1 parent 04c42a2 commit 0eba3f1

File tree

3 files changed

+30
-46
lines changed

3 files changed

+30
-46
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 16 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -72,15 +72,13 @@ jobs:
7272
with:
7373
persist-credentials: false
7474

75-
- name: Setup pnpm
76-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
75+
- name: Setup pnpm and sfw
76+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
7777

7878
- name: Setup Node.js
79-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
79+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
8080
with:
8181
node-version-file: .node-version
82-
cache: 'pnpm'
83-
cache-dependency-path: 'pnpm-lock.yaml'
8482

8583
- name: Create stub packages
8684
run: |
@@ -119,7 +117,7 @@ jobs:
119117
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
120118
CODE
121119
122-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
120+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
123121

124122
- name: Run lint
125123
shell: bash
@@ -139,15 +137,13 @@ jobs:
139137
with:
140138
persist-credentials: false
141139

142-
- name: Setup pnpm
143-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
140+
- name: Setup pnpm and sfw
141+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
144142

145143
- name: Setup Node.js
146-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
144+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
147145
with:
148146
node-version-file: .node-version
149-
cache: 'pnpm'
150-
cache-dependency-path: 'pnpm-lock.yaml'
151147

152148
- name: Create stub packages
153149
run: |
@@ -186,7 +182,7 @@ jobs:
186182
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
187183
CODE
188184
189-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
185+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
190186

191187
- name: Run type check
192188
shell: bash
@@ -213,15 +209,13 @@ jobs:
213209
with:
214210
persist-credentials: false
215211

216-
- name: Setup pnpm
217-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
212+
- name: Setup pnpm and sfw
213+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
218214

219215
- name: Setup Node.js
220-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
216+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
221217
with:
222218
node-version: ${{ matrix.node-version }}
223-
cache: 'pnpm'
224-
cache-dependency-path: 'pnpm-lock.yaml'
225219

226220
- name: Create stub packages
227221
run: |
@@ -260,7 +254,7 @@ jobs:
260254
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
261255
CODE
262256
263-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
257+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
264258

265259
- name: Build CLI
266260
working-directory: packages/cli
@@ -296,15 +290,13 @@ jobs:
296290
with:
297291
persist-credentials: false
298292

299-
- name: Setup pnpm
300-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
293+
- name: Setup pnpm and sfw
294+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
301295

302296
- name: Setup Node.js
303-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
297+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
304298
with:
305299
node-version: ${{ matrix.node-version }}
306-
cache: 'pnpm'
307-
cache-dependency-path: 'pnpm-lock.yaml'
308300

309301
- name: Create stub packages
310302
run: |
@@ -343,7 +335,7 @@ jobs:
343335
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
344336
CODE
345337
346-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
338+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
347339

348340
- name: Build CLI
349341
working-directory: packages/cli

‎.github/workflows/provenance.yml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,10 @@ jobs:
5454
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
5555
with:
5656
node-version-file: .node-version
57-
cache: 'pnpm'
58-
cache-dependency-path: 'pnpm-lock.yaml'
5957

60-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
58+
- uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
6159

62-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
60+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
6361

6462
- name: Build CLI
6563
shell: bash
@@ -100,13 +98,11 @@ jobs:
10098
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
10199
with:
102100
node-version-file: .node-version
103-
cache: 'pnpm'
104-
cache-dependency-path: 'pnpm-lock.yaml'
105101
registry-url: 'https://registry.npmjs.org'
106102

107-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
103+
- uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
108104

109-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
105+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
110106

111107
- name: Download CLI bundle
112108
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -156,13 +152,11 @@ jobs:
156152
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
157153
with:
158154
node-version-file: .node-version
159-
cache: 'pnpm'
160-
cache-dependency-path: 'pnpm-lock.yaml'
161155
registry-url: 'https://registry.npmjs.org'
162156

163-
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
157+
- uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
164158

165-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
159+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
166160

167161
# Get versions for lock-stepped and independent packages.
168162
- name: Get versions

‎.github/workflows/weekly-update.yml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,15 @@ jobs:
2929
with:
3030
persist-credentials: false
3131

32-
- name: Setup pnpm
33-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
32+
- name: Setup pnpm and sfw
33+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
3434

3535
- name: Setup Node.js
3636
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3737
with:
3838
node-version-file: .node-version
39-
cache: 'pnpm'
4039

41-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
40+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
4241

4342
- name: Check for npm updates
4443
id: check
@@ -68,16 +67,15 @@ jobs:
6867
fetch-depth: 0
6968
persist-credentials: false
7069

71-
- name: Setup pnpm
72-
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
70+
- name: Setup pnpm and sfw
71+
uses: SocketDev/socket-registry/.github/actions/setup@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
7372

7473
- name: Setup Node.js
7574
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
7675
with:
7776
node-version-file: .node-version
78-
cache: 'pnpm'
7977

80-
- uses: SocketDev/socket-registry/.github/actions/install@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
78+
- uses: SocketDev/socket-registry/.github/actions/install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
8179

8280
- name: Create update branch
8381
id: branch
@@ -89,7 +87,7 @@ jobs:
8987
git checkout -b "$BRANCH_NAME"
9088
echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
9189
92-
- uses: SocketDev/socket-registry/.github/actions/setup-git-signing@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
90+
- uses: SocketDev/socket-registry/.github/actions/setup-git-signing@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
9391
with:
9492
gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
9593

@@ -316,7 +314,7 @@ jobs:
316314
test.log
317315
retention-days: 7
318316

319-
- uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@ec0af5ed4601f2bca8c042b290135c30854648d9 # main
317+
- uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
320318
if: always()
321319

322320
notify:

0 commit comments

Comments
 (0)