mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-07 13:13:05 -05:00
Isaac ConnorandClaude Opus 5.5
ad5dbaf974
The package workflows' publish steps ran easingthemes/ssh-deploy@main with the zmrepo SSH key in its environment, and imported the package signing key with crazy-max/ghaction-import-gpg@v7. A branch or tag is resolved when the workflow runs, so whoever could move it upstream could run code with those keys on our next push to master or release-1.38, and publish packages to the apt and rpm repositories. Pin each `uses:` to the commit its ref names today, with the ref as a comment so dependabot keeps updating them. ssh-deploy is pinned to v6.0.1, which main differs from only in release metadata. GitHub's own actions are pinned too. utils/check-pinned-actions.py and the CI Pinned Actions workflow fail when a workflow uses an action by anything but a full commit SHA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
797 B
YAML
32 lines
797 B
YAML
name: CI JS Tests
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- '*'
|
|
pull_request:
|
|
branches: [ master ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
js-tests:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
# The tests require only node builtins (assert, fs, path, vm) plus files
|
|
# from web/js, so there is nothing to install and no submodule to fetch.
|
|
- name: Run the JavaScript tests
|
|
run: |
|
|
node --version
|
|
failed=0
|
|
for t in tests/js/*.test.js; do
|
|
echo "--- $t"
|
|
# Run every file even after one fails: a single CI run should report
|
|
# all the broken tests, not just the first.
|
|
node "$t" || failed=1
|
|
done
|
|
exit $failed
|