chore: split workflow wiring from generated source commit #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: apply-security-fix | |
| on: | |
| push: | |
| branches: | |
| - fix/security-transport-completion-marker | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: apply-security-fix-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| apply: | |
| if: github.actor != 'github-actions[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: fix/security-transport-completion-marker | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| - name: Apply source changes | |
| run: python3 .github/scripts/apply-security-fix.py | |
| - name: Keep workflow wiring and archive test script CI-only | |
| run: | | |
| git checkout -- .github/workflows/test.yml | |
| python3 - <<'PY' | |
| from pathlib import Path | |
| path = Path('package.json') | |
| content = path.read_text(encoding='utf-8') | |
| content = content.replace( | |
| ' "test:safe-zip": "bash scripts/test-safe-zip-file.sh",\n', | |
| '', | |
| ) | |
| path.write_text(content, encoding='utf-8') | |
| PY | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Restore package metadata changed by postinstall | |
| run: git checkout -- expo-module.config.json | |
| - name: Format generated JS changes | |
| run: bunx biome check --write src/utils.ts src/__tests__/utils.test.ts | |
| - name: Run JS tests | |
| run: bun test src/__tests__ | |
| - name: Run lint and type checks | |
| run: bun lint | |
| - name: Run archive safety regression test | |
| run: bash scripts/test-safe-zip-file.sh | |
| - name: Validate diff | |
| run: git diff --check | |
| - name: Commit generated fix | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add -A | |
| git commit -m "fix(security): block transport downgrade and forged completion markers" | |
| git push origin HEAD:fix/security-transport-completion-marker |