61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
name: F6.1 fix runtime dependencies
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'release/f6-1-presentation-ready'
|
|
paths:
|
|
- '.github/workflows/f6-1-fix-runtime-deps.yml'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
fix:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: release/f6-1-presentation-ready
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
|
|
- name: Pin patched runtime dependency resolutions
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
cd api-v3
|
|
npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
|
|
npm install --package-lock-only --ignore-scripts
|
|
npm audit --omit=dev --audit-level=high
|
|
cd ..
|
|
|
|
cd web-v2
|
|
npm pkg set dependencies.maplibre-gl=6.4.1
|
|
npm install --package-lock-only --ignore-scripts
|
|
npm audit --omit=dev --audit-level=high
|
|
cd ..
|
|
|
|
- name: Verify resolved patched versions
|
|
run: |
|
|
set -Eeuo pipefail
|
|
grep -Fq '"multer": "2.3.0"' api-v3/package-lock.json
|
|
grep -Fq '"qs": "6.16.0"' api-v3/package-lock.json
|
|
grep -Fq '"maplibre-gl": "6.4.1"' web-v2/package.json
|
|
grep -Fq '"node_modules/maplibre-gl"' web-v2/package-lock.json
|
|
grep -Fq '"version": "6.4.1"' web-v2/package-lock.json
|
|
|
|
- name: Commit patched dependency locks
|
|
run: |
|
|
set -Eeuo pipefail
|
|
rm .github/workflows/f6-1-fix-runtime-deps.yml
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
|
|
git diff --cached --check
|
|
git commit -m 'fix(security): patch runtime dependency advisories'
|
|
git push origin HEAD:release/f6-1-presentation-ready
|