mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-04-28 03:49:31 +00:00
76bdaf2042
* fix: pin all GitHub Actions to commit SHAs and version-lock tools Addresses supply chain hardening findings from issue #2982: - Pin all 6 GitHub Actions to full commit SHAs with version comments: - actions/checkout@v4 → SHA 34e1148... - oven-sh/setup-bun@v2 → SHA 0c5077e... - actions/github-script@v7 → SHA f28e40c... - docker/login-action@v3 → SHA c94ce9f... - docker/build-push-action@v6 → SHA 10e90e3... - hashicorp/setup-packer@main → SHA c3d53c5... (v3.2.0) - Pin Packer version: latest → 1.15.0 (in packer-snapshots.yml) - Pin bun version: latest → 1.3.11 (in agent-tarballs.yml) - Pin shellcheck: replace apt-get (no version) with pinned download of v0.10.0 from GitHub releases with SHA256 integrity check These changes eliminate the primary LiteLLM-style attack vector: a compromised action maintainer can no longer force-push malicious code to an existing tag and have it run in CI. Fixes #2982 Agent: issue-fixer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: exclude import aliases from no-type-assertion lint rule The `JsNamedImportSpecifier` exclusion prevents `import { foo as bar }` patterns from being flagged as type assertions. Previously, any `as` keyword in import/export statements triggered the ban because the GritQL pattern `$value as $type` matched import specifiers as well as actual TypeScript type assertions. This also removes the `as _foo` import aliases in the script-failure-guidance test file (replaced with direct imports + distinctly-named wrapper functions) which were the original manifestation of this bug. All 1944 tests pass. Biome check clean across 169 files. Agent: issue-fixer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
90 lines
2.9 KiB
YAML
90 lines
2.9 KiB
YAML
name: CLI Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'packages/cli/src/**'
|
|
- 'packages/cli/package.json'
|
|
- 'packages/cli/bun.lock'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: cli-release
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
name: Build and release CLI
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Setup Bun
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
|
|
- name: Install dependencies and build
|
|
working-directory: packages/cli
|
|
run: |
|
|
bun install
|
|
bun run build
|
|
|
|
- name: Build cloud bundles
|
|
run: bun run packages/cli/build-clouds.ts
|
|
|
|
- name: Get version
|
|
id: version
|
|
working-directory: packages/cli
|
|
run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create version file
|
|
working-directory: packages/cli
|
|
run: jq -r .version package.json > version
|
|
|
|
- name: Update cli-latest release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# Create release if it doesn't exist, then upload assets with --clobber
|
|
# to atomically replace files without a delete→create race window
|
|
gh release create cli-latest \
|
|
--title "CLI v${{ steps.version.outputs.version }}" \
|
|
--notes "Pre-built CLI binary (auto-updated on every push to main).
|
|
|
|
This release is used as a fallback by \`install.sh\` when the local build fails (e.g. Termux proot).
|
|
The \`version\` file is used by the CLI's auto-update check.
|
|
|
|
**Version:** ${{ steps.version.outputs.version }}
|
|
**Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
--prerelease 2>/dev/null || true
|
|
|
|
gh release upload cli-latest \
|
|
packages/cli/cli.js \
|
|
packages/cli/version \
|
|
--clobber
|
|
|
|
- name: Upload cloud bundles
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# Upload each cloud bundle, creating the release if needed.
|
|
# Uses --clobber to atomically replace assets (no delete→create race).
|
|
for bundle in packages/cli/*.js; do
|
|
name=$(basename "$bundle" .js)
|
|
[[ "$name" == "cli" ]] && continue # skip cli.js, already uploaded above
|
|
|
|
gh release create "${name}-latest" \
|
|
--title "${name} bundle v${{ steps.version.outputs.version }}" \
|
|
--notes "Pre-built ${name} cloud provider bundle.
|
|
|
|
Downloaded by \`sh/${name}/*.sh\` shims for \`bash <(curl ...)\` execution.
|
|
|
|
**Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
--prerelease 2>/dev/null || true
|
|
|
|
gh release upload "${name}-latest" "$bundle" --clobber
|
|
done
|