NHSO-0000: Security fixups. #1648
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: push | |
| jobs: | |
| build: | |
| name: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function | |
| - name: Install Python 3.13 | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: 3.13 | |
| - name: Update apt repositories | |
| run: sudo apt update | |
| - name: Install Java | |
| run: sudo apt-get install --yes default-jre default-jdk | |
| - name: Install node | |
| run: | | |
| wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add - | |
| curl -sL https://deb.nodesource.com/setup_24.x | sudo -E bash - | |
| sudo apt-get install -y nodejs | |
| - name: Upgrade python packaging tools | |
| run: python -m pip install --upgrade pip setuptools wheel | |
| - name: Install poetry | |
| run: 'pip install --only-binary :all: "poetry==2.4.1"' | |
| - name: Cache poetry packages | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.cache/pypoetry | |
| key: ${{ runner.os }}-build-cache-poetry-packages-${{ hashFiles('**/poetry.lock') }} | |
| - name: Cache node modules | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.npm | |
| key: ${{ runner.os }}-build-cache-npm-packages-${{ hashFiles('**/package-lock.json') }} | |
| - name: Install repo | |
| run: make install | |
| - name: Set SPEC_VERSION env var | |
| run: echo ::set-env name=SPEC_VERSION::$(poetry run python scripts/calculate_version.py) | |
| env: | |
| ACTIONS_ALLOW_UNSECURE_COMMANDS: true | |
| - name: Create release (master only) | |
| id: create-release | |
| if: github.ref == 'refs/heads/master' | |
| uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # V1.1.4 | |
| continue-on-error: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| tag_name: ${{ env.SPEC_VERSION }} | |
| release_name: ${{ env.SPEC_VERSION }} |