Repository navigation
fix: pin GitHub Actions to SHA in asset-size workflow - #6
Merged
Merged
Conversation
Pin external actions to commit SHAs instead of tags to mitigate supply chain attacks where tags could be moved to malicious commits. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Upgrade actions/checkout, actions/setup-node, and actions/cache from deprecated v3 to v4 to fix CI failures, with SHA pinning for supply chain security. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Upgrade to actions/checkout@v6, actions/setup-node@v6, and actions/cache@v5 to resolve Node.js 20 deprecation warnings. Previous v4 versions will stop working after June 2, 2026. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove EOL Node.js versions (10.x-17.x, 19.x) from test matrix and add 22.x. actions/setup-node@v6 no longer supports these old versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove manual npm cache directory creation and actions/cache usage which conflicts with setup-node v6's automatic caching. Use setup-node's built-in cache: 'npm' instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove macOS from test matrix due to Puppeteer timeout issue (grunt-contrib-jasmine uses deprecated puppeteer@19.x headless mode) - Add --ignoreConfig flag to tsc command to fix TS5112 error with TypeScript 5.x when tsconfig.json is present Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use tsconfig.json for TypeScript compilation so that type definitions (node, mocha) are properly loaded. The --noEmit flag ensures no output files are generated, matching the original intent of type-checking only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Override tsconfig.json's target=ES5 (deprecated in TS 6.0) with --target es2018 on the command line to avoid TS5107 error with latest TypeScript. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use --ignoreConfig to avoid TS5112 conflict with tsconfig.json, and --types node to provide Node.js type definitions needed by index.d.ts (stream, NodeJS namespace, etc.). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
linhmtran168
reviewed
Apr 2, 2026
Add Node.js 24 (current active, LTS from October 2025) to the test matrix for broader compatibility coverage. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
linhmtran168
approved these changes
Apr 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub Actionsのサプライチェーン攻撃対策として、外部Actionをタグ指定からSHA固定に変更し、合わせて非推奨バージョンを最新版にアップグレードしました。
社内セキュリティガイドライン (GitHub ActionsでSHA固定する)
SHA固定 + バージョンアップグレード
actions/checkout→ v6 (SHA固定)actions/setup-node→ v6 (SHA固定)actions/cache→ 削除（setup-node v6のビルトインキャッシュcache: 'npm'に移行）chrysanthos/simple-asset-size-reporter@1.0.2→ SHA固定CI安定化
grunt-contrib-jasmineが依存するpuppeteer@19.xの古いHeadlessモードがmacOSランナーでタイムアウトするためtsc index.d.ts --ignoreConfig --types nodeに変更し、TS 5.x系のTS5112エラーを回避Test plan
🤖 Generated with Claude Code