mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-15 14:08:49 +00:00
Thibaud-Vdb
7c8f38774b
Version tags are movable pointers: whoever controls an action's repo can re-point them, and the previous commit's CVE is the proof it happens in practice, to this very repository's dependency set. These workflows hold real credentials: release.yml publishes the whole lucide npm family with OIDC trusted publishing, ci.yml creates the GitHub releases, and the comment and review workflows carry pull-request write tokens. Pinning by full commit SHA makes the reviewed code the code that runs. Every pin keeps a version comment, resolved from the upstream repo and cross-checked against its release tag (softprops v1 has no patch tag, the comment names the floating tag it replaced). Dependabot understands SHA pins and keeps bumping them with the comment in sync; the repo has no dependabot.yml yet, adding one with the github-actions ecosystem is a one-block follow-up.
47 lines
1.4 KiB
YAML
47 lines
1.4 KiB
YAML
name: Pull request icon preview
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'icons/*.svg'
|
|
|
|
jobs:
|
|
generate-changed-icons-comment:
|
|
name: Generate Changed Icons Comment
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Get changed files
|
|
id: changed-files
|
|
uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
|
|
with:
|
|
files: icons/*.svg
|
|
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
- name: Install svgson for code preview (safer and faster than installing all deps)
|
|
run: npm install svgson@5.3.1 --force
|
|
|
|
- name: Save PR number
|
|
run: |
|
|
mkdir -p ./pr
|
|
echo ${{ github.event.number }} > ./pr/NR
|
|
|
|
- name: Generate comment markup
|
|
run: node ./scripts/generateChangedIconsCommentMarkup.mts >> ./pr/comment-markup.md
|
|
id: comment-markup
|
|
env:
|
|
CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
|
|
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: pr_number
|
|
path: pr/
|