mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-13 13:48:26 +00:00
Thibaud-Vdb
7c8f38774b
Version tags are movable pointers: whoever controls an action's repo can re-point them, and the previous commit's CVE is the proof it happens in practice, to this very repository's dependency set. These workflows hold real credentials: release.yml publishes the whole lucide npm family with OIDC trusted publishing, ci.yml creates the GitHub releases, and the comment and review workflows carry pull-request write tokens. Pinning by full commit SHA makes the reviewed code the code that runs. Every pin keeps a version comment, resolved from the upstream repo and cross-checked against its release tag (softprops v1 has no patch tag, the comment names the floating tag it replaced). Dependabot understands SHA pins and keeps bumping them with the comment in sync; the repo has no dependabot.yml yet, adding one with the github-actions ecosystem is a one-block follow-up.
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
name: Lucide Angular checks
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- packages/angular/**
|
|
- tools/build-icons/**
|
|
- pnpm-lock.yaml
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build
|
|
run: pnpm --filter @lucide/angular build
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Test
|
|
run: pnpm --filter @lucide/angular test
|