Skip to content

Add GitHub workflow which verifies that dist/index.js is up to date #698

@Marcono1234

Description

@Marcono1234

Problem

It seems currently there is no GitHub workflow which verifies that dist/index.js is up to date, this is problematic because:

  • it could lead to a stale version of the action being released by accident
  • a malicious user could try to inject additional code in dist/index.js, and hope that it is overlooked during pull request review

Related:

Potential solution

Could you please either uncomment this step in the main.yml workflow again:

# - name: "check for uncommitted changes"
# # Ensure no changes, but ignore node_modules dir since dev/fresh ci deps installed.
# run: |
# git diff --exit-code --stat -- . ':!node_modules' \
# || (echo "##[error] found changed files after build. please 'npm run build && npm run fmt'" \
# "and check in all changes" \
# && exit 1)

(I think that should work as check to verify that dist/index.js is up to date)

Or use a dedicated workflow, for example https://github.com/actions/typescript-action/blob/main/.github/workflows/check-dist.yml (with build steps adjusted), and remove the commented-out step from main.yml mentioned above.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions