mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 08:29:51 +00:00
SatoshiQaziMuhammed
909dacd1af
* chore(deps): move vulnerable dependencies to patched versions Direct dev dependencies: vite ^5.4.1 -> ^6.4.3 (5.x has no patched release for the fs.deny bypass and launch-editor advisories; also lifts esbuild from 0.21.5 to 0.25.12), vitest and @vitest/coverage-v8 -> ^4.1.11, postcss -> ^8.5.23. Transitive packages refreshed within their existing ranges: brace-expansion, js-yaml, baseline-browser-mapping, qs, @humanfs/node, browserslist, postcss-selector-parser, nanoid, form-data, @babel/core, picomatch. Overrides with a floor at the patched version where a parent pins an old release: axios ^1.20.0 (tronweb pins 1.15.0) and ws ^8.21.0 (ethers pins 8.17.1). * fix(security): address open code scanning findings - auto-merge: pass workflow_run.head_branch through env instead of interpolating it into the shell script (code injection). - ci, deploy, code-quality: restrict GITHUB_TOKEN to contents: read. - telegram-bot: return a generic error body on failure; the error stays in the function log instead of being echoed to the caller. - p2p-e2e-test.py: stop printing a prefix of the service-role key.
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
name: Auto Merge
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["CI"]
|
|
types: [completed]
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
if: >
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'pull_request'
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Find and merge master → main PR
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# Passed through the environment, never interpolated into the script:
|
|
# the branch name is chosen by whoever opened the PR.
|
|
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
|
run: |
|
|
echo "Workflow ran on branch: $HEAD_BRANCH"
|
|
|
|
if [ "$HEAD_BRANCH" != "master" ]; then
|
|
echo "Not a master branch PR, skipping"
|
|
exit 0
|
|
fi
|
|
|
|
PR_NUMBER=$(gh pr list \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--base main \
|
|
--head master \
|
|
--state open \
|
|
--json number \
|
|
--jq '.[0].number')
|
|
|
|
if [ -z "$PR_NUMBER" ]; then
|
|
echo "No open PR from master to main found, skipping"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Merging PR #$PR_NUMBER"
|
|
gh pr merge "$PR_NUMBER" \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--merge \
|
|
--delete-branch=false
|