Skip to content

chore: add security analysis workflow #1441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Boshen wants to merge 4 commits into
base: main
Choose a base branch
from
Open

chore: add security analysis workflow #1441

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
57d0ad7
chore: add security analysis workflow
Boshen Apr 22, 2026
8b4bb59
chore: use checkout action in workflows
Boshen Apr 22, 2026
dbfd860
chore: fix security workflow findings
Boshen Apr 22, 2026
f9d1d3d
chore: format security workflow
Boshen Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 30 additions & 10 deletions .github/actions/build-upstream/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,15 @@ runs:
- name: Compute NAPI binding cache key
id: cache-key
shell: bash
env:
BUILD_TARGET: ${{ inputs.target }}
RELEASE_BUILD_VALUE: ${{ env.RELEASE_BUILD }}
DEBUG_VALUE: ${{ env.DEBUG }}
VERSION_VALUE: ${{ env.VERSION }}
NPM_TAG_VALUE: ${{ env.NPM_TAG }}
CACHE_HASH: ${{ hashFiles('packages/tools/.upstream-versions.json', 'Cargo.lock', 'crates/**/*.rs', 'crates/*/Cargo.toml', 'packages/cli/binding/**/*.rs', 'packages/cli/binding/Cargo.toml', 'Cargo.toml', '.cargo/config.toml', 'packages/cli/package.json', 'packages/cli/build.ts', 'packages/cli/tsdown.config.ts') }}
run: |
echo "key=napi-binding-v3-${{ inputs.target }}-${{ env.RELEASE_BUILD }}-${{ env.DEBUG }}-${{ env.VERSION }}-${{ env.NPM_TAG }}-${{ hashFiles('packages/tools/.upstream-versions.json', 'Cargo.lock', 'crates/**/*.rs', 'crates/*/Cargo.toml', 'packages/cli/binding/**/*.rs', 'packages/cli/binding/Cargo.toml', 'Cargo.toml', '.cargo/config.toml', 'packages/cli/package.json', 'packages/cli/build.ts', 'packages/cli/tsdown.config.ts') }}" >> $GITHUB_OUTPUT
echo "key=napi-binding-v3-${BUILD_TARGET}-${RELEASE_BUILD_VALUE}-${DEBUG_VALUE}-${VERSION_VALUE}-${NPM_TAG_VALUE}-${CACHE_HASH}" >> "$GITHUB_OUTPUT"

# Resolve the Rust target directory (CARGO_TARGET_DIR from setup-rust, or default "target")
- name: Resolve Rust target directory
Expand Down Expand Up @@ -70,7 +77,9 @@ runs:
- name: Add musl Rust target
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'musl')
shell: bash
run: rustup target add ${{ inputs.target }}
env:
BUILD_TARGET: ${{ inputs.target }}
run: rustup target add "$BUILD_TARGET"

- name: Setup zig (musl)
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'musl')
Expand All @@ -90,8 +99,9 @@ runs:
shell: bash
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'linux') && !contains(inputs.target, 'musl')
run: |
pnpm --filter=vite-plus build-native --target ${{ inputs.target }} --use-napi-cross
pnpm --filter=vite-plus build-native --target "$BUILD_TARGET" --use-napi-cross
env:
BUILD_TARGET: ${{ inputs.target }}
TARGET_CC: clang
TARGET_CFLAGS: ${{ contains(inputs.target, 'aarch64') && '-D_BSD_SOURCE' || '' }}
DEBUG: napi:*
Expand All @@ -100,8 +110,9 @@ runs:
shell: bash
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'musl')
run: |
pnpm --filter=vite-plus build-native --target ${{ inputs.target }} -x
pnpm --filter=vite-plus build-native --target "$BUILD_TARGET" -x
env:
BUILD_TARGET: ${{ inputs.target }}
TARGET_CC: clang
TARGET_CFLAGS: ${{ contains(inputs.target, 'aarch64') && '-D_BSD_SOURCE' || '' }}
DEBUG: napi:*
Expand All @@ -110,16 +121,18 @@ runs:
shell: bash
if: steps.cache-restore.outputs.cache-hit != 'true' && !contains(inputs.target, 'linux')
run: |
pnpm --filter=vite-plus build-native --target ${{ inputs.target }}
pnpm --filter=vite-plus build-native --target "$BUILD_TARGET"
env:
BUILD_TARGET: ${{ inputs.target }}
DEBUG: napi:*

- name: Build Rust CLI binary (Linux gnu)
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'linux') && !contains(inputs.target, 'musl')
shell: bash
run: |
pnpm exec napi build --use-napi-cross --target ${{ inputs.target }} --release -p vite_global_cli
pnpm exec napi build --use-napi-cross --target "$BUILD_TARGET" --release -p vite_global_cli
env:
BUILD_TARGET: ${{ inputs.target }}
TARGET_CC: clang
TARGET_CFLAGS: ${{ contains(inputs.target, 'aarch64') && '-D_BSD_SOURCE' || '' }}
DEBUG: napi:*
Expand All @@ -128,26 +141,33 @@ runs:
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'musl')
shell: bash
run: |
pnpm exec napi build -x --target ${{ inputs.target }} --release -p vite_global_cli
pnpm exec napi build -x --target "$BUILD_TARGET" --release -p vite_global_cli
env:
BUILD_TARGET: ${{ inputs.target }}
TARGET_CC: clang
TARGET_CFLAGS: ${{ contains(inputs.target, 'aarch64') && '-D_BSD_SOURCE' || '' }}
DEBUG: napi:*

- name: Build Rust CLI binary (non-Linux targets)
if: steps.cache-restore.outputs.cache-hit != 'true' && !contains(inputs.target, 'linux')
shell: bash
run: cargo build --release --target ${{ inputs.target }} -p vite_global_cli
env:
BUILD_TARGET: ${{ inputs.target }}
run: cargo build --release --target "$BUILD_TARGET" -p vite_global_cli

- name: Build trampoline shim binary (Windows only)
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'windows')
shell: bash
run: cargo build --release --target ${{ inputs.target }} -p vite_trampoline
env:
BUILD_TARGET: ${{ inputs.target }}
run: cargo build --release --target "$BUILD_TARGET" -p vite_trampoline

- name: Build installer binary (Windows only)
if: steps.cache-restore.outputs.cache-hit != 'true' && contains(inputs.target, 'windows')
shell: bash
run: cargo build --release --target ${{ inputs.target }} -p vite_installer
env:
BUILD_TARGET: ${{ inputs.target }}
run: cargo build --release --target "$BUILD_TARGET" -p vite_installer

- name: Save NAPI binding cache
if: steps.cache-restore.outputs.cache-hit != 'true'
Expand Down
19 changes: 15 additions & 4 deletions .github/actions/clone/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,22 +26,31 @@ runs:
shell: bash
id: ecosystem-ci-project-hash
if: ${{ inputs.ecosystem-ci-project != '' }}
env:
ECOSYSTEM_CI_PROJECT: ${{ inputs.ecosystem-ci-project }}
run: |
node -e "console.log('ECOSYSTEM_CI_PROJECT_HASH=' + require('./ecosystem-ci/repo.json')['${{ inputs.ecosystem-ci-project }}'].hash)" >> $GITHUB_OUTPUT
node -e "console.log('ECOSYSTEM_CI_PROJECT_REPOSITORY=' + require('./ecosystem-ci/repo.json')['${{ inputs.ecosystem-ci-project }}'].repository.replace('https://github.com/', '').replace('.git', ''))" >> $GITHUB_OUTPUT
echo "ECOSYSTEM_CI_PROJECT_PATH=${{ runner.temp }}/vite-plus-ecosystem-ci/${{ inputs.ecosystem-ci-project }}" >> $GITHUB_OUTPUT
node <<'EOF' >> "$GITHUB_OUTPUT"
const repos = require('./ecosystem-ci/repo.json');
const project = process.env.ECOSYSTEM_CI_PROJECT;
const repo = repos[project];
console.log(`ECOSYSTEM_CI_PROJECT_HASH=${repo.hash}`);
console.log(`ECOSYSTEM_CI_PROJECT_REPOSITORY=${repo.repository.replace('https://github.com/', '').replace('.git', '')}`);
EOF
echo "ECOSYSTEM_CI_PROJECT_PATH=${RUNNER_TEMP}/vite-plus-ecosystem-ci/${ECOSYSTEM_CI_PROJECT}" >> "$GITHUB_OUTPUT"

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: rolldown/rolldown
path: rolldown
ref: ${{ steps.upstream-versions.outputs.ROLLDOWN_HASH }}
persist-credentials: false

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: vitejs/vite
path: vite
ref: ${{ steps.upstream-versions.outputs.ROLLDOWN_VITE_HASH }}
persist-credentials: false

# Disable autocrlf to preserve LF line endings on Windows
# This prevents prettier/eslint from failing with "Delete ␍" errors
Expand All @@ -53,4 +62,6 @@ runs:
- name: Clone ecosystem ci project
if: ${{ inputs.ecosystem-ci-project != '' }}
shell: bash
run: npx tsx ecosystem-ci/clone.ts ${{ inputs.ecosystem-ci-project }}
env:
ECOSYSTEM_CI_PROJECT: ${{ inputs.ecosystem-ci-project }}
run: npx tsx ecosystem-ci/clone.ts "$ECOSYSTEM_CI_PROJECT"
7 changes: 5 additions & 2 deletions .github/actions/set-snapshot-version/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,12 @@ runs:
- name: Compute next patch version
id: version
shell: bash
env:
ACTION_PATH: ${{ github.action_path }}
NPM_TAG: ${{ inputs.npm_tag }}
run: |
git fetch --tags --quiet
npm install --prefix ${{ github.action_path }} semver > /dev/null 2>&1
VERSION_OUTPUT=$(node ${{ github.action_path }}/compute-version.mjs "${{ inputs.npm_tag }}")
npm install --prefix "$ACTION_PATH" semver > /dev/null 2>&1
VERSION_OUTPUT=$(node "$ACTION_PATH/compute-version.mjs" "$NPM_TAG")
echo "$VERSION_OUTPUT"
echo "$VERSION_OUTPUT" | tail -n 1 >> $GITHUB_OUTPUT
18 changes: 9 additions & 9 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
outputs:
code-changed: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
Expand All @@ -60,7 +60,7 @@ jobs:
contents: read
packages: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/download-rolldown-binaries
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -80,7 +80,7 @@ jobs:
target: aarch64-apple-darwin
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- name: Setup Dev Drive
Expand Down Expand Up @@ -133,7 +133,7 @@ jobs:
shell: sh {0}
run: apk add --no-cache bash curl git musl-dev gcc g++ python3 cmake make

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- name: Install rustup
Expand All @@ -159,7 +159,7 @@ jobs:
name: Lint
runs-on: namespace-profile-linux-x64-default
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
Expand Down Expand Up @@ -206,7 +206,7 @@ jobs:
target: x86_64-pc-windows-msvc
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- name: Setup Dev Drive
Expand Down Expand Up @@ -640,7 +640,7 @@ jobs:
shardTotal: 3
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- name: Setup Dev Drive
Expand Down Expand Up @@ -698,7 +698,7 @@ jobs:
- download-previous-rolldown-binaries
runs-on: namespace-profile-linux-x64-default
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
Expand Down Expand Up @@ -777,7 +777,7 @@ jobs:
github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'test: install-e2e')
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 100
persist-credentials: true
persist-credentials: false

- name: Run Claude Code
id: claude
Expand Down
50 changes: 0 additions & 50 deletions .github/workflows/deny.yml
View file
Open in desktop

This file was deleted.

8 changes: 4 additions & 4 deletions .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
outputs:
related-files-changed: ${{ steps.filter.outputs.related-files }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
Expand All @@ -55,7 +55,7 @@ jobs:
contents: read
packages: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/download-rolldown-binaries
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -77,7 +77,7 @@ jobs:
- os: windows-latest
target: x86_64-pc-windows-msvc
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

# Disable Windows Defender real-time scanning to speed up I/O-heavy builds (~30-50% faster)
Expand Down Expand Up @@ -337,7 +337,7 @@ jobs:
name: npmx.dev

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone
with:
ecosystem-ci-project: ${{ matrix.project.name }}
Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
persist-credentials: false
- uses: ./.github/actions/set-snapshot-version
if: ${{ inputs.version == '' }}
id: computed
Expand All @@ -44,7 +45,9 @@ jobs:

- name: Set final version
id: version
run: echo "version=${{ inputs.version || steps.computed.outputs.version }}" >> $GITHUB_OUTPUT
env:
VERSION: ${{ inputs.version || steps.computed.outputs.version }}
run: echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

build-rust:
runs-on: ${{ matrix.settings.os }}
Expand Down Expand Up @@ -74,7 +77,7 @@ jobs:
- target: aarch64-pc-windows-msvc
os: windows-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
- uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
Expand Down Expand Up @@ -188,7 +191,7 @@ jobs:
env:
VERSION: ${{ needs.prepare.outputs.version }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
- uses: ./.github/actions/clone

- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
Expand All @@ -198,7 +201,6 @@ jobs:
node-version-file: .node-version
package-manager-cache: false
registry-url: 'https://registry.npmjs.org'
cache: 'pnpm'

- name: Install dependencies
run: pnpm install
Expand Down
Loading
Loading