chore(deps): bump ruff from 0.15.13 to 0.16.1 in /.github #498
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pages Verify | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pages-verify-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify-pages-build: | |
| name: Verify Pages Build (No Publish) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Verify signing key consistency (repo + docs) | |
| run: ./scripts/ci/verify_signing_key_consistency.sh | |
| - name: Prepare advisory artifacts for pre-deploy checks | |
| run: | | |
| set -euo pipefail | |
| mkdir -p public/advisories | |
| cp advisories/feed.json public/advisories/feed.json | |
| if [ -f advisories/ghsa-without-cve.json ]; then | |
| cp advisories/ghsa-without-cve.json public/advisories/ghsa-without-cve.json | |
| fi | |
| - name: Generate ephemeral signing key for PR verification | |
| id: test_key | |
| run: | | |
| set -euo pipefail | |
| KEY_FILE=$(mktemp) | |
| openssl genpkey -algorithm Ed25519 -out "$KEY_FILE" | |
| { | |
| echo "private_key<<EOF" | |
| cat "$KEY_FILE" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| rm -f "$KEY_FILE" | |
| - name: Sign advisory feed and verify | |
| uses: ./.github/actions/sign-and-verify | |
| with: | |
| private_key: ${{ steps.test_key.outputs.private_key }} | |
| input_file: public/advisories/feed.json | |
| signature_file: public/advisories/feed.json.sig | |
| public_key_output: public/signing-public.pem | |
| - name: Sign provisional GHSA feed and verify | |
| if: hashFiles('public/advisories/ghsa-without-cve.json') != '' | |
| uses: ./.github/actions/sign-and-verify | |
| with: | |
| private_key: ${{ steps.test_key.outputs.private_key }} | |
| input_file: public/advisories/ghsa-without-cve.json | |
| signature_file: public/advisories/ghsa-without-cve.json.sig | |
| - name: Generate advisory checksums manifest | |
| run: node scripts/ci/advisory_pages_artifacts.mjs generate --public-dir public --repository "${{ github.repository }}" | |
| - name: Sign checksums and verify | |
| uses: ./.github/actions/sign-and-verify | |
| with: | |
| private_key: ${{ steps.test_key.outputs.private_key }} | |
| input_file: public/checksums.json | |
| signature_file: public/checksums.sig | |
| - name: Publish advisory compatibility aliases | |
| run: node scripts/ci/advisory_pages_artifacts.mjs publish-aliases --public-dir public | |
| - name: Simulate release compatibility mirror | |
| run: | | |
| node scripts/ci/advisory_pages_artifacts.mjs publish-release-mirror \ | |
| --public-dir public \ | |
| --mirror-dir public/releases/latest/download | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build site | |
| run: npm run build | |
| env: | |
| NODE_ENV: production | |
| - name: Sanity-check generated artifacts | |
| run: | | |
| set -euo pipefail | |
| test -f dist/index.html | |
| node scripts/ci/advisory_pages_artifacts.mjs verify-built --public-dir public --dist-dir dist | |
| - name: Smoke-test built advisory endpoints | |
| run: node scripts/ci/advisory_pages_artifacts.mjs smoke-http --dist-dir dist |