-
Notifications
You must be signed in to change notification settings - Fork 0
init #4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: FortiShield-patch-1
Are you sure you want to change the base?
init #4
Changes from all commits
093995a
555174e
0af313a
cebda7f
8497b5b
4fea716
2cbee85
1acfcca
40575c4
2676dac
74b9a70
742bd59
63d27b9
32de056
09f17af
7acb63c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: Publish Package to NPM | ||
|
|
||
| on: | ||
| release: | ||
| types: [published] | ||
|
|
||
| jobs: | ||
| publish: | ||
| name: Publish | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Setup node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: 'npm' | ||
| registry-url: "https://registry.npmjs.org" | ||
|
Comment on lines
+18
to
+20
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainVerify Node.js compatibility with package requirements. The workflow uses Node.js 20, but the package.json's engines field excludes Node.js 20. Ensure these are aligned to avoid build issues. Either update the package.json engines field to include Node.js 20 (as mentioned in my previous comment) or update this workflow to use a supported Node.js version. Below is a shell script you can run to inspect the Node.js version (the "engines" field) specified in your package.json file. This will help verify whether there’s a mismatch with the workflow’s usage of Node.js 20: Action Required: Align Node.js Versions
🏁 Script executed: #!/bin/bash
# Check if package.json exists and display its "engines" field.
if [ -f package.json ]; then
echo "package.json found. Current Node.js engine specification:"
jq '.engines' package.json || echo "Unable to parse the engines field."
else
echo "package.json not found in the repository root."
fiLength of output: 226 Action Required: Align Node.js Versions The workflow at
|
||
|
|
||
| - run: npm install | ||
| - run: npm run build | ||
|
|
||
| - name: Publish package | ||
| run: npm publish --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_ACCESS_TOKEN }} | ||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -4,15 +4,6 @@ | |||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| At HTTPSnippet, we take security issues very seriously. If you believe you have found a security vulnerability in our project, we encourage you to disclose it responsibly. Please report any potential security vulnerabilities to us by sending an email to [vulnerability@konghq.com](mailto:vulnerability@konghq.com). | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| ## How to Report | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| 1. **Do not publicly disclose the vulnerability**: Please do not create a GitHub issue or post the vulnerability on public forums. Instead, contact us directly at [vulnerability@konghq.com](mailto:vulnerability@konghq.com). | ||||||||||||||||||||||||||
| 1. **Provide detailed information**: When reporting a vulnerability, please include as much information as possible to help us understand and reproduce the issue. This may include: | ||||||||||||||||||||||||||
| - Description of the vulnerability | ||||||||||||||||||||||||||
| - Steps to reproduce the issue | ||||||||||||||||||||||||||
| - Potential impact | ||||||||||||||||||||||||||
| - Any relevant logs or screenshots | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| ## What to Expect | ||||||||||||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. suggestion: Consider adding back guidance on how to report vulnerabilities. While the contact email is provided, the removed section "How to Report" contained valuable information about what details to include in a report. This could help users submit more effective reports. Perhaps a condensed version of the old section could be included.
Suggested change
|
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 48 hours. | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Update GitHub Actions checkout version.
The checkout action version is outdated. GitHub recommends using the latest versions of actions for better compatibility and security.
📝 Committable suggestion
🧰 Tools
🪛 actionlint (1.7.4)
13-13: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)