hashicc
5a302b0bcc
* chore: 🤖 remove packageManager field from package.json
* chore: 🤖 migrate yarn resolutions to pnpm overrides
* chore: 🤖 generate pnpm-lock.yml by using: pnpm import yarn.lock
* chore: 🤖 remove yarn.lock file
* chore: 🤖 migrate workspace configuration
* chore: 🤖 remove .yarn and .yarnrc.yml config
* chore: 🤖 update .copyright.hcl to ignore root pnpm files
* chore: 🤖 migrate husky pre-commit hook from yarn to pnpm
* chore: 🤖 migrate package.json scripts from yarn to pnpm
* chore: 🤖 update rose package.json & build to use explicit deps
* chore: 🤖 remove unused cp metadata.json command in pjson script
The cp metadata.json to dist was added in:
d19a251
The addons/rose/metadata.json no longer exists so it can't be copied
* chore: 🤖 migrate electron-app package.json scripts to pnpm
* chore: 🤖 create pnpm workspace for electron-app w/ hoisted deps
* chore: 🤖 migrate electron-app yarn lockfile to pnpm lockfile
Used "pnpm import yarn.lock"
* chore: 🤖 migrate electron-app overrides
node-gyp isn't needed since the fork is used via @electron/node-gyp
see: https://github.com/electron/node-gyp?tab=readme-ov-file#node-gyp---nodejs-native-addon-build-tool
* chore: 🤖 add trusted deps to be built to onlyBuiltDependencies
This is a pnpm feature that increases security. By defining these
dependencies they are being trusted to allow install hooks,
including postinstall. See:
https://pnpm.io/settings#onlybuiltdependencies
* chore: 🤖 add electron-app pnpm files to copyright header ignore
* chore: 🤖 remove yarn references from .*ignore files
* chore: 🤖 migrate --yarn to --pnpm for ember-cli-update.json
This isn't clearly documented but something that is supported
and can be found in other ember apps:
https://github.com/search?q=--pnpm+ember-cli-update.json&type=code
* chore: 🤖 migrate ci and related scripts to use pnpm
The cache is migrated to use the cache supported by
actions/setup-node@v4, an action we are already using. This is the
recommended way by pnpm:
https://pnpm.io/continuous-integration#github-actions
This commit also ensures that all github actions are using
consistent versions of actions/setup-node and pnpm/action-setup
* docs: ✏️ update documentation to use pnpm instead of yarn
* chore: 🤖 use explicit asciinema-player dependency
Because we override styles on asciinema-player we depend on their
styles. What might be a minor non-breaking change in their version could
(and did) break our style expectations in our overrides.
* chore: 🤖 run pnpm install and commit lockfile changes
* chore: 🤖 Remove ember-inflector from being overidden
https://github.com/hashicorp/boundary-ui/pull/2828#discussion_r2110380711
* chore: 🤖 remove highlight.js from pnpm overrides
https://github.com/hashicorp/boundary-ui/pull/2828#discussion_r2109847938
* chore: 🤖 remove additional unnecessary files from ignore files
* docs: ✏️ fix pnpm doc links
* chore: 🤖 use corepack to specify packageManager in package.json
* chore: 🤖 let pnpm action in ci use packageManager for version
https://github.com/pnpm/action-setup?tab=readme-ov-file#version
* docs: ✏️ fix broken pnpm website links
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
# For most projects, this workflow file will not need changing; you simply need
|
||
# to commit it to your repository.
|
||
#
|
||
# You may wish to alter this file to override the set of languages analyzed,
|
||
# or to provide custom queries or build logic.
|
||
name: "CodeQL"
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
pull_request:
|
||
# The branches below must be a subset of the branches above
|
||
branches: [main]
|
||
schedule:
|
||
- cron: '0 19 * * 4'
|
||
|
||
jobs:
|
||
analyze:
|
||
name: Analyze
|
||
runs-on: ${{ fromJSON(vars.RUNNER) }}
|
||
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
# Override automatic language detection by changing the below list
|
||
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
|
||
language: ['javascript']
|
||
# Learn more...
|
||
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
|
||
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
||
# Initializes the CodeQL tools for scanning.
|
||
- name: Initialize CodeQL
|
||
uses: github/codeql-action/init@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7
|
||
with:
|
||
languages: ${{ matrix.language }}
|
||
# If you wish to specify custom queries, you can do so here or in a config file.
|
||
# By default, queries listed here will override any specified in a config file.
|
||
# Prefix the list here with "+" to use these queries and those in the config file.
|
||
# queries: ./path/to/local/query, your-org/your-repo/queries@main
|
||
|
||
# ℹ️ Command-line programs to run using the OS shell.
|
||
# 📚 https://git.io/JvXDl
|
||
|
||
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
|
||
# and modify them (or add more) to build your code if your project
|
||
# uses a compiled language
|
||
|
||
#- run: |
|
||
# make bootstrap
|
||
# make release
|
||
|
||
- name: Perform CodeQL Analysis
|
||
uses: github/codeql-action/analyze@70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22 # codeql-bundle-v2.20.7
|