Skip to content

Use ESLint as a workflow, and lint (almost) everything #464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tracygardner merged 1 commit into from
Mar 24, 2026
Merged

Use ESLint as a workflow, and lint (almost) everything #464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/eslint.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
name: ESLint

on:
pull_request:

jobs:
eslint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
Comment on lines +10 to +11

@coderabbitaicoderabbitaiBotMar 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash# Verify whether workflow actions are pinned to commit SHAs# Expected: no matches after hardening.
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?:v\d+|v\d+\.\d+\.\d+|main|master)\s*$' .github/workflows

Repository: flipcomputing/flock

Length of output: 409

Pin GitHub Actions to commit SHAs to reduce supply-chain risk.

Lines 10-11 use mutable tags (@v4). Replace with full-length commit SHAs for deterministic and safer workflow execution.

🔐 Proposed hardening diff
- - uses: actions/checkout@v4- - uses: actions/setup-node@v4+ - uses: actions/checkout@<full-length-commit-sha>+ - uses: actions/setup-node@<full-length-commit-sha>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/eslint.yml around lines 10 - 11, The workflow uses mutable
action tags actions/checkout@v4 and actions/setup-node@v4 which are a
supply-chain risk; update those usages to pinned full-length commit SHAs
(replace actions/checkout@v4 and actions/setup-node@v4 with the corresponding
repository commit SHA values) so the workflow references immutable commits and
re-run CI to confirm no breakage.

@lawsielawsieMar 24, 2026

Copy link
Copy Markdown
CollaboratorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure whether this is necessary given that they are GitHub's own actions - up to you @tracygardner

@tracygardnertracygardnerMar 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lawsie Accepting as they're GitHub's own actions but noting for upcoming review.

@coderabbitaicoderabbitaiBotMar 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

with:
node-version: 20
- run: npm ci
- run: npx eslint .
continue-on-error: true # Remove to block PRs that fail the check
1 change: 1 addition & 0 deletions eslint.config.mjs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,6 +3,7 @@ import pluginJs from "@eslint/js";

/** @type {import('eslint').Linter.Config[]} */
export default [
{ ignores: ["node_modules/", "dev-dist/", "dist/", "examples/"] },
{ languageOptions: { globals: globals.browser } },
pluginJs.configs.recommended,
];
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@
"dev": "vite",
"build": "node --max-old-space-size=4096 node_modules/vite/bin/vite.js build",
"serve": "vite preview",
"lint": "eslint flock.js && npm run check:link-security",
"lint": "eslint . && npm run check:link-security",
"check:link-security": "node scripts/check-link-security.mjs",
"test:api": "node scripts/run-api-tests.mjs",
"test:api:watch": "node scripts/run-api-tests.mjs --watch",
Expand Down
Loading