Skip to content

Commit 323aa3e

Browse files
aeisenbergaeisenberg
committed
Add permissions block and actions analysis
This change does two things. If it is complicated to review I will split up. First, this ensures that all workflows have minimal permissions blocks. Second, this adds actions analysis.
1 parent e9003a0 commit 323aa3e

File tree

7 files changed

+229
-1
lines changed

7 files changed

+229
-1
lines changed

‎.github/workflows/cli-test.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ jobs:
1717
find-nightly:
1818
name: Find Nightly Release
1919
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
2022
outputs:
2123
url: ${{ steps.get-url.outputs.nightly-url }}
2224
steps:
@@ -33,6 +35,8 @@ jobs:
3335
set-matrix:
3436
name: Set Matrix for cli-test
3537
runs-on: ubuntu-latest
38+
permissions:
39+
contents: read
3640
steps:
3741
- name: Checkout
3842
uses: actions/checkout@v4
@@ -47,6 +51,8 @@ jobs:
4751
runs-on: ${{ matrix.os }}
4852
needs: [find-nightly, set-matrix]
4953
timeout-minutes: 30
54+
permissions:
55+
contents: read
5056
strategy:
5157
matrix:
5258
os: [ubuntu-latest, windows-latest]

‎.github/workflows/codeql.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@ on:
1111
jobs:
1212
codeql:
1313
runs-on: ubuntu-latest
14+
strategy:
15+
matrix:
16+
language:
17+
- javascript
18+
- actions
19+
fail-fast: false
1420

1521
permissions:
1622
contents: read
@@ -24,7 +30,7 @@ jobs:
2430
- name: Initialize CodeQL
2531
uses: github/codeql-action/init@main
2632
with:
27-
languages: javascript
33+
languages: ${{ matrix.language }}
2834
config-file: ./.github/codeql/codeql-config.yml
2935
tools: latest
3036

‎.github/workflows/e2e-tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
pull_request:
66
branches: [main]
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
e2e-test:
1013
name: E2E Test

‎.github/workflows/label-issue.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ on:
33
issues:
44
types: [opened]
55

6+
permissions:
7+
issues: write
8+
69
jobs:
710
label:
811
name: Label issue

‎.github/workflows/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
branches:
88
- main
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
build:
1215
name: Build

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
build:
1717
name: Release
1818
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
1921
steps:
2022
- name: Checkout
2123
uses: actions/checkout@v4
@@ -156,6 +158,8 @@ jobs:
156158
needs: build
157159
environment: publish-open-vsx
158160
runs-on: ubuntu-latest
161+
permissions:
162+
contents: read
159163
env:
160164
OPEN_VSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}
161165
steps:

‎extensions/ql-vscode/eslint.config.js‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
const { resolve } = require("path");
2+
3+
const baseConfig = {
4+
parser: "@typescript-eslint/parser",
5+
files: [".js", ".ts", ".tsx "],
6+
7+
parserOptions: {
8+
ecmaVersion: 2018,
9+
sourceType: "module",
10+
project: [
11+
resolve(__dirname, "tsconfig.lint.json"),
12+
resolve(__dirname, "src/**/tsconfig.json"),
13+
resolve(__dirname, "test/**/tsconfig.json"),
14+
resolve(__dirname, "gulpfile.ts/tsconfig.json"),
15+
resolve(__dirname, "scripts/tsconfig.json"),
16+
resolve(__dirname, ".storybook/tsconfig.json"),
17+
],
18+
},
19+
plugins: ["github", "@typescript-eslint", "etc"],
20+
env: {
21+
node: true,
22+
es6: true,
23+
},
24+
extends: [
25+
"eslint:recommended",
26+
"plugin:github/recommended",
27+
"plugin:github/typescript",
28+
"plugin:jest-dom/recommended",
29+
"plugin:prettier/recommended",
30+
"plugin:@typescript-eslint/recommended",
31+
"plugin:import/recommended",
32+
"plugin:import/typescript",
33+
"plugin:deprecation/recommended",
34+
],
35+
rules: {
36+
"@typescript-eslint/await-thenable": "error",
37+
"@typescript-eslint/no-unused-vars": [
38+
"warn",
39+
{
40+
vars: "all",
41+
args: "none",
42+
ignoreRestSiblings: false,
43+
},
44+
],
45+
"@typescript-eslint/no-explicit-any": "error",
46+
"@typescript-eslint/no-floating-promises": ["error", { ignoreVoid: true }],
47+
"@typescript-eslint/no-invalid-this": "off",
48+
"@typescript-eslint/no-shadow": "off",
49+
"prefer-const": ["warn", { destructuring: "all" }],
50+
"@typescript-eslint/only-throw-error": "error",
51+
"@typescript-eslint/consistent-type-imports": "error",
52+
"import/consistent-type-specifier-style": ["error", "prefer-top-level"],
53+
curly: ["error", "all"],
54+
"escompat/no-regexp-lookbehind": "off",
55+
"etc/no-implicit-any-catch": "error",
56+
"filenames/match-regex": "off",
57+
"i18n-text/no-en": "off",
58+
"no-invalid-this": "off",
59+
"no-console": "off",
60+
"no-shadow": "off",
61+
"github/array-foreach": "off",
62+
"github/no-then": "off",
63+
"react/jsx-key": ["error", { checkFragmentShorthand: true }],
64+
"import/no-cycle": "error",
65+
// Never allow extensions in import paths, except for JSON files where they are required.
66+
"import/extensions": ["error", "never", { json: "always" }],
67+
},
68+
settings: {
69+
"import/resolver": {
70+
typescript: true,
71+
node: true,
72+
},
73+
"import/extensions": [".js", ".jsx", ".ts", ".tsx", ".json"],
74+
// vscode and sarif don't exist on-disk, but only provide types.
75+
"import/core-modules": ["vscode", "sarif"],
76+
},
77+
};
78+
79+
module.exports = [
80+
baseConfig,
81+
{
82+
ignores: [
83+
".vscode-test/",
84+
"node_modules/",
85+
"out/",
86+
"build/",
87+
88+
// Ignore js files
89+
"**/.*",
90+
"**/jest.config.js",
91+
"test/vscode-tests/activated-extension/jest-runner-vscode.config.js",
92+
"test/vscode-tests/cli-integration/jest-runner-vscode.config.js",
93+
"test/vscode-tests/jest-runner-vscode.config.base.js",
94+
"test/vscode-tests/minimal-workspace/jest-runner-vscode.config.js",
95+
"test/vscode-tests/no-workspace/jest-runner-vscode.config.js",
96+
97+
// Include the Storybook config
98+
"!.storybook"
99+
]
100+
},
101+
{
102+
files: ["src/stories/**/*"],
103+
parserOptions: {
104+
project: resolve(__dirname, "src/stories/tsconfig.json"),
105+
},
106+
extends: [
107+
...baseConfig.extends,
108+
"plugin:react/recommended",
109+
"plugin:react/jsx-runtime",
110+
"plugin:react-hooks/recommended",
111+
"plugin:storybook/recommended",
112+
"plugin:github/react",
113+
],
114+
rules: {
115+
...baseConfig.rules,
116+
},
117+
settings: {
118+
react: {
119+
version: "detect",
120+
},
121+
},
122+
},
123+
{
124+
files: ["src/view/**/*"],
125+
parserOptions: {
126+
project: resolve(__dirname, "src/view/tsconfig.json"),
127+
},
128+
extends: [
129+
...baseConfig.extends,
130+
"plugin:react/recommended",
131+
"plugin:react/jsx-runtime",
132+
"plugin:react-hooks/recommended",
133+
"plugin:github/react",
134+
],
135+
rules: {
136+
...baseConfig.rules,
137+
},
138+
settings: {
139+
react: {
140+
version: "detect",
141+
},
142+
},
143+
},
144+
{
145+
files: ["test/vscode-tests/**/*"],
146+
parserOptions: {
147+
project: resolve(__dirname, "test/tsconfig.json"),
148+
},
149+
env: {
150+
jest: true,
151+
},
152+
rules: {
153+
...baseConfig.rules,
154+
// We want to allow mocking of functions in modules, so we need to allow namespace imports.
155+
"import/no-namespace": "off",
156+
"@typescript-eslint/no-unsafe-function-type": "off",
157+
},
158+
},
159+
{
160+
files: ["test/**/*"],
161+
parserOptions: {
162+
project: resolve(__dirname, "test/tsconfig.json"),
163+
},
164+
env: {
165+
jest: true,
166+
},
167+
rules: {
168+
"@typescript-eslint/no-explicit-any": "off",
169+
},
170+
},
171+
{
172+
files: [
173+
".eslintrc.js",
174+
"test/**/jest-runner-vscode.config.js",
175+
"test/**/jest-runner-vscode.config.base.js",
176+
],
177+
parser: undefined,
178+
plugins: ["github"],
179+
extends: [
180+
"eslint:recommended",
181+
"plugin:github/recommended",
182+
"plugin:prettier/recommended",
183+
],
184+
rules: {
185+
"import/no-commonjs": "off",
186+
"prefer-template": "off",
187+
"filenames/match-regex": "off",
188+
"@typescript-eslint/no-var-requires": "off",
189+
},
190+
},
191+
{
192+
files: [".storybook/**/*.tsx"],
193+
parserOptions: {
194+
project: resolve(__dirname, ".storybook/tsconfig.json"),
195+
},
196+
rules: {
197+
...baseConfig.rules,
198+
// Storybook doesn't use the automatic JSX runtime in the addon yet, so we need to allow
199+
// `React` to be imported.
200+
"import/no-namespace": ["error", { ignore: ["react"] }],
201+
},
202+
},
203+
];

0 commit comments

Comments
 (0)