From 565995e715d5c90dfe4de069605f4a5ad61d5674 Mon Sep 17 00:00:00 2001 From: neo773 <62795688+neo773@users.noreply.github.com> Date: Tue, 12 May 2026 17:50:29 +0530 Subject: [PATCH] security: harden CI against supply-chain attacks (#20476) - Pin all third-party actions to SHA - Gate claude.yml triggers to internal authors with Harden-Runner egress audit - Ignore fork-PR lifecycle scripts - Narrow cross-repo dispatch payloads - Add 7d npm release-age gate - Add CODEOWNERS on .github/** and .yarnrc.yml --------- Co-authored-by: prastoin --- .cursor/rules/github-actions-security.mdc | 72 +++++++++++++++++++ .github/CODEOWNERS | 6 ++ .github/actions/deploy-twenty-app/action.yml | 2 +- .github/actions/install-twenty-app/action.yml | 2 +- .github/actions/nx-affected/action.yaml | 2 +- .github/actions/restore-cache/action.yaml | 2 +- .github/actions/save-cache/action.yaml | 5 +- .../spawn-twenty-docker-image/action.yaml | 2 +- .github/actions/yarn-install/action.yaml | 11 +-- .github/workflows/cd-deploy-main.yaml | 11 ++- .github/workflows/cd-deploy-tag.yaml | 13 ++-- .github/workflows/changed-files.yaml | 4 +- .github/workflows/ci-ai-catalog-sync.yaml | 13 ++-- .github/workflows/ci-breaking-changes.yaml | 4 +- .../ci-create-app-e2e-hello-world.yaml | 2 +- .../workflows/ci-create-app-e2e-minimal.yaml | 2 +- .../workflows/ci-create-app-e2e-postcard.yaml | 2 +- .github/workflows/ci-create-app.yaml | 6 +- .github/workflows/ci-docs.yaml | 7 +- .github/workflows/ci-emails.yaml | 2 +- .../workflows/ci-example-app-hello-world.yaml | 2 +- .../workflows/ci-example-app-postcard.yaml | 2 +- .../ci-front-component-renderer.yaml | 18 ++--- .github/workflows/ci-front.yaml | 32 +++------ .github/workflows/ci-merge-queue.yaml | 10 +-- .github/workflows/ci-release-create.yaml | 4 +- .github/workflows/ci-release-merge.yaml | 4 +- .github/workflows/ci-sdk.yaml | 8 +-- .github/workflows/ci-server.yaml | 14 ++-- .github/workflows/ci-shared.yaml | 6 +- .github/workflows/ci-test-docker-compose.yaml | 8 +-- .github/workflows/ci-ui.yaml | 18 ++--- .github/workflows/ci-utils.yaml | 4 +- .github/workflows/ci-website.yaml | 6 +- .github/workflows/ci-zapier.yaml | 8 +-- .github/workflows/claude.yml | 63 +++++++++++----- .github/workflows/docs-i18n-pull.yaml | 11 ++- .github/workflows/docs-i18n-push.yaml | 4 +- .github/workflows/i18n-pull.yaml | 13 ++-- .github/workflows/i18n-push.yaml | 13 ++-- .github/workflows/post-ci-comments.yaml | 21 ++++-- .github/workflows/preview-env-dispatch.yaml | 34 +++++---- .github/workflows/preview-env-keepalive.yaml | 6 +- .../workflows/visual-regression-dispatch.yaml | 41 ++++++----- .github/workflows/website-i18n-pull.yaml | 13 ++-- .github/workflows/website-i18n-push.yaml | 13 ++-- .yarnrc.yml | 2 + 47 files changed, 311 insertions(+), 237 deletions(-) create mode 100644 .cursor/rules/github-actions-security.mdc create mode 100644 .github/CODEOWNERS diff --git a/.cursor/rules/github-actions-security.mdc b/.cursor/rules/github-actions-security.mdc new file mode 100644 index 0000000000..f289026be9 --- /dev/null +++ b/.cursor/rules/github-actions-security.mdc @@ -0,0 +1,72 @@ +--- +description: GitHub Actions security guidelines for supply chain protection +globs: **/.github/**/*.yml, **/.github/**/*.yaml +alwaysApply: false +--- + +# GitHub Actions Security + +## Pin Third-Party Actions to Commit SHAs + +Always reference external actions and reusable workflows by their full commit SHA, never by a mutable tag or branch. Tags can be force-pushed by a compromised maintainer account. + +```yaml +# ❌ Mutable tag — vulnerable to supply chain attacks +uses: actions/checkout@v4 +uses: actions/setup-node@v4 + +# ✅ Pinned to commit SHA with tag comment for readability +uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 +uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 +``` + +## Prefer `gh api` Over Third-Party Dispatch Actions + +For repository dispatch calls, use `gh api` directly instead of third-party actions like `peter-evans/repository-dispatch`. This eliminates a supply-chain dependency entirely. + +```yaml +# ✅ Use env vars + bracket notation to prevent injection +- name: Dispatch to target repo + env: + GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + BRANCH: ${{ github.event.workflow_run.head_branch }} + run: | + gh api repos/org/repo/dispatches \ + -f event_type=my-event \ + -f "client_payload[pr_number]=$PR_NUMBER" \ + -f "client_payload[branch]=$BRANCH" + +# ✅ Simple dispatch without payload +- name: Trigger workflow + env: + GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }} + run: | + gh api repos/org/repo/dispatches -f event_type=my-event + +# ❌ Third-party action dependency +- uses: peter-evans/repository-dispatch@v2 + with: + token: ${{ secrets.DISPATCH_TOKEN }} + repository: org/repo + event-type: my-event + +# ❌ Inline ${{ }} in shell — vulnerable to injection +- run: | + gh api repos/org/repo/dispatches --input - <> "${GITHUB_OUTPUT}" - name: Restore cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore) id: restore-cache with: key: ${{ steps.cache-primary-key-builder.outputs.CACHE_PRIMARY_KEY_PREFIX }}-${{ github.sha }} diff --git a/.github/actions/save-cache/action.yaml b/.github/actions/save-cache/action.yaml index 6ef14fe530..87968a4442 100644 --- a/.github/actions/save-cache/action.yaml +++ b/.github/actions/save-cache/action.yaml @@ -9,8 +9,11 @@ inputs: runs: using: "composite" steps: + # Fork PRs on pull_request already can't write to the base repo's cache (GitHub built-in). + # The fork guard is defense-in-depth for pull_request_target, which does have write access. - name: Save cache - uses: actions/cache/save@v4 + if: ${{ format('{0}', github.event.pull_request.head.repo.fork) != 'true' }} + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save) with: key: ${{ inputs.key }} path: | diff --git a/.github/actions/spawn-twenty-docker-image/action.yaml b/.github/actions/spawn-twenty-docker-image/action.yaml index b0e268ca5e..54b8ba4226 100644 --- a/.github/actions/spawn-twenty-docker-image/action.yaml +++ b/.github/actions/spawn-twenty-docker-image/action.yaml @@ -48,7 +48,7 @@ runs: fi - name: Checkout docker compose files - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: ${{ inputs.twenty-repository }} ref: ${{ steps.resolve.outputs.git-ref }} diff --git a/.github/actions/yarn-install/action.yaml b/.github/actions/yarn-install/action.yaml index 35b8a71d39..49f0065d11 100644 --- a/.github/actions/yarn-install/action.yaml +++ b/.github/actions/yarn-install/action.yaml @@ -29,12 +29,12 @@ runs: echo "packages/*/node_modules" >> $GITHUB_OUTPUT echo 'EOF' >> $GITHUB_OUTPUT - name: Setup Node.js and get yarn cache - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ inputs.node-version }} - name: Restore node_modules id: cache-node-modules - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore) with: key: v4-${{ steps.globals.outputs.CACHE_KEY_PREFIX }}-${{github.sha}} restore-keys: v4-${{ steps.globals.outputs.CACHE_KEY_PREFIX }}- @@ -44,10 +44,13 @@ runs: shell: ${{ steps.globals.outputs.ACTION_SHELL }} run: | yarn config set enableHardenedMode true + yarn config set enableScripts false yarn --immutable --check-cache + # Fork PRs on pull_request already can't write to the base repo's cache (GitHub built-in). + # The fork guard is defense-in-depth for pull_request_target, which does have write access. - name: Save cache - if: ${{ steps.cache-node-modules.outputs.cache-hit != 'true' && steps.cache-node-modules.outputs.cache-matched-key == '' }} - uses: actions/cache/save@v4 + if: ${{ steps.cache-node-modules.outputs.cache-hit != 'true' && steps.cache-node-modules.outputs.cache-matched-key == '' && format('{0}', github.event.pull_request.head.repo.fork) != 'true' }} + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save) with: key: ${{ steps.cache-node-modules.outputs.cache-primary-key }} path: ${{ steps.globals.outputs.PATH_TO_CACHE }} diff --git a/.github/workflows/cd-deploy-main.yaml b/.github/workflows/cd-deploy-main.yaml index 7fe62465b1..9c3213f997 100644 --- a/.github/workflows/cd-deploy-main.yaml +++ b/.github/workflows/cd-deploy-main.yaml @@ -14,9 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: auto-deploy-main - client-payload: '{"github": ${{ toJson(github) }}}' # Passes the entire github context to the downstream workflow + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches \ + -f event_type=auto-deploy-main diff --git a/.github/workflows/cd-deploy-tag.yaml b/.github/workflows/cd-deploy-tag.yaml index 3c1608b38c..360cf0a35d 100644 --- a/.github/workflows/cd-deploy-tag.yaml +++ b/.github/workflows/cd-deploy-tag.yaml @@ -14,9 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Repository Dispatch - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: auto-deploy-tag - client-payload: '{"github": ${{ toJson(github) }}}' # Passes the entire github context to the downstream workflow + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + REF_NAME: ${{ github.ref_name }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches \ + -f event_type=auto-deploy-tag \ + -f "client_payload[github][ref_name]=$REF_NAME" diff --git a/.github/workflows/changed-files.yaml b/.github/workflows/changed-files.yaml index c74cb6130a..397953483a 100644 --- a/.github/workflows/changed-files.yaml +++ b/.github/workflows/changed-files.yaml @@ -21,11 +21,11 @@ jobs: any_changed: ${{ steps.changed-files.outputs.any_changed }} steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Check for changed files id: changed-files - uses: tj-actions/changed-files@v45 + uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9 with: files: ${{ inputs.files }} diff --git a/.github/workflows/ci-ai-catalog-sync.yaml b/.github/workflows/ci-ai-catalog-sync.yaml index 0da151494a..d30f5ded59 100644 --- a/.github/workflows/ci-ai-catalog-sync.yaml +++ b/.github/workflows/ci-ai-catalog-sync.yaml @@ -17,7 +17,7 @@ jobs: NODE_OPTIONS: '--max-old-space-size=4096' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: main @@ -41,7 +41,7 @@ jobs: - name: Create pull request if: steps.changes.outputs.changed == 'true' - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.6 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: 'chore: sync AI model catalog from models.dev' @@ -61,8 +61,7 @@ jobs: - name: Trigger automerge if: steps.changes.outputs.changed == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: automated-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=automated-pr-ready diff --git a/.github/workflows/ci-breaking-changes.yaml b/.github/workflows/ci-breaking-changes.yaml index fe1c4c27c2..7f094b3778 100644 --- a/.github/workflows/ci-breaking-changes.yaml +++ b/.github/workflows/ci-breaking-changes.yaml @@ -66,7 +66,7 @@ jobs: steps: - name: Checkout current branch - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 @@ -634,7 +634,7 @@ jobs: - name: Upload breaking changes report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: breaking-changes-report path: | diff --git a/.github/workflows/ci-create-app-e2e-hello-world.yaml b/.github/workflows/ci-create-app-e2e-hello-world.yaml index 59038ce129..8623c5404d 100644 --- a/.github/workflows/ci-create-app-e2e-hello-world.yaml +++ b/.github/workflows/ci-create-app-e2e-hello-world.yaml @@ -57,7 +57,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 diff --git a/.github/workflows/ci-create-app-e2e-minimal.yaml b/.github/workflows/ci-create-app-e2e-minimal.yaml index f8126a333e..3a9bf1461e 100644 --- a/.github/workflows/ci-create-app-e2e-minimal.yaml +++ b/.github/workflows/ci-create-app-e2e-minimal.yaml @@ -55,7 +55,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 diff --git a/.github/workflows/ci-create-app-e2e-postcard.yaml b/.github/workflows/ci-create-app-e2e-postcard.yaml index d8f05f76b1..01b717387f 100644 --- a/.github/workflows/ci-create-app-e2e-postcard.yaml +++ b/.github/workflows/ci-create-app-e2e-postcard.yaml @@ -57,7 +57,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 diff --git a/.github/workflows/ci-create-app.yaml b/.github/workflows/ci-create-app.yaml index ee2512eb6c..02295d638b 100644 --- a/.github/workflows/ci-create-app.yaml +++ b/.github/workflows/ci-create-app.yaml @@ -30,12 +30,8 @@ jobs: matrix: task: [lint, typecheck, test] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-docs.yaml b/.github/workflows/ci-docs.yaml index 8ae32921d6..0c5d28e562 100644 --- a/.github/workflows/ci-docs.yaml +++ b/.github/workflows/ci-docs.yaml @@ -28,13 +28,8 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - - name: Fetch local actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 diff --git a/.github/workflows/ci-emails.yaml b/.github/workflows/ci-emails.yaml index f46cdf85b5..d6ed4c2608 100644 --- a/.github/workflows/ci-emails.yaml +++ b/.github/workflows/ci-emails.yaml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-example-app-hello-world.yaml b/.github/workflows/ci-example-app-hello-world.yaml index f0f5240cf4..1a9fb48e90 100644 --- a/.github/workflows/ci-example-app-hello-world.yaml +++ b/.github/workflows/ci-example-app-hello-world.yaml @@ -54,7 +54,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install dependencies uses: ./.github/actions/yarn-install diff --git a/.github/workflows/ci-example-app-postcard.yaml b/.github/workflows/ci-example-app-postcard.yaml index da9dd22262..28aaeac914 100644 --- a/.github/workflows/ci-example-app-postcard.yaml +++ b/.github/workflows/ci-example-app-postcard.yaml @@ -54,7 +54,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install dependencies uses: ./.github/actions/yarn-install diff --git a/.github/workflows/ci-front-component-renderer.yaml b/.github/workflows/ci-front-component-renderer.yaml index 6ea171e167..74ebcb7d8b 100644 --- a/.github/workflows/ci-front-component-renderer.yaml +++ b/.github/workflows/ci-front-component-renderer.yaml @@ -32,12 +32,8 @@ jobs: matrix: task: [build, typecheck, lint] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -50,12 +46,8 @@ jobs: timeout-minutes: 30 runs-on: ubuntu-latest steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -63,7 +55,7 @@ jobs: - name: Build storybook run: npx nx storybook:build twenty-front-component-renderer - name: Upload storybook build - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: storybook-twenty-front-component-renderer path: packages/twenty-front-component-renderer/storybook-static @@ -76,7 +68,7 @@ jobs: STORYBOOK_URL: http://localhost:6008 steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -84,7 +76,7 @@ jobs: - name: Build dependencies run: npx nx build twenty-sdk - name: Download storybook build - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: storybook-twenty-front-component-renderer path: packages/twenty-front-component-renderer/storybook-static diff --git a/.github/workflows/ci-front.yaml b/.github/workflows/ci-front.yaml index 9bbb8e0ea5..b06fddeb5b 100644 --- a/.github/workflows/ci-front.yaml +++ b/.github/workflows/ci-front.yaml @@ -38,12 +38,8 @@ jobs: env: REACT_APP_SERVER_BASE_URL: http://localhost:3000 steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch local actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -55,7 +51,7 @@ jobs: - name: Front / Build storybook run: npx nx storybook:build twenty-front - name: Upload storybook build - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: storybook-static path: packages/twenty-front/storybook-static @@ -79,7 +75,7 @@ jobs: STORYBOOK_URL: http://localhost:6006 steps: - name: Fetch local actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -96,7 +92,7 @@ jobs: npx nx build twenty-ui npx nx build twenty-front-component-renderer - name: Download storybook build - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: storybook-static path: packages/twenty-front/storybook-static @@ -121,7 +117,7 @@ jobs: # exit 1 # fi # - name: Upload coverage artifact - # uses: actions/upload-artifact@v4 + # uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 # with: # retention-days: 1 # name: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-${{ matrix.shard }} @@ -136,12 +132,12 @@ jobs: # matrix: # storybook_scope: [modules, pages, performance] # steps: - # - uses: actions/checkout@v4 + # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 # with: # fetch-depth: 10 # - name: Install dependencies # uses: ./.github/actions/yarn-install - # - uses: actions/download-artifact@v4 + # - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 # with: # pattern: coverage-artifacts-${{ matrix.storybook_scope }}-${{ github.run_id }}-* # merge-multiple: true @@ -164,12 +160,8 @@ jobs: matrix: task: [lint, typecheck, test] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -203,12 +195,8 @@ jobs: NODE_OPTIONS: "--max-old-space-size=10240" ANALYZE: "true" steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -218,7 +206,7 @@ jobs: - name: Build frontend run: npx nx build twenty-front # - name: Upload frontend build artifact - # uses: actions/upload-artifact@v4 + # uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 # with: # name: frontend-build # path: packages/twenty-front/build diff --git a/.github/workflows/ci-merge-queue.yaml b/.github/workflows/ci-merge-queue.yaml index dc27c51ad2..6a63f3273c 100644 --- a/.github/workflows/ci-merge-queue.yaml +++ b/.github/workflows/ci-merge-queue.yaml @@ -41,11 +41,11 @@ jobs: ports: - 6379:6379 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: lts/* @@ -53,7 +53,7 @@ jobs: uses: ./.github/actions/yarn-install - name: Restore Nx build cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (restore) with: key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }} restore-keys: | @@ -83,7 +83,7 @@ jobs: - name: Save Nx build cache if: always() - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 (save) with: key: v4-e2e-build-${{ github.ref_name }}-${{ github.sha }} path: | @@ -119,7 +119,7 @@ jobs: - name: Upload Playwright results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: playwright-results path: | diff --git a/.github/workflows/ci-release-create.yaml b/.github/workflows/ci-release-create.yaml index 2e1ff43dc0..19f2da073d 100644 --- a/.github/workflows/ci-release-create.yaml +++ b/.github/workflows/ci-release-create.yaml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: ${{ github.event.inputs.ref }} @@ -47,7 +47,7 @@ jobs: printf '%s\n' "$VERSION" > version.txt - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 + uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 with: branch: release/${{ steps.sanitize.outputs.version }} commit-message: "chore: release v${{ steps.sanitize.outputs.version }}" diff --git a/.github/workflows/ci-release-merge.yaml b/.github/workflows/ci-release-merge.yaml index a398fc96a9..91b58523f9 100644 --- a/.github/workflows/ci-release-merge.yaml +++ b/.github/workflows/ci-release-merge.yaml @@ -30,7 +30,7 @@ jobs: fi - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: main @@ -55,7 +55,7 @@ jobs: git tag "v${{ env.VERSION }}" git push origin "v${{ env.VERSION }}" - - uses: release-drafter/release-drafter@v5 + - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5 if: contains(github.event.pull_request.labels.*.name, 'create_release') env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci-sdk.yaml b/.github/workflows/ci-sdk.yaml index 699a8e6717..938161b8c7 100644 --- a/.github/workflows/ci-sdk.yaml +++ b/.github/workflows/ci-sdk.yaml @@ -30,12 +30,8 @@ jobs: matrix: task: [lint, typecheck, test:unit, test:integration] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -74,7 +70,7 @@ jobs: TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-server.yaml b/.github/workflows/ci-server.yaml index 4a39bb1b2c..1c119955ad 100644 --- a/.github/workflows/ci-server.yaml +++ b/.github/workflows/ci-server.yaml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -65,7 +65,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -83,12 +83,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Get changed upgrade-version-command files id: changed-files - uses: tj-actions/changed-files@v45 + uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9 with: files: | packages/twenty-server/src/database/commands/upgrade-version-command/** @@ -178,7 +178,7 @@ jobs: - 6379:6379 steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -278,7 +278,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -341,7 +341,7 @@ jobs: SHARD_COUNTER: 10 steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-shared.yaml b/.github/workflows/ci-shared.yaml index 73a4735d1f..e2af8d9eb8 100644 --- a/.github/workflows/ci-shared.yaml +++ b/.github/workflows/ci-shared.yaml @@ -29,12 +29,8 @@ jobs: matrix: task: [lint, typecheck, test] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-test-docker-compose.yaml b/.github/workflows/ci-test-docker-compose.yaml index d2575f6136..705097814c 100644 --- a/.github/workflows/ci-test-docker-compose.yaml +++ b/.github/workflows/ci-test-docker-compose.yaml @@ -26,9 +26,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -101,9 +101,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} diff --git a/.github/workflows/ci-ui.yaml b/.github/workflows/ci-ui.yaml index 1d0ca60bfb..f2adaa6c54 100644 --- a/.github/workflows/ci-ui.yaml +++ b/.github/workflows/ci-ui.yaml @@ -30,12 +30,8 @@ jobs: matrix: task: [lint, typecheck, test] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -48,12 +44,8 @@ jobs: timeout-minutes: 30 runs-on: ubuntu-latest steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -61,7 +53,7 @@ jobs: - name: Build storybook run: npx nx storybook:build twenty-ui - name: Upload storybook build - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: storybook-twenty-ui path: packages/twenty-ui/storybook-static @@ -74,7 +66,7 @@ jobs: STORYBOOK_URL: http://localhost:6007 steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -82,7 +74,7 @@ jobs: - name: Build dependencies run: npx nx build twenty-shared - name: Download storybook build - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: storybook-twenty-ui path: packages/twenty-ui/storybook-static diff --git a/.github/workflows/ci-utils.yaml b/.github/workflows/ci-utils.yaml index 70b7312d42..f297bb12a1 100644 --- a/.github/workflows/ci-utils.yaml +++ b/.github/workflows/ci-utils.yaml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest if: github.event.action != 'closed' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install dependencies uses: ./.github/actions/yarn-install - name: Utils / Run Danger.js @@ -38,7 +38,7 @@ jobs: runs-on: ubuntu-latest if: github.event.action == 'closed' && github.event.pull_request.merged == true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install dependencies uses: ./.github/actions/yarn-install - name: Run congratulate-dangerfile.js diff --git a/.github/workflows/ci-website.yaml b/.github/workflows/ci-website.yaml index 85b7ba1e13..74ba02becf 100644 --- a/.github/workflows/ci-website.yaml +++ b/.github/workflows/ci-website.yaml @@ -32,12 +32,8 @@ jobs: matrix: task: [lint, typecheck, test] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/ci-zapier.yaml b/.github/workflows/ci-zapier.yaml index 937a3d401c..2b3bc56fef 100644 --- a/.github/workflows/ci-zapier.yaml +++ b/.github/workflows/ci-zapier.yaml @@ -46,7 +46,7 @@ jobs: - 6379:6379 steps: - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies @@ -97,12 +97,8 @@ jobs: matrix: task: [lint, typecheck, validate] steps: - - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@0.11.0 - with: - access_token: ${{ github.token }} - name: Fetch custom Github Actions and base branch history - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 10 - name: Install dependencies diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 46dfd7a2d2..137831d2b2 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -8,10 +8,12 @@ on: pull_request_review: types: [submitted] issues: - types: [opened, assigned] + types: [opened] repository_dispatch: types: [claude-core-team-issues] +permissions: {} + concurrency: group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.event.client_payload.issue_number }} cancel-in-progress: false @@ -19,17 +21,36 @@ concurrency: jobs: claude: if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot') || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot') || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && github.event.review.user.type != 'Bot') || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + ( + github.event_name == 'issue_comment' && + contains(github.event.comment.body, '@claude') && + github.event.comment.user.type != 'Bot' && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) + ) || + ( + github.event_name == 'pull_request_review_comment' && + contains(github.event.comment.body, '@claude') && + github.event.comment.user.type != 'Bot' && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) + ) || + ( + github.event_name == 'pull_request_review' && + contains(github.event.review.body, '@claude') && + github.event.review.user.type != 'Bot' && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association) + ) || + ( + github.event_name == 'issues' && + github.event.action == 'opened' && + (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association) + ) runs-on: ubuntu-latest timeout-minutes: 60 permissions: contents: write pull-requests: write issues: write - id-token: write services: postgres: image: postgres:16 @@ -50,14 +71,14 @@ jobs: - 6379:6379 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 - name: Install dependencies uses: ./.github/actions/yarn-install - name: Run Claude Code id: claude-code - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} additional_permissions: | @@ -102,7 +123,6 @@ jobs: contents: write pull-requests: write issues: write - id-token: write services: postgres: image: postgres:16 @@ -122,14 +142,14 @@ jobs: ports: - 6379:6379 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 - name: Install dependencies uses: ./.github/actions/yarn-install - name: Build prompt from dispatch payload id: prompt - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const p = context.payload.client_payload; @@ -144,7 +164,7 @@ jobs: core.setOutput('issue_number', p.issue_number); - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} prompt: ${{ steps.prompt.outputs.prompt }} @@ -159,9 +179,16 @@ jobs: } - name: Dispatch response to ci-privileged if: always() - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} - repository: twentyhq/ci-privileged - event-type: claude-cross-repo-response - client-payload: '{"repo": ${{ toJSON(steps.prompt.outputs.repo) }}, "issue_number": ${{ toJSON(steps.prompt.outputs.issue_number) }}, "run_id": ${{ toJSON(github.run_id) }}, "run_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}' + env: + GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + REPO: ${{ steps.prompt.outputs.repo }} + ISSUE_NUMBER: ${{ steps.prompt.outputs.issue_number }} + RUN_ID: ${{ github.run_id }} + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: | + gh api repos/twentyhq/ci-privileged/dispatches \ + -f event_type=claude-cross-repo-response \ + -f "client_payload[repo]=$REPO" \ + -f "client_payload[issue_number]=$ISSUE_NUMBER" \ + -f "client_payload[run_id]=$RUN_ID" \ + -f "client_payload[run_url]=$RUN_URL" diff --git a/.github/workflows/docs-i18n-pull.yaml b/.github/workflows/docs-i18n-pull.yaml index 76ad5b042f..7138e2540a 100644 --- a/.github/workflows/docs-i18n-pull.yaml +++ b/.github/workflows/docs-i18n-pull.yaml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }} @@ -153,8 +153,7 @@ jobs: - name: Trigger i18n automerge if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: i18n-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready diff --git a/.github/workflows/docs-i18n-push.yaml b/.github/workflows/docs-i18n-push.yaml index 7a645338cb..99565598e7 100644 --- a/.github/workflows/docs-i18n-push.yaml +++ b/.github/workflows/docs-i18n-push.yaml @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} ref: ${{ github.ref }} @@ -36,7 +36,7 @@ jobs: run: yarn docs:generate-navigation-template - name: Upload docs to Crowdin - uses: crowdin/github-action@v2 + uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2 with: upload_sources: true upload_translations: false diff --git a/.github/workflows/i18n-pull.yaml b/.github/workflows/i18n-pull.yaml index b078f5b7d4..d89569aaf3 100644 --- a/.github/workflows/i18n-pull.yaml +++ b/.github/workflows/i18n-pull.yaml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} ref: ${{ github.head_ref || github.ref_name }} @@ -69,7 +69,7 @@ jobs: - name: Pull translations from Crowdin if: inputs.force_pull || steps.compile_translations_strict.outcome == 'failure' - uses: crowdin/github-action@v2 + uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2 with: upload_sources: false upload_translations: false @@ -139,8 +139,7 @@ jobs: - name: Trigger i18n automerge if: steps.compile_translations.outputs.changes_detected == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: i18n-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready diff --git a/.github/workflows/i18n-push.yaml b/.github/workflows/i18n-push.yaml index 2f7229674d..7c608b27c7 100644 --- a/.github/workflows/i18n-push.yaml +++ b/.github/workflows/i18n-push.yaml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} ref: main @@ -80,7 +80,7 @@ jobs: - name: Upload missing translations if: steps.check_extract_changes.outputs.changes_detected == 'true' - uses: crowdin/github-action@v2 + uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2 with: upload_sources: true upload_translations: true @@ -105,8 +105,7 @@ jobs: - name: Trigger i18n automerge if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: i18n-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready diff --git a/.github/workflows/post-ci-comments.yaml b/.github/workflows/post-ci-comments.yaml index 4912cd4a69..f12f83c7c9 100644 --- a/.github/workflows/post-ci-comments.yaml +++ b/.github/workflows/post-ci-comments.yaml @@ -16,7 +16,7 @@ jobs: steps: - name: Get PR number from workflow run id: pr-info - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const runId = context.payload.workflow_run.id; @@ -63,9 +63,16 @@ jobs: - name: Dispatch to ci-privileged if: steps.pr-info.outputs.has_pr == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} - repository: twentyhq/ci-privileged - event-type: breaking-changes-report - client-payload: '{"pr_number": ${{ toJSON(steps.pr-info.outputs.pr_number) }}, "run_id": ${{ toJSON(steps.pr-info.outputs.run_id) }}, "repo": ${{ toJSON(github.repository) }}, "branch_state": ${{ toJSON(github.event.workflow_run.head_branch) }}}' + env: + GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }} + RUN_ID: ${{ steps.pr-info.outputs.run_id }} + REPOSITORY: ${{ github.repository }} + BRANCH_STATE: ${{ github.event.workflow_run.head_branch }} + run: | + gh api repos/twentyhq/ci-privileged/dispatches \ + -f event_type=breaking-changes-report \ + -f "client_payload[pr_number]=$PR_NUMBER" \ + -f "client_payload[run_id]=$RUN_ID" \ + -f "client_payload[repo]=$REPOSITORY" \ + -f "client_payload[branch_state]=$BRANCH_STATE" diff --git a/.github/workflows/preview-env-dispatch.yaml b/.github/workflows/preview-env-dispatch.yaml index 8e2a6d406c..065a37cfe0 100644 --- a/.github/workflows/preview-env-dispatch.yaml +++ b/.github/workflows/preview-env-dispatch.yaml @@ -36,17 +36,27 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger preview environment workflow - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.GITHUB_TOKEN }} - repository: ${{ github.repository }} - event-type: preview-environment - client-payload: '{"pr_number": "${{ github.event.pull_request.number }}", "pr_head_sha": "${{ github.event.pull_request.head.sha }}", "repo_full_name": "${{ github.repository }}"}' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + REPOSITORY: ${{ github.repository }} + run: | + gh api repos/"$REPOSITORY"/dispatches \ + -f event_type=preview-environment \ + -f "client_payload[pr_number]=$PR_NUMBER" \ + -f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \ + -f "client_payload[repo_full_name]=$REPOSITORY" - name: Dispatch to ci-privileged for PR comment - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} - repository: twentyhq/ci-privileged - event-type: preview-env-url - client-payload: '{"pr_number": ${{ toJSON(github.event.pull_request.number) }}, "keepalive_dispatch_time": ${{ toJSON(github.event.pull_request.updated_at) }}, "repo": ${{ toJSON(github.repository) }}}' + env: + GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + KEEPALIVE_DISPATCH_TIME: ${{ github.event.pull_request.updated_at }} + REPOSITORY: ${{ github.repository }} + run: | + gh api repos/twentyhq/ci-privileged/dispatches \ + -f event_type=preview-env-url \ + -f "client_payload[pr_number]=$PR_NUMBER" \ + -f "client_payload[keepalive_dispatch_time]=$KEEPALIVE_DISPATCH_TIME" \ + -f "client_payload[repo]=$REPOSITORY" diff --git a/.github/workflows/preview-env-keepalive.yaml b/.github/workflows/preview-env-keepalive.yaml index 5049c6a04b..1e73f14ece 100644 --- a/.github/workflows/preview-env-keepalive.yaml +++ b/.github/workflows/preview-env-keepalive.yaml @@ -13,12 +13,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: ${{ github.event.client_payload.pr_head_sha }} - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -166,7 +166,7 @@ jobs: echo "$TUNNEL_URL" > tunnel-url.txt - name: Upload tunnel URL artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: tunnel-url path: tunnel-url.txt diff --git a/.github/workflows/visual-regression-dispatch.yaml b/.github/workflows/visual-regression-dispatch.yaml index 526a9d8d2f..67e0c15ad3 100644 --- a/.github/workflows/visual-regression-dispatch.yaml +++ b/.github/workflows/visual-regression-dispatch.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Determine project and artifact name id: project - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const workflowName = context.payload.workflow_run.name; @@ -43,7 +43,7 @@ jobs: - name: Check if storybook artifact exists id: check-artifact - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const artifactName = '${{ steps.project.outputs.artifact_name }}'; @@ -65,7 +65,7 @@ jobs: - name: Get PR number if: steps.check-artifact.outputs.exists == 'true' id: pr-info - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const headBranch = context.payload.workflow_run.head_branch; @@ -107,7 +107,7 @@ jobs: - name: Download storybook artifact from triggering run if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: ${{ steps.project.outputs.artifact_name }} path: storybook-static @@ -120,7 +120,7 @@ jobs: - name: Upload storybook tarball if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ steps.project.outputs.tarball_name }} path: /tmp/${{ steps.project.outputs.tarball_file }} @@ -128,17 +128,20 @@ jobs: - name: Dispatch to ci-privileged if: steps.check-artifact.outputs.exists == 'true' && steps.pr-info.outputs.has_pr == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} - repository: twentyhq/ci-privileged - event-type: visual-regression - client-payload: >- - { - "pr_number": "${{ steps.pr-info.outputs.pr_number }}", - "run_id": "${{ github.run_id }}", - "repo": "${{ github.repository }}", - "project": "${{ steps.project.outputs.project }}", - "branch": "${{ github.event.workflow_run.head_branch }}", - "commit": "${{ github.event.workflow_run.head_sha }}" - } + env: + GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }} + RUN_ID: ${{ github.run_id }} + REPOSITORY: ${{ github.repository }} + PROJECT: ${{ steps.project.outputs.project }} + BRANCH: ${{ github.event.workflow_run.head_branch }} + COMMIT: ${{ github.event.workflow_run.head_sha }} + run: | + gh api repos/twentyhq/ci-privileged/dispatches \ + -f event_type=visual-regression \ + -f "client_payload[pr_number]=$PR_NUMBER" \ + -f "client_payload[run_id]=$RUN_ID" \ + -f "client_payload[repo]=$REPOSITORY" \ + -f "client_payload[project]=$PROJECT" \ + -f "client_payload[branch]=$BRANCH" \ + -f "client_payload[commit]=$COMMIT" diff --git a/.github/workflows/website-i18n-pull.yaml b/.github/workflows/website-i18n-pull.yaml index 516c23bd57..444391d8bf 100644 --- a/.github/workflows/website-i18n-pull.yaml +++ b/.github/workflows/website-i18n-pull.yaml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} ref: ${{ github.head_ref || github.ref_name }} @@ -66,7 +66,7 @@ jobs: - name: Pull website translations from Crowdin if: inputs.force_pull || steps.compile_translations_strict.outcome == 'failure' - uses: crowdin/github-action@v2 + uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2 with: upload_sources: false upload_translations: false @@ -128,8 +128,7 @@ jobs: - name: Trigger i18n automerge if: steps.compile_translations.outputs.changes_detected == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: i18n-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready diff --git a/.github/workflows/website-i18n-push.yaml b/.github/workflows/website-i18n-push.yaml index a0e9802d49..90552182ba 100644 --- a/.github/workflows/website-i18n-push.yaml +++ b/.github/workflows/website-i18n-push.yaml @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ github.token }} ref: main @@ -78,7 +78,7 @@ jobs: - name: Upload missing website translations if: steps.check_extract_changes.outputs.changes_detected == 'true' - uses: crowdin/github-action@v2 + uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2 with: upload_sources: true upload_translations: true @@ -104,8 +104,7 @@ jobs: - name: Trigger i18n automerge if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' - uses: peter-evans/repository-dispatch@v2 - with: - token: ${{ secrets.TWENTY_INFRA_TOKEN }} - repository: twentyhq/twenty-infra - event-type: i18n-pr-ready + env: + GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + run: | + gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready diff --git a/.yarnrc.yml b/.yarnrc.yml index 26fd66ed67..9f6a58b09f 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -6,4 +6,6 @@ enableInlineHunks: true nodeLinker: node-modules +npmMinimalAgeGate: "3d" + yarnPath: .yarn/releases/yarn-4.13.0.cjs