Skip to content

Harden the organization check install #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
silveltman wants to merge 1 commit into from
Closed

Harden the organization check install #4

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,12 @@ jobs:
name: Check
runs-on: ubuntu-latest
timeout-minutes: 15
# Nested pnpm installs in a check script get the same protection as the install below.
env:
pnpm_config_ignore_scripts: "true"
pnpm_config_ignore_pnpmfile: "true"
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -33,24 +37,29 @@ jobs:
fi

- if: steps.scripts.outputs.run == 'true'
uses: actions/setup-node@v7
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24

# Corepack starts the pnpm version from `packageManager` faster than pnpm/action-setup.
- if: steps.scripts.outputs.run == 'true'
run: corepack enable

# Later pushes to the same pull request skip the install while dependencies are unchanged.
# Caches downloaded packages only. The install below always runs, so every run
# checks the lockfile against the repository's pnpm settings and the registry.
- if: steps.scripts.outputs.run == 'true'
id: modules
uses: actions/cache@v6
id: store
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

- if: steps.scripts.outputs.run == 'true'
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: node_modules
key: modules-${{ runner.os }}-node24-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '**/package.json') }}
path: ${{ steps.store.outputs.path }}
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: pnpm-store-${{ runner.os }}-

- if: steps.scripts.outputs.run == 'true' && steps.modules.outputs.cache-hit != 'true'
run: pnpm install --frozen-lockfile --ignore-scripts
- if: steps.scripts.outputs.run == 'true'
run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile

- if: steps.scripts.outputs.run == 'true'
run: pnpm check
Expand Down
Loading