-
-
Notifications
You must be signed in to change notification settings - Fork 4
Feature release #100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature release #100
Changes from all commits
55d809f
342971e
f68a0f0
88665bb
93acde3
8cb402a
d15d150
6bc1bcc
60ddf92
cd74878
298ef32
d7c930e
4d2ad03
75a5595
db80f9b
78aae75
cdff162
02caa47
b47086a
995277a
ca5f45d
0d4c2df
0fb6a15
b4bea3f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| name: Release plugin version | ||
| on: | ||
| on: | ||
| workflow_dispatch: | ||
| push: | ||
| branches: [master, main, beta] | ||
|
|
@@ -31,10 +31,34 @@ jobs: | |
| run: | | ||
| npm audit --audit-level=high --production | ||
| npm audit signatures | ||
| continue-on-error: true # Don't fail the build, but report issues | ||
| continue-on-error: true # Don't fail the build, but report issues | ||
| - name: Build plugin | ||
| run: npm run build | ||
| - name: Release update | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: npx semantic-release | ||
| - name: Configure Git | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | ||
| run: | | ||
| git config --global user.name "${{ github.actor }}" | ||
| git config --global user.email "${{ github.actor }}`@users.noreply.github.com`" | ||
| - name: Commit manifest.json (main only) | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | ||
| run: | | ||
| if git diff --quiet -- manifest.json; then | ||
| echo "manifest.json unchanged; skipping commit" | ||
| exit 0 | ||
| fi | ||
|
|
||
| git add manifest.json | ||
| git commit -m "chore: 🔖 sync manifest version [skip ci]" | ||
| git push | ||
| - name: Generate artifact attestation (main release) | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | ||
| uses: actions/attest@v4 | ||
|
Comment on lines
+57
to
+59
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the workflow around the attestation step
wc -l .github/workflows/release.yml
sed -n '1,120p' .github/workflows/release.yml
# Look for any attestation-related docs or permissions elsewhere in the repo
rg -n "attestations: write|actions/attest@v4|artifact attestation|attestation" .github README.md docs . 2>/dev/null | head -n 200Repository: jsonMartin/readwise-mirror Length of output: 2438 🌐 Web query:
💡 Result: To use the actions/attest@v4 action in a GitHub Actions workflow, you must explicitly configure specific permissions for the GITHUB_TOKEN [1][2]. The required permissions are [3][4]: permissions: id-token: write attestations: write artifact-metadata: write Explanation of required permissions: - id-token: write: Necessary for the action to mint the OIDC (OpenID Connect) token, which is required to request a Sigstore signing certificate [3][4]. - attestations: write: Required to persist the generated attestation [3][4][5]. - artifact-metadata: write: Required to create the artifact storage record [3][4]. When you define the permissions block within your job, all unspecified permissions are set to none [5]. Therefore, ensure you include any other permissions your workflow requires (such as contents: read or packages: write) alongside these three [1][2]. Citations:
Grant attestation and artifact-metadata write permissions. 🧰 Tools🪛 zizmor (1.26.1)[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== release workflow excerpt ==\n'
nl -ba .github/workflows/release.yml | sed -n '45,75p'
printf '\n== search for attest and action pinning patterns ==\n'
rg -n "actions/attest@|uses: .*@[v0-9]|uses: .*@[a-f0-9]{40}|pin" .github/workflows -S || true
printf '\n== workflow files overview ==\n'
fd -a -e yml -e yaml .github/workflows || trueRepository: jsonMartin/readwise-mirror Length of output: 236 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== release workflow excerpt ==\n'
awk 'NR>=45 && NR<=75 { printf "%d:%s\n", NR, $0 }' .github/workflows/release.yml
printf '\n== attest usage ==\n'
rg -n "actions/attest@" .github/workflows || true
printf '\n== pinned action examples ==\n'
rg -n "uses: .*@[a-f0-9]{40}" .github/workflows || true
printf '\n== workflow files ==\n'
find .github/workflows -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) -printRepository: jsonMartin/readwise-mirror Length of output: 1208 Pin 🧰 Tools🪛 zizmor (1.26.1)[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| with: | ||
| subject-path: | | ||
| main.js | ||
| manifest.json | ||
| src/ui/styles/styles.css | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,3 @@ | ||
| { | ||
| "chat.tools.terminal.autoApprove": { | ||
| "/^obsidian vault=\"Obsidian Sandbox\" plugin:reload id=readwise-mirror$/": { | ||
| "approve": true, | ||
| "matchCommandLine": true | ||
| }, | ||
| "/^obsidian vault=\"Obsidian Sandbox\" plugin id=readwise-mirror$/": { | ||
| "approve": true, | ||
| "matchCommandLine": true | ||
| }, | ||
| "/^obsidian vault=\"Obsidian Sandbox\" commands filter=readwise$/": { | ||
| "approve": true, | ||
| "matchCommandLine": true | ||
| }, | ||
| "/^obsidian vault=\"Obsidian Sandbox\" command id=readwise-mirror:reset-last-updated$/": { | ||
| "approve": true, | ||
| "matchCommandLine": true | ||
| }, | ||
| "/^obsidian vault=\"Obsidian Sandbox\" command id=readwise-mirror:update$/": { | ||
| "approve": true, | ||
| "matchCommandLine": true | ||
| } | ||
| }, | ||
| "jest.configPath": "jest.config.js" | ||
| } | ||
|
|
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Uh oh!
There was an error while loading. Please reload this page.