From 16c6011c6e7c27766a1da8ee73c7d90032934aa5 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Fri, 7 Aug 2026 15:33:10 +0300 Subject: [PATCH 1/2] chore: resolve CodeQL issues (#DS-5215) --- .github/actions/setup-node/action.yml | 2 +- .github/workflows/build.yml | 5 ++++- .github/workflows/commitlint.yml | 9 +++++++-- .github/workflows/deploy-next.yml | 4 ++-- .github/workflows/deploy-preview.yml | 4 ++-- .github/workflows/e2e-approve-snapshots.yml | 14 +++++++------- .github/workflows/e2e.yml | 6 +++--- .github/workflows/linters.yml | 5 ++++- .github/workflows/pr-notification.yml | 6 ++++-- .github/workflows/publish.yml | 4 ++-- .github/workflows/redeploy-preview.yml | 12 ++++++------ .github/workflows/units.yml | 5 ++++- 12 files changed, 46 insertions(+), 30 deletions(-) diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml index eeaf7ea..394c597 100644 --- a/.github/actions/setup-node/action.yml +++ b/.github/actions/setup-node/action.yml @@ -4,7 +4,7 @@ runs: using: composite steps: - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: 'yarn' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 026241f..ba82e3f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -6,10 +6,13 @@ on: - main pull_request: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/setup-node - run: yarn run build diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index ef15daf..f33142f 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -2,10 +2,15 @@ name: Commitlint on: [pull_request] +permissions: + contents: read + jobs: commitlint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/setup-node - - run: echo "${{ github.event.pull_request.title }}" | yarn commitlint --verbose + - env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: printf '%s\n' "$PR_TITLE" | yarn commitlint --verbose diff --git a/.github/workflows/deploy-next.yml b/.github/workflows/deploy-next.yml index 7339a2c..5e5401a 100644 --- a/.github/workflows/deploy-next.yml +++ b/.github/workflows/deploy-next.yml @@ -15,12 +15,12 @@ jobs: if: ${{ github.repository_owner == 'koobiq' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: ./.github/actions/setup-node - run: yarn run build - - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 + - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0 with: repoToken: ${{ secrets.GITHUB_TOKEN }} firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }} diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index a9dfad1..d42ca6e 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -13,14 +13,14 @@ jobs: if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup-node # Run dev mode build to generate the `e2eRoute` # @see dev/ag-grid-angular/src/main.ts - run: yarn run build --configuration=development - - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 + - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0 with: repoToken: ${{ secrets.GITHUB_TOKEN }} firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }} diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml index b72b382..eb2b529 100644 --- a/.github/workflows/e2e-approve-snapshots.yml +++ b/.github/workflows/e2e-approve-snapshots.yml @@ -19,16 +19,16 @@ jobs: runs-on: ubuntu-24.04-arm timeout-minutes: 10 steps: - - uses: xt0rted/pull-request-comment-branch@v3 + - uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0 id: comment-branch - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: message: 🔄 [Updating](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ steps.comment-branch.outputs.head_ref }} + ref: ${{ steps.comment-branch.outputs.head_sha }} - run: npm run e2e:docker:update-snapshots - - uses: stefanzweifel/git-auto-commit-action@v7 + - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 id: commit-and-push with: commit_message: 'test: updated e2e snapshots' @@ -37,11 +37,11 @@ jobs: if: ${{ steps.commit-and-push.outputs.changes_detected == 'true' }} with: message: ✅ Snapshots [updated](https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}/commits/${{ steps.commit-and-push.outputs.commit_hash }})! - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 if: ${{ steps.commit-and-push.outputs.changes_detected != 'true' }} with: message: ⚠️ No snapshots changes detected. - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 if: ${{ failure() }} with: message: 🚨 Failed to [update](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0719b72..10fe9cc 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -15,17 +15,17 @@ jobs: runs-on: ubuntu-24.04-arm timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: run-e2e-tests run: npm run e2e:docker - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ always() }} id: upload-report with: name: playwright-report path: playwright-report/ retention-days: 5 - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 if: ${{ failure() && steps.run-e2e-tests.outcome == 'failure' }} with: message: | diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml index 18c78bf..ee6a478 100644 --- a/.github/workflows/linters.yml +++ b/.github/workflows/linters.yml @@ -6,11 +6,14 @@ on: - main pull_request: +permissions: + contents: read + jobs: linters: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/setup-node - run: | yarn run prettier diff --git a/.github/workflows/pr-notification.yml b/.github/workflows/pr-notification.yml index 4e3cb77..c255204 100644 --- a/.github/workflows/pr-notification.yml +++ b/.github/workflows/pr-notification.yml @@ -9,6 +9,8 @@ on: types: - opened +permissions: {} + jobs: notify: runs-on: ubuntu-latest @@ -18,7 +20,7 @@ jobs: steps: - name: Notification to main channel if: ${{ github.actor != 'dependabot[bot]' }} - uses: mattermost/action-mattermost-notify@v2.1.0 + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 env: NODE_TLS_REJECT_UNAUTHORIZED: '0' with: @@ -28,7 +30,7 @@ jobs: TEXT: ${{ env.TEXT }} - name: Notification to dev channel - uses: mattermost/action-mattermost-notify@v2.1.0 + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 env: NODE_TLS_REJECT_UNAUTHORIZED: '0' with: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 21921b4..63c692a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,7 +18,7 @@ jobs: if: ${{ github.repository_owner == 'koobiq' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: ./.github/actions/setup-node @@ -26,7 +26,7 @@ jobs: env: NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }} NPM_CONFIG_PROVENANCE: true - - uses: mattermost/action-mattermost-notify@v2.1.0 + - uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 env: NODE_TLS_REJECT_UNAUTHORIZED: '0' with: diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml index 334f35d..26692fa 100644 --- a/.github/workflows/redeploy-preview.yml +++ b/.github/workflows/redeploy-preview.yml @@ -19,27 +19,27 @@ jobs: if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }} runs-on: ubuntu-latest steps: - - uses: xt0rted/pull-request-comment-branch@v3 + - uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0 id: comment-branch - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: message: 🔄 [Redeploying](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview. - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ steps.comment-branch.outputs.head_ref }} + ref: ${{ steps.comment-branch.outputs.head_sha }} persist-credentials: false - uses: ./.github/actions/setup-node # Run dev mode build to generate the `e2eRoute` # @see dev/ag-grid-angular/src/main.ts - run: yarn run build --configuration=development - - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 + - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0 with: repoToken: '${{ secrets.GITHUB_TOKEN }}' firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}' expires: 3d channelId: data-grid-pr-${{ github.event.issue.number }} target: next - - uses: thollander/actions-comment-pull-request@v3 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 if: ${{ failure() }} with: message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview. diff --git a/.github/workflows/units.yml b/.github/workflows/units.yml index da3eb18..bc4efc9 100644 --- a/.github/workflows/units.yml +++ b/.github/workflows/units.yml @@ -6,10 +6,13 @@ on: - main pull_request: +permissions: + contents: read + jobs: units: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/setup-node - run: yarn run unit From 2f5ce4be1e651099be05005acb325628cda4c918 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Wed, 12 Aug 2026 13:31:09 +0300 Subject: [PATCH 2/2] refactor: review --- .github/workflows/build.yml | 2 ++ .github/workflows/commitlint.yml | 2 ++ .github/workflows/deploy-next.yml | 1 + .github/workflows/e2e.yml | 2 ++ .github/workflows/linters.yml | 2 ++ .github/workflows/publish.yml | 1 + .github/workflows/units.yml | 2 ++ 7 files changed, 12 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ba82e3f..e9e3384 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,5 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: ./.github/actions/setup-node - run: yarn run build diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index f33142f..b49c059 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: ./.github/actions/setup-node - env: PR_TITLE: ${{ github.event.pull_request.title }} diff --git a/.github/workflows/deploy-next.yml b/.github/workflows/deploy-next.yml index 5e5401a..5176862 100644 --- a/.github/workflows/deploy-next.yml +++ b/.github/workflows/deploy-next.yml @@ -18,6 +18,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - uses: ./.github/actions/setup-node - run: yarn run build - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0 diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 10fe9cc..f740c7b 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -16,6 +16,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - id: run-e2e-tests run: npm run e2e:docker - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml index ee6a478..9b5e6bc 100644 --- a/.github/workflows/linters.yml +++ b/.github/workflows/linters.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: ./.github/actions/setup-node - run: | yarn run prettier diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 63c692a..14a3d61 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,6 +21,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - uses: ./.github/actions/setup-node - run: yarn nx release publish --registry=https://registry.npmjs.org/ env: diff --git a/.github/workflows/units.yml b/.github/workflows/units.yml index bc4efc9..d541218 100644 --- a/.github/workflows/units.yml +++ b/.github/workflows/units.yml @@ -14,5 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: ./.github/actions/setup-node - run: yarn run unit