Skip to content

feat: onboarding v3.0.1 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Raj-StepSecurity merged 3 commits into from
Nov 9, 2026
Merged

feat: onboarding v3.0.1 #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b784516
feat: onboarding v3.0.1
Raj-StepSecurity Nov 6, 2026
7dfdcd6
feat: subscription check added
Raj-StepSecurity Nov 6, 2026
50e25ab
yarn converted to package-lock
Raj-StepSecurity Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .github/workflows/audit_package_v3.0.1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
name: NPM Audit Fix Run

on:
workflow_dispatch:
inputs:
force:
description: "Use --force flag for npm audit fix?"
required: true
type: boolean
base_branch:
description: "Specify a base branch"
required: false
default: "main"
node_version:
description: "Node.js version to use"
required: false
default: "24"

schedule:
- cron: "0 0 * * 1"
Comment on lines +19 to +20
Comment thread
Raj-StepSecurity marked this conversation as resolved.
Resolved

jobs:
audit-fix:
uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1
with:
force: ${{ inputs.force || false }}
base_branch: ${{ inputs.base_branch || 'main' }}
node_version: ${{ inputs.node_version || '24' }}

permissions:

@github-actions github-actions Bot Nov 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning: permissions block placed after jobs.

Top-level permissions should appear before jobs: for readability and consistency with the rest of the workflows in this repo. While GitHub Actions parses YAML as an unordered dictionary (so this works), the convention is to place it near the top of the file alongside on: and name:.

contents: write
pull-requests: write
packages: read
issues: write
21 changes: 5 additions & 16 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,19 +13,13 @@ jobs:
runs-on: ubuntu-latest

steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@v2
with:
egress-policy: audit

- name: Checkout tree
Comment thread
Raj-StepSecurity marked this conversation as resolved.
Resolved
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
uses: actions/checkout@v7

@github-actions github-actions Bot Nov 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security: harden-runner removed and action unpinned.

The previous version of this step was pinned to a full commit SHA:

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

and was preceded by step-security/harden-runner@v2 for egress auditing.

Two issues here:

  1. harden-runner should be restored as the first step in every job — it audits outbound calls and is the flagship feature of StepSecurity. Removing it from a StepSecurity-maintained repo sends the wrong signal.
  2. Floating major-version tags like @v7 are mutable and can be re-pointed to malicious commits. Pin to a full SHA:
Suggested change
uses: actions/checkout@v7
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2


- name: Set-up Node
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
- name: Set-up Node.js LTS
Comment thread
Raj-StepSecurity marked this conversation as resolved.
Resolved
uses: actions/setup-node@v7
Comment thread
Raj-StepSecurity marked this conversation as resolved.
Resolved
with:
node-version: 24
cache: npm
node-version: lts/*

- run: npm ci

Expand All @@ -52,13 +46,8 @@ jobs:
runs-on: ubuntu-latest

steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@v2
with:
egress-policy: audit

- name: Checkout tree
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
uses: actions/checkout@v7

- name: Use latest Packer
uses: ./
8 changes: 7 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,8 @@
/.yarn/*
!/.yarn/patches
!/.yarn/plugins
!/.yarn/releases
!/.yarn/sdks
!/.yarn/versions

/node_modules/
.idea
1 change: 1 addition & 0 deletions .yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
nodeLinker: node-modules
14 changes: 8 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

# setup-packer

[![Builds, tests & co](https://github.com/step-security/setup-packer/actions/workflows/main.yml/badge.svg)](https://github.com/step-security/setup-packer/actions)

Set up and cache the Packer CLI.

## Roadmap
Expand All @@ -12,7 +14,7 @@ that only work on one operating system or manipulate the Packer CLI itself.
## Usage

Currently, the semantic versioning style does not support to specify the version
of the packer itself. If you want to use a version other than the latest one,
of the packer itself. ​If you want to use a version other than the latest one,
be sure to specify the exact version.

### Example workflow
Expand All @@ -30,30 +32,30 @@ jobs:

steps:
- name: Checkout tree
uses: actions/checkout@v7
uses: actions/checkout@v4
Comment thread
Raj-StepSecurity marked this conversation as resolved.
Resolved

- name: Use latest Packer
uses: step-security/setup-packer@v4
uses: step-security/setup-packer@v3

# or

- name: Use latest Packer
uses: step-security/setup-packer@v4
uses: step-security/setup-packer@v3
with:
packer-version: 1.6.5

- name: Build image from template
run: packer build TEMPLATE
```

### How to specify the version of the action itself
### ​How to specify the version of the action itself

There is a point that is particularly easy to misunderstand. It's where you
specify the version of the action _itself_.

```yml
- name: Use latest Packer
uses: step-security/setup-packer@v4
uses: step-security/setup-packer@v3
# ^^^
```

Expand Down
57 changes: 25 additions & 32 deletions biome.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,27 @@
{
"$schema": "node_modules/@biomejs/biome/configuration_schema.json",
"files": {
"includes": ["**", "!!dist", "!!.claude"]
},
"vcs": {
"enabled": true,
"clientKind": "git",
"useIgnoreFile": true,
"defaultBranch": "master"
},
"linter": {
"enabled": true,
"domains": {
"project": "recommended"
},
"rules": {
"preset": "recommended",
"complexity": {
"useLiteralKeys": "off"
}
}
},
"formatter": {
"enabled": true,
"useEditorconfig": true
},
"assist": {
"enabled": true,
"actions": {
"recommended": true
}
}
"$schema": "node_modules/@biomejs/biome/configuration_schema.json",
"files": {
"ignore": ["./dist"]
},
"formatter": {
"enabled": true,
"indentStyle": "space"
},
"linter": {
"enabled": true,
"rules": {
"recommended": true,
"complexity": {
"useLiteralKeys": "off"
}
}
},
"organizeImports": {
"enabled": true
},
"vcs": {
"clientKind": "git",
"enabled": true,
"useIgnoreFile": true
}
}
Loading
Loading