From b35a18343b950c681aedd85ef067e4cdef0b5fbf Mon Sep 17 00:00:00 2001 From: sebastien Date: Thu, 5 Nov 2026 18:14:13 +0100 Subject: [PATCH 1/5] chore(ci): use the local setup action in the jobs that must not use the cache (AI-assisted) These jobs can write to the repository, PRs or releases, or need SFW to fetch packages. They keep cache-mode: none and don't opt into the cache. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-hash-router.yml | 16 +++--------- .github/workflows/build-perf.yml | 12 +++------ .github/workflows/continuous-releases.yml | 25 ++++-------------- .github/workflows/lighthouse-report.yml | 17 ++---------- .github/workflows/lint-autofix.yml | 17 ++---------- .github/workflows/security-supply-chain.yml | 29 +++++---------------- 6 files changed, 21 insertions(+), 95 deletions(-) diff --git a/.github/workflows/build-hash-router.yml b/.github/workflows/build-hash-router.yml index f26291d5afe4..bf8d21b76dd0 100644 --- a/.github/workflows/build-hash-router.yml +++ b/.github/workflows/build-hash-router.yml @@ -10,6 +10,7 @@ on: paths: - packages/** - .github/workflows/build-hash-router.yml + - .github/actions/** concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} @@ -31,19 +32,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 - with: - # Only install pnpm: Node.js and dependencies are installed by later steps - install: false - node-version-file: false - - name: Set up Node - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - - name: Installation - run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile + - name: Set up pnpm, Node.js and dependencies + uses: ./.github/actions/setup - name: Build Hash Router run: pnpm build:website:fast diff --git a/.github/workflows/build-perf.yml b/.github/workflows/build-perf.yml index 4faca426868f..975d30751017 100644 --- a/.github/workflows/build-perf.yml +++ b/.github/workflows/build-perf.yml @@ -47,17 +47,11 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - name: Set up pnpm and Node.js + uses: ./.github/actions/setup with: - # Only install pnpm: Node.js and dependencies are installed by later steps + # compressed-size-action installs the dependencies of each branch install: false - node-version-file: false - - name: Set up Node - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - name: Track build size changes uses: preactjs/compressed-size-action@f322c295dde06a1cb7ccaef105732dd8a726d1d9 # v2.10.0 with: diff --git a/.github/workflows/continuous-releases.yml b/.github/workflows/continuous-releases.yml index 9d29d9631dd3..cb43cf5d44cb 100644 --- a/.github/workflows/continuous-releases.yml +++ b/.github/workflows/continuous-releases.yml @@ -29,26 +29,11 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 - with: - # Only install pnpm: Node.js and dependencies are installed by later steps - install: false - node-version-file: false - - - name: Set up Node - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - # ⚠️ Do not use any cache on purpose - # It increases the chance of a compromised release being publish - # See https://github.com/actions/setup-node/issues/1445#issuecomment-4040130833 - # cache: pnpm - package-manager-cache: false - - - name: Installation - run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile + # ⚠️ Do not use any cache on purpose + # It increases the chance of a compromised release being publish + # See https://github.com/actions/setup-node/issues/1445#issuecomment-4040130833 + - name: Set up pnpm, Node.js and dependencies + uses: ./.github/actions/setup - name: Build packages run: pnpm build:packages diff --git a/.github/workflows/lighthouse-report.yml b/.github/workflows/lighthouse-report.yml index 3d558d18f0b8..1d8824ee84e3 100644 --- a/.github/workflows/lighthouse-report.yml +++ b/.github/workflows/lighthouse-report.yml @@ -27,21 +27,8 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 - with: - # Only install pnpm: Node.js and dependencies are installed by later steps - install: false - node-version-file: false - - - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - - - name: Install dependencies - run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile + - name: Set up pnpm, Node.js and dependencies + uses: ./.github/actions/setup - name: Build website fast run: pnpm build:website:fast diff --git a/.github/workflows/lint-autofix.yml b/.github/workflows/lint-autofix.yml index 2f43efb11fda..848fb0cc0fa2 100644 --- a/.github/workflows/lint-autofix.yml +++ b/.github/workflows/lint-autofix.yml @@ -29,21 +29,8 @@ jobs: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 - with: - # Only install pnpm: Node.js and dependencies are installed by later steps - install: false - node-version-file: false - - - name: Set up Node LTS - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - - - name: Installation - run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile + - name: Set up pnpm, Node.js and dependencies + uses: ./.github/actions/setup - name: AutoFix Duplicated deps run: pnpm lint:deps:fix diff --git a/.github/workflows/security-supply-chain.yml b/.github/workflows/security-supply-chain.yml index 4910e902a418..9abc53b4e2b2 100644 --- a/.github/workflows/security-supply-chain.yml +++ b/.github/workflows/security-supply-chain.yml @@ -34,19 +34,11 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + # No cache on purpose! We want SFW to fetch packages + - name: Set up pnpm and Node.js + uses: ./.github/actions/setup with: - # Only install pnpm: Node.js and dependencies are installed by later steps install: false - node-version-file: false - - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - # No cache on purpose! We want SFW to fetch packages - package-manager-cache: false # See https://socket.dev/blog/introducing-socket-firewall - name: Install Socket Firewall Free @@ -74,20 +66,11 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + # No cache on purpose! We want SFW to fetch packages + - name: Set up pnpm and Node.js + uses: ./.github/actions/setup with: - # Only install pnpm: Node.js and dependencies are installed by later steps install: false - node-version-file: false - - - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - # No cache on purpose! We want SFW to fetch packages - package-manager-cache: false # See https://socket.dev/blog/introducing-socket-firewall - name: Install Socket Firewall Free From 4e9b17ecc7704ac09518d14d36015290d04279d1 Mon Sep 17 00:00:00 2001 From: sebastien Date: Thu, 5 Nov 2026 18:27:04 +0100 Subject: [PATCH 2/5] chore(ci): keep the inline setup steps in Lint AutoFix (AI-assisted) It checks out the PR branch, which may predate the local setup action. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/lint-autofix.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint-autofix.yml b/.github/workflows/lint-autofix.yml index 848fb0cc0fa2..6e0cbae390ef 100644 --- a/.github/workflows/lint-autofix.yml +++ b/.github/workflows/lint-autofix.yml @@ -29,8 +29,22 @@ jobs: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} - - name: Set up pnpm, Node.js and dependencies - uses: ./.github/actions/setup + # Not using ./.github/actions/setup: the PR branch checked out may predate it + - name: Install pnpm + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + with: + # Only install pnpm: Node.js and dependencies are installed by later steps + install: false + node-version-file: false + + - name: Set up Node LTS + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: lts/* + check-latest: true + + - name: Installation + run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile - name: AutoFix Duplicated deps run: pnpm lint:deps:fix From 99f4c62e2ab1e817cf8310967a61d64458d8b5a3 Mon Sep 17 00:00:00 2001 From: sebastien Date: Thu, 5 Nov 2026 18:52:19 +0100 Subject: [PATCH 3/5] chore(ci): set cache: false explicitly where the cache is disabled on purpose (AI-assisted) The comment explaining why goes on the setting itself. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-hash-router.yml | 3 +++ .github/workflows/build-perf.yml | 2 ++ .github/workflows/continuous-releases.yml | 8 +++++--- .github/workflows/lighthouse-report.yml | 3 +++ .github/workflows/security-supply-chain.yml | 8 ++++++-- 5 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-hash-router.yml b/.github/workflows/build-hash-router.yml index bf8d21b76dd0..e7f2c6b6f849 100644 --- a/.github/workflows/build-hash-router.yml +++ b/.github/workflows/build-hash-router.yml @@ -34,6 +34,9 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup + with: + # No cache on purpose: this workflow can write to the repository + cache: false - name: Build Hash Router run: pnpm build:website:fast diff --git a/.github/workflows/build-perf.yml b/.github/workflows/build-perf.yml index 975d30751017..2bffad1afeec 100644 --- a/.github/workflows/build-perf.yml +++ b/.github/workflows/build-perf.yml @@ -50,6 +50,8 @@ jobs: - name: Set up pnpm and Node.js uses: ./.github/actions/setup with: + # No cache on purpose: this job can write to pull requests, issues and checks + cache: false # compressed-size-action installs the dependencies of each branch install: false - name: Track build size changes diff --git a/.github/workflows/continuous-releases.yml b/.github/workflows/continuous-releases.yml index cb43cf5d44cb..6bb284230f4b 100644 --- a/.github/workflows/continuous-releases.yml +++ b/.github/workflows/continuous-releases.yml @@ -29,11 +29,13 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - # ⚠️ Do not use any cache on purpose - # It increases the chance of a compromised release being publish - # See https://github.com/actions/setup-node/issues/1445#issuecomment-4040130833 - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup + with: + # ⚠️ Do not use any cache on purpose + # It increases the chance of a compromised release being publish + # See https://github.com/actions/setup-node/issues/1445#issuecomment-4040130833 + cache: false - name: Build packages run: pnpm build:packages diff --git a/.github/workflows/lighthouse-report.yml b/.github/workflows/lighthouse-report.yml index 1d8824ee84e3..06c2dcb39fc2 100644 --- a/.github/workflows/lighthouse-report.yml +++ b/.github/workflows/lighthouse-report.yml @@ -29,6 +29,9 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup + with: + # No cache on purpose: this job can write to pull requests + cache: false - name: Build website fast run: pnpm build:website:fast diff --git a/.github/workflows/security-supply-chain.yml b/.github/workflows/security-supply-chain.yml index 9abc53b4e2b2..5fec111e3c1d 100644 --- a/.github/workflows/security-supply-chain.yml +++ b/.github/workflows/security-supply-chain.yml @@ -34,10 +34,12 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - # No cache on purpose! We want SFW to fetch packages - name: Set up pnpm and Node.js uses: ./.github/actions/setup with: + # No cache on purpose! We want SFW to fetch packages + cache: false + # Installed below, with SFW install: false # See https://socket.dev/blog/introducing-socket-firewall @@ -66,10 +68,12 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - # No cache on purpose! We want SFW to fetch packages - name: Set up pnpm and Node.js uses: ./.github/actions/setup with: + # No cache on purpose! We want SFW to fetch packages + cache: false + # Only the generated site template dependencies are installed install: false # See https://socket.dev/blog/introducing-socket-firewall From 0e965286ff1c352b8fb7187af1c2d5e6e5e9b6a4 Mon Sep 17 00:00:00 2001 From: sebastien Date: Thu, 5 Nov 2026 18:57:30 +0100 Subject: [PATCH 4/5] chore(ci): reuse the existing cache comments, use the setup action in Lint AutoFix (AI-assisted) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-hash-router.yml | 2 +- .github/workflows/build-perf.yml | 2 +- .github/workflows/lighthouse-report.yml | 2 +- .github/workflows/lint-autofix.yml | 19 ++++--------------- .github/workflows/security-supply-chain.yml | 2 -- 5 files changed, 7 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build-hash-router.yml b/.github/workflows/build-hash-router.yml index e7f2c6b6f849..5866d9bb366a 100644 --- a/.github/workflows/build-hash-router.yml +++ b/.github/workflows/build-hash-router.yml @@ -35,7 +35,7 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup with: - # No cache on purpose: this workflow can write to the repository + # This workflow can write to the repository (GitHub Pages deployment) cache: false - name: Build Hash Router diff --git a/.github/workflows/build-perf.yml b/.github/workflows/build-perf.yml index 2bffad1afeec..12b633f7daff 100644 --- a/.github/workflows/build-perf.yml +++ b/.github/workflows/build-perf.yml @@ -50,7 +50,7 @@ jobs: - name: Set up pnpm and Node.js uses: ./.github/actions/setup with: - # No cache on purpose: this job can write to pull requests, issues and checks + # This job can write to pull requests, issues and checks cache: false # compressed-size-action installs the dependencies of each branch install: false diff --git a/.github/workflows/lighthouse-report.yml b/.github/workflows/lighthouse-report.yml index 06c2dcb39fc2..be2057e552fd 100644 --- a/.github/workflows/lighthouse-report.yml +++ b/.github/workflows/lighthouse-report.yml @@ -30,7 +30,7 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup with: - # No cache on purpose: this job can write to pull requests + # This job can write to pull requests cache: false - name: Build website fast diff --git a/.github/workflows/lint-autofix.yml b/.github/workflows/lint-autofix.yml index 6e0cbae390ef..3192feef4028 100644 --- a/.github/workflows/lint-autofix.yml +++ b/.github/workflows/lint-autofix.yml @@ -29,22 +29,11 @@ jobs: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} - # Not using ./.github/actions/setup: the PR branch checked out may predate it - - name: Install pnpm - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - name: Set up pnpm, Node.js and dependencies + uses: ./.github/actions/setup with: - # Only install pnpm: Node.js and dependencies are installed by later steps - install: false - node-version-file: false - - - name: Set up Node LTS - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: lts/* - check-latest: true - - - name: Installation - run: pnpm install --frozen-lockfile || pnpm install --frozen-lockfile || pnpm install --frozen-lockfile + # This job can push commits to the repository + cache: false - name: AutoFix Duplicated deps run: pnpm lint:deps:fix diff --git a/.github/workflows/security-supply-chain.yml b/.github/workflows/security-supply-chain.yml index 5fec111e3c1d..104692fda954 100644 --- a/.github/workflows/security-supply-chain.yml +++ b/.github/workflows/security-supply-chain.yml @@ -39,7 +39,6 @@ jobs: with: # No cache on purpose! We want SFW to fetch packages cache: false - # Installed below, with SFW install: false # See https://socket.dev/blog/introducing-socket-firewall @@ -73,7 +72,6 @@ jobs: with: # No cache on purpose! We want SFW to fetch packages cache: false - # Only the generated site template dependencies are installed install: false # See https://socket.dev/blog/introducing-socket-firewall From f431944ae8d7427781770ff4272db5c39585111d Mon Sep 17 00:00:00 2001 From: sebastien Date: Thu, 5 Nov 2026 19:11:05 +0100 Subject: [PATCH 5/5] chore(ci): say the no-cache settings prevent cache poisoning (AI-assisted) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-hash-router.yml | 2 +- .github/workflows/build-perf.yml | 2 +- .github/workflows/lighthouse-report.yml | 2 +- .github/workflows/lint-autofix.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-hash-router.yml b/.github/workflows/build-hash-router.yml index 5866d9bb366a..8b24d57cb152 100644 --- a/.github/workflows/build-hash-router.yml +++ b/.github/workflows/build-hash-router.yml @@ -35,7 +35,7 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup with: - # This workflow can write to the repository (GitHub Pages deployment) + # Security: prevents cache poisoning, as this workflow can write to the repository (GitHub Pages deployment) cache: false - name: Build Hash Router diff --git a/.github/workflows/build-perf.yml b/.github/workflows/build-perf.yml index 12b633f7daff..d6b4a14e81ee 100644 --- a/.github/workflows/build-perf.yml +++ b/.github/workflows/build-perf.yml @@ -50,7 +50,7 @@ jobs: - name: Set up pnpm and Node.js uses: ./.github/actions/setup with: - # This job can write to pull requests, issues and checks + # Security: prevents cache poisoning, as this job can write to pull requests, issues and checks cache: false # compressed-size-action installs the dependencies of each branch install: false diff --git a/.github/workflows/lighthouse-report.yml b/.github/workflows/lighthouse-report.yml index be2057e552fd..49e3546790e9 100644 --- a/.github/workflows/lighthouse-report.yml +++ b/.github/workflows/lighthouse-report.yml @@ -30,7 +30,7 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup with: - # This job can write to pull requests + # Security: prevents cache poisoning, as this job can write to pull requests cache: false - name: Build website fast diff --git a/.github/workflows/lint-autofix.yml b/.github/workflows/lint-autofix.yml index 3192feef4028..afa9f8ce9b72 100644 --- a/.github/workflows/lint-autofix.yml +++ b/.github/workflows/lint-autofix.yml @@ -32,7 +32,7 @@ jobs: - name: Set up pnpm, Node.js and dependencies uses: ./.github/actions/setup with: - # This job can push commits to the repository + # Security: prevents cache poisoning, as this job can push commits to the repository cache: false - name: AutoFix Duplicated deps