Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use npm to manage "Check Workflows" tool dependencies #792

Merged
merged 1 commit into from
Oct 16, 2024

Commits on Oct 16, 2024

  1. Use npm to manage "Check Workflows" tool dependencies

    The project uses the ajv-cli tool to validate GitHub Actions workflows against the JSON schema. Previously, the version
    of the tool used was not controlled. This was problematic because:
    
    - A different version of the tool may be used on the contributor's machine than on the CI runner, resulting in confusing
      failures.
    - The project is immediately subject to disruption or breakage resulting from a release of the tool.
    
    The new approach is to specify the version of the tools via the standard npm metadata files (package.json +
    package-lock.json), providing the following benefits:
    
    - Enables automated updates via Dependabot PRs
    - Enables automated vulnerability alerts
    per1234 committed Oct 16, 2024
    Configuration menu
    Copy the full SHA
    14983d7 View commit details
    Browse the repository at this point in the history