Scorecard updates (#1182)

* Remove surplus npm install Signed-off-by: Charlie Egan <[email protected]> * Update GHA repo permissions based on suggestions Signed-off-by: Charlie Egan <[email protected]> * Update npm installs to versioned installs Signed-off-by: Charlie Egan <[email protected]> * Use package.json for npm versions * Run npm install --------- Signed-off-by: Charlie Egan <[email protected]>
StyraInc · Oct 8, 2024 · 0af7c91 · 0af7c91
1 parent 9503967
commit 0af7c91
Show file tree

Hide file tree

Showing 7 changed files with 808 additions and 8 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -40,7 +40,7 @@ jobs:
         with:
           version: v0.69.0
           static: ${{ matrix.os.static }}
-      - run: npm install -g markdownlint-cli dprint
+      - run: npm install --prefix build
       - name: Restore rq cache
         id: cache-rq
         uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 # v4.1.0

diff --git a/.github/workflows/push-tags.yaml b/.github/workflows/push-tags.yaml
@@ -6,15 +6,18 @@ on:
       - v[0-9].**
 
 permissions:
-  # this is needed to create a release
-  contents: write
-  # this is needed to create artifacts in ghcr
-  packages: write
+  contents: read
 
 jobs:
   goreleaser:
     name: GoReleaser
     runs-on: ubuntu-22.04
+    permissions:
+      # this is needed to create a release
+      contents: write
+      # this is needed to create artifacts in ghcr
+      packages: write
+
     steps:
       - name: Check out code
         uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

diff --git a/.github/workflows/update-example-index.yaml b/.github/workflows/update-example-index.yaml
@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: "0 1 * * *" # Run daily at 1 AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   update-examples-index:
     env:

diff --git a/build/do.rq b/build/do.rq
@@ -170,14 +170,15 @@ e2e if {
 lint if {
 	run("opa check --strict --capabilities build/capabilities.json bundle")
 	run("./regal lint --format pretty bundle")
-	run("markdownlint --config docs/.markdownlint.yaml --ignore docs/CODE_OF_CONDUCT.md README.md docs/")
+	run("npx --prefix build markdownlint --config docs/.markdownlint.yaml --ignore docs/CODE_OF_CONDUCT.md README.md docs/")
+	run("npx --prefix build dprint --config build/dprint.json check")
 }
 
 lint_ci if {
 	run("opa check --strict --capabilities build/capabilities.json bundle")
 	run_quiet("./regal lint --format github bundle")
-	run("markdownlint --config docs/.markdownlint.yaml --ignore docs/CODE_OF_CONDUCT.md README.md docs/")
-	run("dprint --config build/dprint.json check")
+	run("npx --prefix build markdownlint --config docs/.markdownlint.yaml --ignore docs/CODE_OF_CONDUCT.md README.md docs/")
+	run("npx --prefix build dprint --config build/dprint.json check")
 }
 
 check_readme if {

diff --git a/build/dprint.json b/build/dprint.json
@@ -4,6 +4,7 @@
   },
   "json": {},
   "excludes": [
+    ".lsp/**",
     "**/testdata/**"
   ],
   "plugins": [