ci: hardening security of Github actions

.github/workflows/actions/cache-vscode/action.yml → .github/actions/cache-vscode/action.yml

@@ -13,7 +13,7 @@ runs:
 
     - name: 🗃️ Use cached vscode
       if: ${{ steps.generate-key.outputs.vscode-cache-key != '' }}
-      uses: actions/[email protected]
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ inputs.path }}
         key: ${{ steps.generate-key.outputs.vscode-cache-key }}

.github/workflows/actions/download-archive/action.yml → .github/actions/download-archive/action.yml

@@ -11,7 +11,7 @@ runs:
   using: 'composite'
   steps:
     - name: ⬇️ Download Build Archive
-      uses: actions/[email protected]
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}

.github/workflows/actions/set-screen-resolution/action.yml → .github/actions/set-screen-resolution/action.yml

@@ -37,5 +37,7 @@ runs:
       if: runner.os == 'macOS'
       shell: bash
       run: |
+        echo "::group::brew install displayplacer"
         brew install displayplacer
+        echo "::endgroup::"
         displayplacer list

.github/workflows/actions/setup-workspace/action.yml → .github/actions/setup-workspace/action.yml

@@ -9,12 +9,12 @@ runs:
   using: composite
   steps:
     - name: 🧰 Setup PNPM
-      uses: pnpm/[email protected]
+      uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       with:
         run_install: false
 
     - name: 🛠️ Setup Node.js ${{ inputs.node-version }}
-      uses: actions/[email protected]
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'pnpm'

.github/workflows/actions/upload-archive/action.yml → .github/actions/upload-archive/action.yml

@@ -21,7 +21,7 @@ runs:
       if: ${{ runner.os == 'Windows' }}
 
     - name: ⬆️ Upload Archive
-      uses: actions/[email protected]
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.output }}

.github/workflows/ci-build.yml

@@ -19,12 +19,12 @@ jobs:
     runs-on: ${{ inputs.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 
@@ -34,7 +34,7 @@ jobs:
 
       - name: ⬆️ Upload Build Artifacts
         if: ${{ runner.os == 'Linux' }}
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         with:
           name: vscode-webdriverio
           output: vscode-webdriverio-build.zip

.github/workflows/ci-e2e.yml

@@ -26,46 +26,46 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
           filename: vscode-webdriverio-build.zip
 
       - name: 🗃️ Use cached vscode
-        uses: ./.github/workflows/actions/cache-vscode
+        uses: ./.github/actions/cache-vscode
         with:
           path: e2e/.wdio-vscode-service
 
       - name: 🖥️ Set screen resolution
-        uses: ./.github/workflows/actions/set-screen-resolution
+        uses: ./.github/actions/set-screen-resolution
 
       - name: 🧪 Run the e2e test
         env:
           E2E_SCENARIO: ${{ matrix.scenario }}
-        run: pnpm --filter @vscode-wdio/e2e run test:e2e:${E2E_SCENARIO}
+        run: pnpm --filter @vscode-wdio/e2e run "test:e2e:${E2E_SCENARIO}"
         shell: bash
 
       - name: 📦 Upload Test Logs on Failure
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         if: failure()
         with:
           name: ${{ inputs.compatibility-mode == 'yes' && 'compatibility' || 'e2e' }}-${{ matrix.scenario }}-logs-${{ matrix.os }}
           output: ${{ inputs.compatibility-mode == 'yes' && 'compatibility' || 'e2e' }}-${{ matrix.scenario }}-logs-${{ matrix.os }}.zip
           paths: e2e/logs
 
       - name: 🐛 Debug Build
-        uses: stateful/[email protected]
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'

.github/workflows/ci-lint.yml

@@ -14,12 +14,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 

.github/workflows/ci-smoke.yml

@@ -23,46 +23,46 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
           filename: vscode-webdriverio-build.zip
 
       - name: 🗃️ Use cached vscode
-        uses: ./.github/workflows/actions/cache-vscode
+        uses: ./.github/actions/cache-vscode
         with:
           path: e2e/.wdio-vscode-service
 
       - name: 🖥️ Set screen resolution
-        uses: ./.github/workflows/actions/set-screen-resolution
+        uses: ./.github/actions/set-screen-resolution
 
       - name: 🚂 Run the smoke test
         env:
           E2E_SCENARIO: ${{ inputs.scenario }}
-        run: pnpm --filter @vscode-wdio/e2e run test:smoke:${E2E_SCENARIO}
+        run: pnpm --filter @vscode-wdio/e2e run "test:smoke:${E2E_SCENARIO}"
         shell: bash
 
       - name: 📦 Upload Test Logs on Failure
-        uses: ./.github/workflows/actions/upload-archive
+        uses: ./.github/actions/upload-archive
         if: failure()
         with:
           name: smoke-${{ inputs.scenario }}--logs-${{ matrix.os }}
           output: smoke-${{ inputs.scenario }}-logs-${{ matrix.os }}.zip
           paths: e2e/logs
 
       - name: 🐛 Debug Build
-        uses: stateful/[email protected]
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'

.github/workflows/ci-typecheck.yml

@@ -19,17 +19,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .

.github/workflows/ci-unit.yml

@@ -19,17 +19,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: ⬇️ Download Build Archive
-        uses: ./.github/workflows/actions/download-archive
+        uses: ./.github/actions/download-archive
         with:
           name: vscode-webdriverio
           path: .
@@ -40,7 +40,7 @@ jobs:
         shell: bash
 
       - name: 🐛 Debug Build
-        uses: stateful/[email protected]
+        uses: stateful/vscode-server-action@ec99599aefe0bf96d14491e1d5f7e80d30e22247 # v1.1.0
         if: failure()
         with:
           timeout: '180000'

.github/workflows/pr-labeler.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Auto Label Based on Checklist
-        uses: actions/[email protected]
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { owner, repo, number } = context.issue;

.github/workflows/release.yml

@@ -54,21 +54,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 👷 Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: 'main'
           fetch-depth: 0
 
       - name: 🛠️ Setup workspace
-        uses: ./.github/workflows/actions/setup-workspace
+        uses: ./.github/actions/setup-workspace
         with:
           node-version: '20'
 
       - name: 🪄 Generate Prerelease patch version number
         id: gen-pre-release-ver
         env:
           RELEASE_TYPE: ${{ github.event.inputs.releaseType }}
-        uses: actions/[email protected]
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           result-encoding: string
           script: |
@@ -112,6 +112,12 @@ jobs:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
           VSCODE_WDIO_DRY_RUN: ${{ github.event.inputs.dryRun }}
 
+      - name: ✅ Push to remote repository
+        env:
+          DRY_RUN_ARGS: ${{ github.event.inputs.dryRun == 'yes' && '--dry-run' || '' }}
+        run: |
+          git push origin --no-verify --follow-tags "${DRY_RUN_ARGS}"
+
       - name: 📝 Create the Github Release
         run: |
           pnpm --filter @vscode-wdio/release run release-note

.github/workflows/update.yml

@@ -20,15 +20,15 @@ jobs:
     steps:
       - name: Fetch PR metadata
         id: metadata
-        uses: dependabot/[email protected]
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Wait for PR CI
         # Don't merge updates to GitHub Actions versions automatically.
         # (Some repos may wish to limit by version range (major/minor/patch), or scope (dep vs dev-dep), too.)
         if: contains(steps.metadata.outputs.package-ecosystem, 'npm')
-        uses: lewagon/[email protected]
+        uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repo-token: ${{ secrets.GITHUB_TOKEN }}

infra/release/package.json

@@ -5,7 +5,6 @@
   "scripts": {
     "cache-key": "tsx ./src/cacheKey.ts",
     "copy": "tsx ./src/copy.ts",
-    "push": "tsx ./src/push.ts",
     "update-version": "tsx ./src/updatePrereleaseVersion.ts",
     "release-note": "tsx ./src/createRelease.ts",
     "changelog": "tsx ./src/changelog.ts"

packages/vscode-webdriverio/package.json

@@ -38,7 +38,6 @@
     "prepackage:update-version": "pnpm --filter @vscode-wdio/release run update-version",
     "package": "vsce package",
     "publish": "tsx ./scripts/publish.ts",
-    "postpublish": "pnpm --filter @vscode-wdio/release run push",
     "package:next": "pnpm run package --pre-release",
     "publish:next": "pnpm run publish --pre-release",
     "typecheck": "tsc --noEmit --project tsconfig.json",