chore(deps): bump @types/node from 20.19.43 to 26.1.2 #142
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # L9 analysis caller — copied from Quantum-L9/l9-ci-core docs/templates/l9-analysis.yml | |
| # Adapted for Node.js/TypeScript: semgrep ruleset dropped p/python (see | |
| # governance README "Python vs Node.js — what changes, what doesn't"). | |
| # | |
| # Topology (this is the wiring that actually works): | |
| # job analyze -> generates the semgrep report and runs the SDK pipeline in ONE | |
| # job so the freshly-generated report is on the same filesystem | |
| # (the reusable normalize workflow re-checks-out github.sha and | |
| # would NOT see an uncommitted report). | |
| # job publish -> calls Core's publish-analysis.yml, which DOWNLOADS the | |
| # uploaded artifact (no report-in-tree needed) and publishes the | |
| # GitHub check per the resolved governance mode. | |
| # | |
| # Prerequisite: .github/governance/*.yaml (the CI instantiation pack the | |
| # resolver reads) — copied alongside this file from l9-ci-core's governance pack. | |
| name: L9 Analysis | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: l9-analysis-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| # Pin Core to the immutable release commit (or replace with the v2 tag). | |
| L9_CORE_REF: "f88116503430aa18992b70d8d31063e34ff97ef1" | |
| # Match the event: pr_fast for pull_request, merge for push, nightly/release/ | |
| # supply_chain as appropriate. Must be allowed_events in execution-profiles.yaml. | |
| L9_PROFILE: "pr_fast" | |
| L9_MATRIX_ID: "pr-semgrep" | |
| jobs: | |
| analyze: | |
| name: Analyze (semgrep -> SDK) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| outputs: | |
| mode: ${{ steps.gov.outputs.mode }} | |
| enabled: ${{ steps.gov.outputs.enabled }} | |
| artifact-name: ${{ steps.names.outputs.artifact-name }} | |
| governance-digest: ${{ steps.gov.outputs.governance-digest }} | |
| steps: | |
| - name: Checkout immutable event revision | |
| env: | |
| REPOSITORY: ${{ github.repository }} | |
| REVISION: ${{ github.sha }} | |
| TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| git init . | |
| git remote add origin \ | |
| "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git" | |
| git -c protocol.version=2 fetch --depth=1 origin "${REVISION}" | |
| git checkout --detach FETCH_HEAD | |
| git remote set-url origin "https://github.com/${REPOSITORY}.git" | |
| - id: gov | |
| name: Resolve governance (Core) | |
| uses: Quantum-L9/l9-ci-core/.github/actions/resolve-governance@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| profile: ${{ env.L9_PROFILE }} | |
| provider: semgrep | |
| event-name: ${{ github.event_name }} | |
| repository: ${{ github.repository }} | |
| ref: ${{ github.ref }} | |
| governance-root: .github/governance | |
| - id: names | |
| name: Resolve artifact name | |
| env: | |
| MATRIX_ID: ${{ env.L9_MATRIX_ID }} | |
| run: | | |
| set -euo pipefail | |
| echo "artifact-name=l9-semgrep-${MATRIX_ID}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT" | |
| - name: Run semgrep (produce raw report) | |
| if: steps.gov.outputs.enabled == 'true' | |
| run: | | |
| set -euo pipefail | |
| python -m pip install 'pip==26.1.2' 'semgrep==1.170.1' | |
| mkdir -p "artifacts/raw/semgrep/${L9_MATRIX_ID}" | |
| # Node.js repo ruleset — JS/TS only (no p/python; this repo is TypeScript). | |
| semgrep scan \ | |
| --config p/javascript \ | |
| --config p/typescript \ | |
| --json \ | |
| --output "artifacts/raw/semgrep/${L9_MATRIX_ID}/report.json" \ | |
| --error --quiet || true | |
| env: | |
| L9_MATRIX_ID: ${{ env.L9_MATRIX_ID }} | |
| - id: sdk | |
| name: Provision immutable SDK | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| - name: Normalize provider report | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/invoke-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| executable: ${{ steps.sdk.outputs.executable }} | |
| operation: semgrep-normalize | |
| input: artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/report.json | |
| output: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json | |
| root: . | |
| snapshot-id: ${{ github.sha }} | |
| revision: ${{ github.sha }} | |
| strict: ${{ steps.gov.outputs.strict }} | |
| required: ${{ steps.gov.outputs.required-provider }} | |
| policy: ${{ steps.gov.outputs.sdk-policy }} | |
| - name: Validate canonical bundle | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/validate-bundle@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| executable: ${{ steps.sdk.outputs.executable }} | |
| bundle: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json | |
| - name: Project agent-review payload | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/invoke-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| executable: ${{ steps.sdk.outputs.executable }} | |
| operation: bundle-project-agent-payload | |
| input: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json | |
| output: .l9/runtime/${{ env.L9_MATRIX_ID }}/agent-review-payload.json | |
| strict: ${{ steps.gov.outputs.strict }} | |
| - id: route | |
| name: Route artifacts | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/route-artifacts@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| provider: semgrep | |
| matrix-id: ${{ env.L9_MATRIX_ID }} | |
| raw-report: artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/report.json | |
| bundle: .l9/runtime/${{ env.L9_MATRIX_ID }}/finding-bundle.json | |
| agent-payload: .l9/runtime/${{ env.L9_MATRIX_ID }}/agent-review-payload.json | |
| destination-root: artifacts | |
| - name: Build artifact manifest | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/actions/build-artifact-manifest@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| with: | |
| provider: semgrep | |
| matrix-id: ${{ env.L9_MATRIX_ID }} | |
| sdk-revision: ${{ steps.sdk.outputs.sdk-revision }} | |
| bundle: ${{ steps.route.outputs.bundle }} | |
| agent-payload: ${{ steps.route.outputs.agent-payload }} | |
| raw-directory: ${{ steps.route.outputs.raw-directory }} | |
| output: artifacts/metadata/${{ env.L9_MATRIX_ID }}/artifact-manifest.json | |
| - name: Upload analysis artifact set | |
| if: steps.gov.outputs.enabled == 'true' | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: ${{ steps.names.outputs.artifact-name }} | |
| path: | | |
| artifacts/raw/semgrep/${{ env.L9_MATRIX_ID }}/ | |
| artifacts/l9/${{ env.L9_MATRIX_ID }}/ | |
| artifacts/metadata/${{ env.L9_MATRIX_ID }}/ | |
| if-no-files-found: error | |
| retention-days: 14 | |
| publish: | |
| name: Publish analysis (Core) | |
| needs: analyze | |
| if: needs.analyze.outputs.enabled == 'true' | |
| uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1 | |
| permissions: | |
| actions: read | |
| checks: write | |
| contents: read | |
| with: | |
| artifact-name: ${{ needs.analyze.outputs.artifact-name }} | |
| profile: pr_fast | |
| mode: ${{ needs.analyze.outputs.mode }} | |
| provider: semgrep | |
| matrix-id: pr-semgrep | |
| governance-digest: ${{ needs.analyze.outputs.governance-digest }} | |
| repository-revision: ${{ github.sha }} | |
| workflow-result: ${{ needs.analyze.result }} |