sync: update from private repo (2336949a)

2026-09-17 11:29:31 +00:00
parent 28f74c4e37
commit 57702b4f34
2139 changed files with 321270 additions and 17494 deletions
@@ -0,0 +1,28 @@
+import { readFile } from 'node:fs/promises';
+
+import { describe, expect, it } from 'vitest';
+
+const workflowPath = new URL('../../.gitea/workflows/ci.yml', import.meta.url);
+
+describe('untrusted pull request CI', () => {
+  it('does not use a privileged PR trigger or shared npm cache', async () => {
+    const workflow = await readFile(workflowPath, 'utf8');
+
+    expect(workflow).not.toMatch(/\bpull_request_target\s*:/);
+    expect(workflow).not.toMatch(/^\s+cache:\s*npm\s*$/m);
+    expect(workflow).toMatch(/\bpermissions:\s*\n\s+contents:\s*read\b/);
+  });
+
+  it('checks lockfiles before installing without lifecycle scripts', async () => {
+    const workflow = await readFile(workflowPath, 'utf8');
+    const policyIndex = workflow.indexOf('node scripts/security/dependency-policy.mjs');
+    const installIndex = workflow.indexOf('npm ci --ignore-scripts');
+
+    expect(policyIndex).toBeGreaterThan(-1);
+    expect(installIndex).toBeGreaterThan(policyIndex);
+    expect(workflow).toContain('npm --prefix ui ci --ignore-scripts');
+    expect(workflow).toContain('node scripts/security/rebuild-native.mjs');
+    expect(workflow).toContain('persist-credentials: false');
+    expect(workflow).not.toMatch(/^\s+npm ci\s*$/m);
+  });
+});