activescott / serverless-http-invoker / 29784998629

99%

master: 99%

push

github

ci: guard against Serverless Framework v4 upgrades (#206)

* ci: guard against Serverless Framework v4 upgrades

Dependabot ignore/allow rules in dependabot.yml apply only to version
updates. Security updates bypass both and bump ancestor dependencies
(e.g. serverless v3 -> v4) to fix vulnerable transitive deps. Combined
with the dependabot auto-merge workflow, such a PR could merge silently.

Add a guard-serverless-v3 workflow that fails when serverless v4+
appears in any package.json or package-lock.json. The job
(serverless_version_check) is a required status check on main so it
blocks auto-merge.

* ci: check peerDependencies and harden version extraction in serverless guard

The root package.json declares serverless as a peerDependency, which
the guard previously did not check. Check peerDependencies and
optionalDependencies sections in addition to dependencies and
devDependencies. Also make the major-version grep non-fatal for ranges
without digits so pipefail does not abort the step.

29 of 32 branches covered (90.63%)

Branch coverage included in aggregate %.

238 of 238 relevant lines covered (100.0%)

72.13 hits per line