NIT-Administrative-Systems / northwestern-laravel-starter / 31827549537
100%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 79
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
31827549537

push

github

web-flow 
fix: resolve open Dependabot and code scanning alerts (#153)

* fix(deps): patch js-yaml and form-data advisories in docs

js-yaml 4.3.1 resolves CVE-2026-59870 (quadratic CPU in !!omap
resolution). form-data 4.0.6 resolves the CRLF injection advisory and
is enforced with a pnpm override because httpsnippet still constrains
it below the first patched version.

* ci: harden GitHub Actions security posture

Pin every third-party action to a full commit SHA with a version
comment so mutable tags cannot be rewritten upstream. Read-only jobs
stop checking out the PR head branch (the merge commit is what should
be tested) and disable git credential persistence; the lint job keeps
the head ref because it pushes formatting fixes back. The unit test,
docs validation, smoke test, and docs deployment jobs gain explicit
token permissions, and the release-triggered smoke test disables
setup-node's default package-manager cache to close its poisoning
surface. Resolves the open unpinned-tag, untrusted-checkout, and
missing-workflow-permissions code scanning alerts.

* docs: add security section to the v2.4.0 changelog entry

* ci: adopt actionlint and zizmor workflow linting

A path-filtered lint-workflows job now runs on any .github change:
actionlint 1.7.12 checks workflow correctness (expression typing, needs
wiring, shellcheck on run blocks) and zizmor 1.29.0 audits security
posture. The zizmor policy enforces commit-SHA pinning for every
action, with two rationale'd artipacked suppressions for the checkouts
that must push. First actionlint run findings are fixed here: the unit
test results publisher now declares its determine-scope dependency that
its if condition already read, and workflow scripts drop legacy
backticks, quote GITHUB_OUTPUT, group redirects, and rename an unused
loop variable. The intentional VCS_ARGS word-split carries a shellcheck
directive.

* docs: note workflow linting adoption in the v2.4.0 entry

* style: apply automated formatting

* ci... (continued)

1769 of 1769 relevant lines covered (100.0%)

6.78 hits per line

Jobs
ID Job ID Ran Files Coverage
1 31827549537.1 79
100.0
 GitHub Action Run
Source Files on build 31827549537