activescott / serverless-http-invoker

99%

master: 99%

LAST BUILD ON BRANCH main

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• 0.8.7-next
• 1.0.0-next
• 1.0.1
• 1.0.1-next
• 1.0.2
• beta
• chore/dependabot-auto-merge
• chore/dependabot-ignore-serverless-major
• chore/kill-greenkeeper
• chore/npm-audit-fix
• chore/pin-serverless-v3
• chore/semantic-release-broken-dependency
• chore/up-dev-dependencies
• chore/upgrade-chai-and-chai-as-promised
• ci/oidc-npm-provenance
• core/dependabot-config
• dependabot/npm_and_yarn/axios-1.15.0
• dependabot/npm_and_yarn/axios-1.16.0
• dependabot/npm_and_yarn/axios-1.18.1
• dependabot/npm_and_yarn/axios-1.8.4
• dependabot/npm_and_yarn/chai-4.3.4
• dependabot/npm_and_yarn/chai-4.5.0
• dependabot/npm_and_yarn/coveralls-3.1.0
• dependabot/npm_and_yarn/decompress-4.2.1
• dependabot/npm_and_yarn/examples/basic/decompress-4.2.1
• dependabot/npm_and_yarn/examples/basic/dot-prop-4.2.1
• dependabot/npm_and_yarn/examples/basic/https-proxy-agent-2.2.4
• dependabot/npm_and_yarn/examples/basic/ini-1.3.7
• dependabot/npm_and_yarn/examples/basic/lodash-4.17.14
• dependabot/npm_and_yarn/examples/basic/lodash-4.17.15
• dependabot/npm_and_yarn/examples/basic/lodash-4.17.19
• dependabot/npm_and_yarn/examples/comprehensive/decompress-4.2.1
• dependabot/npm_and_yarn/examples/comprehensive/dot-prop-4.2.1
• dependabot/npm_and_yarn/examples/comprehensive/https-proxy-agent-2.2.4
• dependabot/npm_and_yarn/examples/comprehensive/ini-1.3.8
• dependabot/npm_and_yarn/examples/comprehensive/lodash-4.17.15
• dependabot/npm_and_yarn/examples/comprehensive/lodash-4.17.19
• dependabot/npm_and_yarn/follow-redirects-1.16.0
• dependabot/npm_and_yarn/form-data-2.5.5
• dependabot/npm_and_yarn/handlebars-4.5.3
• dependabot/npm_and_yarn/https-proxy-agent-2.2.4
• dependabot/npm_and_yarn/ini-1.3.7
• dependabot/npm_and_yarn/ini-1.3.8
• dependabot/npm_and_yarn/lodash-4.17.14
• dependabot/npm_and_yarn/lodash-4.17.15
• dependabot/npm_and_yarn/lodash-4.17.19
• dependabot/npm_and_yarn/lodash-4.17.23
• dependabot/npm_and_yarn/lodash-4.18.1
• dependabot/npm_and_yarn/lodash-es-4.17.14
• dependabot/npm_and_yarn/mocha-10.4.0
• dependabot/npm_and_yarn/mocha-11.1.0
• dependabot/npm_and_yarn/mocha-11.7.3
• dependabot/npm_and_yarn/mocha-11.7.6
• dependabot/npm_and_yarn/mocha-8.3.2
• dependabot/npm_and_yarn/multi-456de2e4f1
• dependabot/npm_and_yarn/multi-75e6bc5210
• dependabot/npm_and_yarn/multi-acd8535d99
• dependabot/npm_and_yarn/multi-e9aa88d040
• dependabot/npm_and_yarn/npm-6.14.6
• dependabot/npm_and_yarn/npm-registry-fetch-4.0.5
• dependabot/npm_and_yarn/npm-user-validate-1.0.1
• dependabot/npm_and_yarn/nyc-15.1.0
• dependabot/npm_and_yarn/nyc-18.0.0
• dependabot/npm_and_yarn/picomatch-2.3.2
• dependabot/npm_and_yarn/semantic-release-17.2.3
• dependabot/npm_and_yarn/semantic-release-17.4.2
• dependabot/npm_and_yarn/serverless-3.40.0
• dependabot/npm_and_yarn/ws-7.5.10
• dependabot/npm_and_yarn/ws-7.5.12
• dependabot/npm_and_yarn/y18n-3.2.2
• dependabot/npm_and_yarn/yaml-2.4.1
• dependabot/npm_and_yarn/yaml-2.7.1
• dependabot/npm_and_yarn/yaml-2.8.3
• dependabot/npm_and_yarn/yaml-2.9.0
• docs/version-support-notice
• feat/drop-node-14-16-18
• fix/ci-publish-node-24
• greenkeeper/coveralls-3.0.10
• greenkeeper/coveralls-3.0.11
• greenkeeper/coveralls-3.0.6
• greenkeeper/coveralls-3.0.7
• greenkeeper/coveralls-3.0.8
• greenkeeper/coveralls-3.0.9
• greenkeeper/default/serverless-1.49.0
• greenkeeper/default/serverless-1.50.0
• greenkeeper/default/serverless-1.50.1
• greenkeeper/default/serverless-1.51.0
• greenkeeper/default/serverless-1.52.0
• greenkeeper/default/serverless-1.52.1
• greenkeeper/default/serverless-1.52.2
• greenkeeper/default/serverless-1.53.0
• greenkeeper/default/serverless-1.54.0
• greenkeeper/default/serverless-1.55.0
• greenkeeper/default/serverless-1.55.1
• greenkeeper/default/serverless-1.56.1
• greenkeeper/default/serverless-1.57.0
• greenkeeper/default/serverless-1.58.0
• greenkeeper/default/serverless-1.59.0
• greenkeeper/default/serverless-1.59.1
• greenkeeper/default/serverless-1.59.2
• greenkeeper/default/serverless-1.59.3
• greenkeeper/default/serverless-1.60.0
• greenkeeper/default/serverless-1.60.1
• greenkeeper/default/serverless-1.60.2
• greenkeeper/default/serverless-1.60.3
• greenkeeper/default/serverless-1.60.4
• greenkeeper/default/serverless-1.61.2
• greenkeeper/default/serverless-1.66.0
• greenkeeper/default/serverless-1.67.0
• greenkeeper/initial
• greenkeeper/mocha-6.2.1
• greenkeeper/mocha-6.2.2
• greenkeeper/mocha-7.0.1
• greenkeeper/mocha-7.1.1
• greenkeeper/nyc-15.0.0
• greenkeeper/nyc-15.0.1
• greenkeeper/prettier-1.19.0
• greenkeeper/prettier-1.19.1
• greenkeeper/semantic-release-16.0.0
• greenkeeper/semantic-release-16.0.1
• greenkeeper/semantic-release-16.0.4
• greenkeeper/semantic-release-17.0.0
• greenkeeper/semantic-release-17.0.1
• greenkeeper/semantic-release-17.0.2
• greenkeeper/semantic-release-17.0.3
• greenkeeper/semantic-release-17.0.4
• greenkeeper/serverless-pin-1.61.3
• main
• master
• misc-updates
• patch-readme
• v0.0.0-prerelease
• v0.8.7-next
• v1.0.2
• v1.0.3
• v1.0.4
• v1.0.5

Build # 29784998629

Build Type

push

github

Committed by web-flow

Commit Message

ci: guard against Serverless Framework v4 upgrades (#206)

* ci: guard against Serverless Framework v4 upgrades

Dependabot ignore/allow rules in dependabot.yml apply only to version
updates. Security updates bypass both and bump ancestor dependencies
(e.g. serverless v3 -> v4) to fix vulnerable transitive deps. Combined
with the dependabot auto-merge workflow, such a PR could merge silently.

Add a guard-serverless-v3 workflow that fails when serverless v4+
appears in any package.json or package-lock.json. The job
(serverless_version_check) is a required status check on main so it
blocks auto-merge.

* ci: check peerDependencies and harden version extraction in serverless guard

The root package.json declares serverless as a peerDependency, which
the guard previously did not check. Check peerDependencies and
optionalDependencies sections in addition to dependencies and
devDependencies. Also make the major-version grep non-fatal for ranges
without digits so pipefail does not abort the step.

Coverage Stats

29 of 32 branches covered (90.63%)

Branch coverage included in aggregate %.

238 of 238 relevant lines covered (100.0%)

72.13 hits per line