Some time ago GitHub has introduced an alternative version of Windows
virtual environment. One of those is possibly untested in this repo.
Let's test both of them.
Audit tasks and side tracks are still using "windows-latest" because we
don't particularly care about them. However, main tests should be run
against both versions.
You can find currently supported environments here:
https://github.com/actions/virtual-environments/
By a public request, let's support aliases for architecture parameters.
Treat "arch: Win32" as "x86" and "Win64" as "x64".
Test this on CI just in case x86 breaks or something.
Set the threshold to "moderate" and above. Currently msvc-dev-cmd has
an issue in transitive dev-dependency "minimist" [1] via somewhat long
chain of dependencies:
- eslint > file-entry-cache > flat-cache > write > mkdirp > minimist
- eslint > mkdirp > minimist
In order for this to be resolved all these packages need to do something
about their pinned versions. I don't want to sit there with a red build
because of some possible low-severity prototype pollution in dev
dependency. Anything higher -- okay, I'll look at at, and apply a fix
if necessary. (Maybe we should not audit dev dependencies at all...)
This particular vulnerability can be exploited by an attacker who can
submit a pull request and do "something bad"™ to Actions runners
executing jobs for this repository. However, since it's a dev
dependency, nothing will happen to our users. So we can safely ignore
this advisory.
[1]: https://npmjs.com/advisories/1179
I'd like to be notified about weird vulnerabilities in JavaScript
libraries for the release branch as well. It's double important
since the release branch ships particular pinned version of *all*
dependencies.
It's not like we need any new features, but let's bump the versions
because we are in JavaScript land.
Also, run "npm audit" regularly, just in case a serious vulnerability
is discovered.
Well, it seems the environment is changing so we'd better run the tests
reguarly to see whether something breaks in a timely manner.
GitHub Actions also don't offer other Windows environments now, only
windows-latest is available. Reduce test matrix to only that.
Try compiling some C code, If it works then we're probably fine.
I don't even try to verify cross-compilation because I don't need it.
It should work, but that's not my problem right now.
Now that I know how to write some simple action, let's make a stub
more complete. For example, I already know what inputs I would like
to handle for this action.
Alexei Lozovsky
Ewout ter Hoeven