mirror of
https://github.com/ilammy/msvc-dev-cmd.git
synced 2026-09-07 06:07:19 +08:00
ilammy
ddf4cb029f
Set the threshold to "moderate" and above. Currently msvc-dev-cmd has an issue in transitive dev-dependency "minimist" [1] via somewhat long chain of dependencies: - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist - eslint > mkdirp > minimist In order for this to be resolved all these packages need to do something about their pinned versions. I don't want to sit there with a red build because of some possible low-severity prototype pollution in dev dependency. Anything higher -- okay, I'll look at at, and apply a fix if necessary. (Maybe we should not audit dev dependencies at all...) This particular vulnerability can be exploited by an attacker who can submit a pull request and do "something bad"™ to Actions runners executing jobs for this repository. However, since it's a dev dependency, nothing will happen to our users. So we can safely ignore this advisory. [1]: https://npmjs.com/advisories/1179
38 lines
760 B
YAML
38 lines
760 B
YAML
name: msvc-dev-cmd
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- master
|
|
- release/*
|
|
schedule:
|
|
- cron: '0 6 * * *'
|
|
|
|
jobs:
|
|
test:
|
|
name: default
|
|
runs-on: windows-latest
|
|
strategy:
|
|
fail-fast: false
|
|
steps:
|
|
- name: Check out source code
|
|
uses: actions/checkout@v1
|
|
- name: Download Internet
|
|
run: npm install
|
|
- name: Enable Developer Command Prompt
|
|
uses: ./
|
|
- name: Compile and run some C code
|
|
shell: cmd
|
|
run: |
|
|
cl.exe hello.c
|
|
hello.exe
|
|
audit:
|
|
name: npm audit
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Check out source code
|
|
uses: actions/checkout@v1
|
|
- run: npm install
|
|
- run: npm audit --audit-level=moderate
|