mirror of
https://github.com/ilammy/msvc-dev-cmd.git
synced 2026-09-07 06:07:19 +08:00
Alexei Lozovsky
74a501b087
* Update glob-parent to resolve CVE-2020-28469 * Run audit tasks on Ubuntu runners (they are cheaper) * Audit only production dependencies That is, something that can actually affect users of this action. I don't really want to be bothered with yet another "prototype pollution" or "denial of service" in transitive dependencies of eslint. * Audit dev-dependencies for critical vulnerabilities That said, still audit development dependencies for critical vulnerabilities if they come along. Hopefully, this should be rare.
32 lines
697 B
YAML
32 lines
697 B
YAML
name: msvc-dev-cmd (release)
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- release/*
|
|
schedule:
|
|
- cron: '0 6 * * *'
|
|
|
|
jobs:
|
|
test:
|
|
name: release
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Setup Developer Command Prompt
|
|
uses: ilammy/msvc-dev-cmd@v1
|
|
- name: Check out source code
|
|
uses: actions/checkout@v2
|
|
- name: Compile and run some C code
|
|
shell: cmd
|
|
run: |
|
|
cl.exe hello.c
|
|
hello.exe
|
|
audit:
|
|
name: npm audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source code
|
|
uses: actions/checkout@v2
|
|
- run: npm audit --audit-level=moderate --production
|
|
- run: npm audit --audit-level=critical
|