Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: bump dependencies to resolve security issues #169

Merged
merged 3 commits into from
Oct 13, 2020
Merged

fix: bump dependencies to resolve security issues #169

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
78deb3b
fix: bump dependencies to resolve security issues
magicmatatjahu Oct 13, 2020
bdc4a8b
feat: add sleep in release workflow
magicmatatjahu Oct 13, 2020
7b066e1
feat: update workflow
magicmatatjahu Oct 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@ jobs:
GIT_COMMITTER_NAME: asyncapi-bot
GIT_COMMITTER_EMAIL: info@asyncapi.io
run: npm run release
# Sleep for 10 seconds before using latest version in playground, because sometimes NPM needs additional few seconds to `save` package in registry
- name: Sleep for 10 seconds
uses: jakejarvis/wait-action@master
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please use something different, this action looks nifty but as you can see it is always fetched from master 😱 which is super unsecure. Unfortunately the user doesn't seem to provide regular professional releases

why not just sleep 30s && npm install @kyma-project/asyncapi-react@${{ steps.extractver.outputs.version }} -s in the playground step?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you are right, I changed it to sleep 10 && ...

with:
time: '10s'
- name: Get version from package.json after release step
id: extractver
run: echo "::set-output name=version::$(npm run get-lib-version --silent)"
Expand Down
Loading