From 3081df16f792f9600eb42f90a3d122e24fe87e56 Mon Sep 17 00:00:00 2001 From: Vida Xie Date: Mon, 20 Jul 2026 22:59:51 +0800 Subject: [PATCH 1/5] ci: setup `e18e/action-dependency-diff` --- .github/workflows/bundle-diff.yml | 70 +++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/workflows/bundle-diff.yml diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml new file mode 100644 index 0000000..eb141bf --- /dev/null +++ b/.github/workflows/bundle-diff.yml @@ -0,0 +1,70 @@ +name: Dependency Diff + +on: + pull_request: + +jobs: + build-main: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: main + - name: Setup JS + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 + + - name: Build + run: pnpm build + - name: Pack + run: pnpm pack -r -F "./packages/**" + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: base-packages + path: '*.tgz' + + build-pr: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Setup JS + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 + + - name: Build + run: pnpm build + - name: Pack + run: pnpm pack -r -F "./packages/**" + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: source-packages + path: '*.tgz' + + diff_dependencies: + runs-on: ubuntu-latest + needs: [build-main, build-pr] + permissions: + issues: write + pull-requests: write + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 # allows the diff action to access git history + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: base-packages + path: ./base-packages + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: source-packages + path: ./source-packages + - name: Create Diff + uses: e18e/action-dependency-diff@8e9b8c1957ab066d36235a43f4c1ff1522e1bdbc # v1.6.1 + with: + base-packages: ./base-packages/*.tgz + source-packages: ./source-packages/*.tgz + pack-size-threshold: -1 + size-threshold: -1 From 6f7cac474413e4885e57aa99d4b982c98fbfef26 Mon Sep 17 00:00:00 2001 From: Vida Xie Date: Mon, 20 Jul 2026 23:12:04 +0800 Subject: [PATCH 2/5] ci: fix CodeQL workflow permissions and suppress duplicate dep report --- .github/workflows/bundle-diff.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml index eb141bf..f5459a8 100644 --- a/.github/workflows/bundle-diff.yml +++ b/.github/workflows/bundle-diff.yml @@ -6,6 +6,8 @@ on: jobs: build-main: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -26,6 +28,8 @@ jobs: build-pr: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -68,3 +72,4 @@ jobs: source-packages: ./source-packages/*.tgz pack-size-threshold: -1 size-threshold: -1 + duplicate-threshold: 0 From 1b9821c34029f42104a1bbdfadf6d0e87b9cd9e6 Mon Sep 17 00:00:00 2001 From: Vida Xie Date: Mon, 20 Jul 2026 23:24:54 +0800 Subject: [PATCH 3/5] ci: upgrade e18e/action-dependency-diff to skip duplicate scan --- .github/workflows/bundle-diff.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml index f5459a8..d3f7fbc 100644 --- a/.github/workflows/bundle-diff.yml +++ b/.github/workflows/bundle-diff.yml @@ -66,7 +66,7 @@ jobs: name: source-packages path: ./source-packages - name: Create Diff - uses: e18e/action-dependency-diff@8e9b8c1957ab066d36235a43f4c1ff1522e1bdbc # v1.6.1 + uses: e18e/action-dependency-diff@3648e18f3cb944fbc79b52b7febc153a8b5381cb # fix: disable duplicate checks when threshold <= 0 with: base-packages: ./base-packages/*.tgz source-packages: ./source-packages/*.tgz From 71806b52f07aeafcba366056d0d1f1ca51cc4447 Mon Sep 17 00:00:00 2001 From: Vida Xie Date: Mon, 20 Jul 2026 23:39:27 +0800 Subject: [PATCH 4/5] ci: use -1 for duplicate-threshold in bundle-diff --- .github/workflows/autofix.yml | 2 +- .github/workflows/bundle-diff.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/unit-test.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml index d0a8da3..11ef934 100644 --- a/.github/workflows/autofix.yml +++ b/.github/workflows/autofix.yml @@ -13,7 +13,7 @@ jobs: contents: read steps: - name: Setup JS - uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0 + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 with: no-frozen-lockfile: true diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml index d3f7fbc..05ec1e2 100644 --- a/.github/workflows/bundle-diff.yml +++ b/.github/workflows/bundle-diff.yml @@ -72,4 +72,4 @@ jobs: source-packages: ./source-packages/*.tgz pack-size-threshold: -1 size-threshold: -1 - duplicate-threshold: 0 + duplicate-threshold: -1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 611d070..2610814 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-slim steps: - name: Setup JS - uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0 + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 with: fetch-all: true diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index fe59261..a6189db 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -17,7 +17,7 @@ jobs: permissions: {} steps: - name: Setup JS - uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0 + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 - name: Build run: pnpm build @@ -36,7 +36,7 @@ jobs: permissions: {} steps: - name: Setup JS - uses: sxzz/workflows/setup-js@69098296b6f6083ed99f38e2040f2a7238580e27 # v1.4.0 + uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 with: node-version: ${{ matrix.node-version }} From 700c5ece5e8e1d267803bfbde2ddbdf50c269962 Mon Sep 17 00:00:00 2001 From: Vida Xie Date: Mon, 20 Jul 2026 23:54:41 +0800 Subject: [PATCH 5/5] ci: fix bundle-diff workflow security and tarball packaging --- .github/workflows/bundle-diff.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/bundle-diff.yml b/.github/workflows/bundle-diff.yml index 05ec1e2..4c43e4b 100644 --- a/.github/workflows/bundle-diff.yml +++ b/.github/workflows/bundle-diff.yml @@ -13,18 +13,19 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main + persist-credentials: false - name: Setup JS uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 - name: Build run: pnpm build - name: Pack - run: pnpm pack -r -F "./packages/**" + run: pnpm pack -r --pack-destination ./tarballs -F "./packages/**" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: base-packages - path: '*.tgz' + path: ./tarballs/*.tgz build-pr: runs-on: ubuntu-latest @@ -33,23 +34,26 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Setup JS uses: sxzz/workflows/setup-js@dd67f194be6388e12ee61ad0cd3b81cf74bfd294 - name: Build run: pnpm build - name: Pack - run: pnpm pack -r -F "./packages/**" + run: pnpm pack -r --pack-destination ./tarballs -F "./packages/**" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: source-packages - path: '*.tgz' + path: ./tarballs/*.tgz diff_dependencies: runs-on: ubuntu-latest needs: [build-main, build-pr] permissions: + contents: read issues: write pull-requests: write steps: @@ -57,6 +61,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # allows the diff action to access git history + persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: base-packages