adk23333/github-pages-deploy-action
1
0
Fork 0
mirror of https://github.com/JamesIves/github-pages-deploy-action.git synced 2023-12-15 20:03:39 +08:00
Code Issues Packages Projects Releases Wiki Activity
4f4d7a7b17
github-pages-deploy-action/SECURITY.md

15 lines
458 B
Markdown
Raw Normal View History

Create SECURITY.md
2020-05-10 05:27:41 +08:00
# Security Policy
## Supported Versions
[Release] Version 4 (#589) * Stop checking out workspace (#515) * Stop checking out base branch before deployment, drop option. * Don't check out default branch, as we don't check out base branch, drop option. * Don't stash/unstash as we don't update the workdir, drop preserve option. * Don't init the workspace * Only fetch the remote branch if it exists, only with depth 1. * Rely on previous checkouts to have handled lfs files correctly, drop option. * Update README, action.yml, integration tests * Set up eslint for test files. (#517) * Add DRY_RUN option, passing --dry-run to git push. (#526) See #499 for the proposal. * Simplifies Token Setup (#530) * Token simplification * Access Token / Github Token -> Token * Oops * Typos * Update README.md * Update README.md * Update action.yml Co-authored-by: Axel Hecht <axel@pike.org> * Update README.md Co-authored-by: Axel Hecht <axel@pike.org> * Update README.md Co-authored-by: Axel Hecht <axel@pike.org> * Adjust codeql action to latest recommendations (#540) Also, add the dev and release branches, and drop master. * Add workflow to update build and node_modules on release branches (#541) * Stores username/email in secrets * Removing stale bot integration * Test current code base as an integration test for PRs and pushes (#505) * Add a build step to create lib and node_modules artifact * Run integration test with built dist and current SHA as base For pull requests, the github.sha is the sha of the merge to the target branch, not the head of the PR. Special case that. * Use v2 checkout, and DRY_RUN for the integration test. I also made the branches more generic, as there are now more of them. * Fix #536, don't push at all on dryRun Also add tests for dryRun and singleCommit and generateBranch code flows. * Try to fix dryRun on new remote branches, refactor fetch * Try to fix dryRun, only fetch if origin branch exists * Refactor worktree setup to include branch generation and setup for singleCommit This is a continuation of the no-checkout work, and sadly suggested pretty intensive changes. * Set up git config to fix tests, also make debugging easier * Add matrix for existing and non-existing branch * Add matrix for singleCommit and not * Drop GITHUB_TOKEN, add DRY_RUN to action.yml * When deploying existing branch, add a modifcation and deploy again * Force branch checkout to work in redeployment scenarios * Make singleCommit easier to see in job descriptions * Review comments * Add a test-only property to action to test code paths with remote branch. * Introduce TestFlag enum to signal different test scenarios to unit tests * Fix util.test.ts * Update worktree.ts * Fix a few nits in tests and automation. Don't try to wordcount ls-rem… (#546) * Fix a few nits in tests and automation. Don't try to wordcount ls-remote. Nits in tests are around undoing changes made to the environment, and to not modify the checkout. * Describe suite with empty SHA * Lowercase Inputs (#547) * Lowercases inputs * Adjusts workflow tests and deployment_status * Use multi-line string for clean-exclude patterns. (#553) As this change is subtle, I'm taking the opportunity to change the underscore for the hyphen, which makes it less likely that users of this action will just pass in an old json array. * Hyphenate inputs and outputs, add step output, fix #558 (#559) * Hyphenate inputs and outputs, add step output, fix #558 I've also tried to make the clean docs a bit clearer, and consistent about clean being on my default. Still not totally happy with the intro of the docs there, though. * Add testing of step outputs to build integration tests * Security Docs * Integration tests * Revert "Integration tests" This reverts commit 639ff537d5bf88b668efb3a56d361e2a03f008c9. * Native SSH Key Support (#569) * SSH Key Support :key: * Update ssh.ts * Update src/ssh.ts Co-authored-by: Axel Hecht <axel@pike.org> * README fixes/etc * Unit Tests & README * ssh key * Update README.md * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update integration.yml Co-authored-by: Axel Hecht <axel@pike.org> * Deployment Issues (#583) * Update git.ts * Tests * Update git.ts * Formatting * Update src/git.ts Co-authored-by: Axel Hecht <axel@pike.org> * TestFlag * Logging * Update git.ts Co-authored-by: Axel Hecht <axel@pike.org> * Codespace Support (#584) * Add files via upload * Update README.md * Add files via upload * Update README.md * Update README.md * Update README.md * Update README.md * Update README.md * SSH Issues (#588) * Unsets Persisted Credentials (#587) * Persist * Config Setup/Tests * Assets * Update git.ts * Spacing * Update integration.yml * Update README.md Co-authored-by: Axel Hecht <axel@pike.org>
2021-02-06 11:05:18 +08:00
The current version is actively maintained and will receive frequent updates and security patches.
Create SECURITY.md
2020-05-10 05:27:41 +08:00
| Version | Supported |
| ------- | ------------------ |
[Release] Version 4 (#589) * Stop checking out workspace (#515) * Stop checking out base branch before deployment, drop option. * Don't check out default branch, as we don't check out base branch, drop option. * Don't stash/unstash as we don't update the workdir, drop preserve option. * Don't init the workspace * Only fetch the remote branch if it exists, only with depth 1. * Rely on previous checkouts to have handled lfs files correctly, drop option. * Update README, action.yml, integration tests * Set up eslint for test files. (#517) * Add DRY_RUN option, passing --dry-run to git push. (#526) See #499 for the proposal. * Simplifies Token Setup (#530) * Token simplification * Access Token / Github Token -> Token * Oops * Typos * Update README.md * Update README.md * Update action.yml Co-authored-by: Axel Hecht <axel@pike.org> * Update README.md Co-authored-by: Axel Hecht <axel@pike.org> * Update README.md Co-authored-by: Axel Hecht <axel@pike.org> * Adjust codeql action to latest recommendations (#540) Also, add the dev and release branches, and drop master. * Add workflow to update build and node_modules on release branches (#541) * Stores username/email in secrets * Removing stale bot integration * Test current code base as an integration test for PRs and pushes (#505) * Add a build step to create lib and node_modules artifact * Run integration test with built dist and current SHA as base For pull requests, the github.sha is the sha of the merge to the target branch, not the head of the PR. Special case that. * Use v2 checkout, and DRY_RUN for the integration test. I also made the branches more generic, as there are now more of them. * Fix #536, don't push at all on dryRun Also add tests for dryRun and singleCommit and generateBranch code flows. * Try to fix dryRun on new remote branches, refactor fetch * Try to fix dryRun, only fetch if origin branch exists * Refactor worktree setup to include branch generation and setup for singleCommit This is a continuation of the no-checkout work, and sadly suggested pretty intensive changes. * Set up git config to fix tests, also make debugging easier * Add matrix for existing and non-existing branch * Add matrix for singleCommit and not * Drop GITHUB_TOKEN, add DRY_RUN to action.yml * When deploying existing branch, add a modifcation and deploy again * Force branch checkout to work in redeployment scenarios * Make singleCommit easier to see in job descriptions * Review comments * Add a test-only property to action to test code paths with remote branch. * Introduce TestFlag enum to signal different test scenarios to unit tests * Fix util.test.ts * Update worktree.ts * Fix a few nits in tests and automation. Don't try to wordcount ls-rem… (#546) * Fix a few nits in tests and automation. Don't try to wordcount ls-remote. Nits in tests are around undoing changes made to the environment, and to not modify the checkout. * Describe suite with empty SHA * Lowercase Inputs (#547) * Lowercases inputs * Adjusts workflow tests and deployment_status * Use multi-line string for clean-exclude patterns. (#553) As this change is subtle, I'm taking the opportunity to change the underscore for the hyphen, which makes it less likely that users of this action will just pass in an old json array. * Hyphenate inputs and outputs, add step output, fix #558 (#559) * Hyphenate inputs and outputs, add step output, fix #558 I've also tried to make the clean docs a bit clearer, and consistent about clean being on my default. Still not totally happy with the intro of the docs there, though. * Add testing of step outputs to build integration tests * Security Docs * Integration tests * Revert "Integration tests" This reverts commit 639ff537d5bf88b668efb3a56d361e2a03f008c9. * Native SSH Key Support (#569) * SSH Key Support :key: * Update ssh.ts * Update src/ssh.ts Co-authored-by: Axel Hecht <axel@pike.org> * README fixes/etc * Unit Tests & README * ssh key * Update README.md * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update ssh.test.ts * Update integration.yml Co-authored-by: Axel Hecht <axel@pike.org> * Deployment Issues (#583) * Update git.ts * Tests * Update git.ts * Formatting * Update src/git.ts Co-authored-by: Axel Hecht <axel@pike.org> * TestFlag * Logging * Update git.ts Co-authored-by: Axel Hecht <axel@pike.org> * Codespace Support (#584) * Add files via upload * Update README.md * Add files via upload * Update README.md * Update README.md * Update README.md * Update README.md * Update README.md * SSH Issues (#588) * Unsets Persisted Credentials (#587) * Persist * Config Setup/Tests * Assets * Update git.ts * Spacing * Update integration.yml * Update README.md Co-authored-by: Axel Hecht <axel@pike.org>
2021-02-06 11:05:18 +08:00
| 4.0.x | :white_check_mark: |
| < 3.0 | :x: |
Create SECURITY.md
2020-05-10 05:27:41 +08:00
## Reporting a Vulnerability
Update SECURITY.md
2020-05-11 07:46:07 +08:00
Please disclose any security vulnerabilities either through the issues interface (as a bug) or by [emailing the project maintainer](https://jamesiv.es).
Reference in New Issue Copy Permalink