Headline
CVE-2021-21421: Fix #17 do not report secret on error, add github action · creharmony/node-etsy-client@b4beb8e
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
@@ -0,0 +1,66 @@
node-etsy-client continuous integration
name: etsy_client_ci
Controls when the action will run.
on:
Triggers the workflow on pull request or push (only for the npmjs branch)
push:
branches: [ npmjs ]
pull_request:
Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
This workflow contains a single job called “build”
build:
The type of runner that the job will run on
runs-on: ubuntu-latest
env:
ETSY_SHOP: fakefakefakefake
strategy:
matrix:
See supported Node.js release schedule at https://nodejs.org/en/about/releases/
node-version: [10.x, 12.x, 14.x, 15.x]
node-version: [12.x]
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v1
with:
node-version: ${{ matrix.node-version }}
- name: Cache dependencies
uses: actions/cache@v2
with:
path: |
**/node_modules
key: ${{ runner.os }}-${{ hashFiles(‘**/package-lock.json’) }}
- name: Install dependencies
- run: npm ci # need package.json.lock
run: npm install
- name: Run ci-tests with code coverage
run: npm run ci-test
- name: Report coverage to the PR
continue-on-error: true
uses: romeovs/[email protected]
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
lcov-file: ./coverage/lcov.info
- name: Publish NpmJS package
if: github.ref == ‘refs/heads/npmjs’
run: |
echo “//registry.npmjs.org/:_authToken=${{ secrets.NPM_DEPLOY_TOKEN }}” > .npmrc
npm whoami # rely on .npmrc
npm publish