-
Notifications
You must be signed in to change notification settings - Fork 3
refactor: earn flow + remove xstate/store #551
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
8f6710c
15d72af
3127f0d
5dac944
2110846
90a2b21
b2043f0
3c5bfdc
67eb76f
0d6ed5f
98e4c72
7f4ea37
d00f44e
3870423
3dabf4a
9714f3d
df4abba
299528b
533df27
17b8feb
2771fb0
e5a8a8b
835a450
d1b6eb5
d10d4fb
a77564b
e43ea7d
16bd0ab
9d4d279
6858258
44726d1
14473ae
b83fe8b
5e76122
da95f91
b13cc54
1cc25fa
d13bc31
a3d26ae
f86f6d7
e68f426
8f8bd72
5ad1c12
1b7fb13
49c5f22
364d5cc
77802a3
5ab29a2
59beec8
4baeb74
768b66c
d69dcf9
f4ab711
f41ad22
ae0dc50
1ac27c3
642c85d
048ebb5
649e8fe
3ede7fb
f7fe641
8bddeea
12dd4a6
67c27d0
44e816c
f71768d
3b2d96c
ca6a5a5
7363f07
18cb589
6d96ac4
dcaac32
2cbfeec
e4062a9
d3f8b07
0307f3b
37ad052
2f79e27
d2be8dd
3d7a05a
6c4e7ed
0020817
0f5bc15
32f2aec
1744651
e06b9a0
d514aab
82bf264
c471693
1010b93
891bfe0
b4d2f9f
73852cc
fdce137
f5c3048
c797aa9
1905d40
3bf4b1e
16be725
d106876
d2c633a
9f6abbf
2e4493d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,11 +4,13 @@ on: | |
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: ${{ github.workflow }}-${{ github.ref }} | ||
|
|
||
| jobs: | ||
| release: | ||
| if: github.event_name == 'push' | ||
| name: Release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
|
|
@@ -83,3 +85,117 @@ jobs: | |
| pnpm install --frozen-lockfile | ||
| pnpm exec turbo --filter=@stakekit/widget build | ||
| npm publish "./$PACKAGE_DIR" | ||
|
|
||
| canary: | ||
| if: github.event_name == 'workflow_dispatch' | ||
| name: Publish canary | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| concurrency: | ||
| group: npm-canary-publish | ||
| cancel-in-progress: false | ||
| env: | ||
| PACKAGE_DIR: packages/widget | ||
|
|
||
| steps: | ||
| # actions/[email protected] | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | ||
| with: | ||
| ref: ${{ github.sha }} | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install mise | ||
| run: | | ||
| curl https://mise.run | MISE_VERSION=v2026.5.6 sh | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Agentic Security Review The canary publish job executes Impact: An attacker controlling that install script path could tamper with build/publish steps and ship malicious package artifacts under a trusted namespace. Reviewed by Cursor Security Reviewer for commit ae0dc50. Configure here. |
||
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | ||
| echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH" | ||
| export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH" | ||
| mise install | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Read npm release state | ||
| id: registry | ||
| shell: bash | ||
| run: | | ||
| package_name=$(node -p "require('./${PACKAGE_DIR}/package.json').name") | ||
| latest_version=$(npm view "${package_name}@latest" version) | ||
|
|
||
| { | ||
| echo "package_name=${package_name}" | ||
| echo "latest_version=${latest_version}" | ||
| } >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Prepare canary version | ||
| id: canary_version | ||
| env: | ||
| LATEST_VERSION: ${{ steps.registry.outputs.latest_version }} | ||
| run: pnpm exec tsx packages/widget/scripts/prepare-canary-release.ts | ||
|
|
||
| - name: Build widget | ||
| run: pnpm exec turbo --filter=@stakekit/widget build | ||
|
|
||
| - name: Test widget | ||
| run: | | ||
| pnpm --filter @stakekit/widget test:unit | ||
| pnpm --filter @stakekit/widget test:dom | ||
|
|
||
| - name: Check canary publish status | ||
| id: publish | ||
| shell: bash | ||
| env: | ||
| PACKAGE_NAME: ${{ steps.registry.outputs.package_name }} | ||
| VERSION: ${{ steps.canary_version.outputs.version }} | ||
| run: | | ||
| if npm view "${PACKAGE_NAME}@${VERSION}" version >/dev/null 2>&1; then | ||
| echo "${PACKAGE_NAME}@${VERSION} is already published; skipping." | ||
| echo "should_publish=false" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
|
|
||
| echo "should_publish=true" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Inspect package contents | ||
| if: steps.publish.outputs.should_publish == 'true' | ||
| run: npm pack "./$PACKAGE_DIR" --dry-run | ||
|
|
||
| - name: Publish canary to npm | ||
| if: steps.publish.outputs.should_publish == 'true' | ||
| run: npm publish "./$PACKAGE_DIR" --access public --tag canary | ||
|
|
||
| - name: Write release summary | ||
| env: | ||
| PACKAGE_NAME: ${{ steps.registry.outputs.package_name }} | ||
| VERSION: ${{ steps.canary_version.outputs.version }} | ||
| SHOULD_PUBLISH: ${{ steps.publish.outputs.should_publish }} | ||
| run: | | ||
| if [[ "$SHOULD_PUBLISH" == "true" ]]; then | ||
| release_status="Published" | ||
| else | ||
| release_status="Already published" | ||
| fi | ||
|
|
||
| { | ||
| echo "## Widget canary release" | ||
| echo | ||
| echo "| Field | Value |" | ||
| echo "| --- | --- |" | ||
| echo "| Status | ${release_status} |" | ||
| echo "| Package | ${PACKAGE_NAME} |" | ||
| echo "| Version | ${VERSION} |" | ||
| echo "| npm tag | canary |" | ||
| echo "| Branch | ${{ github.ref_name }} |" | ||
| echo "| Commit | ${{ github.sha }} |" | ||
| echo | ||
| echo "Install the moving canary channel:" | ||
| echo | ||
| echo " pnpm add ${PACKAGE_NAME}@canary" | ||
| echo | ||
| echo "Install this exact build:" | ||
| echo | ||
| echo " pnpm add ${PACKAGE_NAME}@${VERSION}" | ||
| } >> "$GITHUB_STEP_SUMMARY" | ||


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Agentic Security Review
Severity: HIGH
The canary release job is gated only by
workflow_dispatchand publishes from${{ github.sha }}without enforcing a trusted ref (for examplemainor a protected release tag). That means workflow-dispatch authority can publish branch-selected code to the officialcanarypackage channel.Impact: A compromised or over-privileged dispatcher could publish unreviewed or malicious artifacts under
@stakekit/widget, creating a supply-chain risk for canary consumers.Reviewed by Cursor Security Reviewer for commit b4d2f9f. Configure here.