fix(ci): resolve all failing workflows #42
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,9 +19,9 @@ jobs: | |
| run: | ||
| working-directory: ./site | ||
| steps: | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
|
|
||
| - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
|
|
@@ -31,6 +31,10 @@ jobs: | |
|
|
||
| - run: npm run build | ||
|
|
||
| - name: Install matching Chrome + ChromeDriver | ||
| run: npx --yes browser-driver-manager install chrome | ||
|
Comment on lines
+34
to
+35
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
fd -t f -g 'package.json' -g 'package-lock.json' . \
-x rg -n 'browser-driver-manager' {} || trueRepository: LUSKTECH/gl1tch.xyz Length of output: 221 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Package files:"
git ls-files | rg '(^|/)package\.json$|(^|/)package-lock\.json$|(^|/)pnpm-lock\.yaml$|(^|/)yarn\.lock$|(^|/)npm-shrinkwrap\.json$' || true
echo
echo "browser-driver-manager references:"
rg -n 'browser-driver-manager|npx --yes|npm exec|browser-driver' .github package.json package-lock.json pnpm-lock.yaml yarn.lock npm-shrinkwrap.json 2>/dev/null || true
echo
echo "Workflow files:"
fd -t f .github/workflows -x sh -c 'echo "--- $1"; sed -n "1,100p" "$1"' sh {}Repository: LUSKTECH/gl1tch.xyz Length of output: 1122 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Package files:"
git ls-files | rg '(^|/)package\.json$|(^|/)package-lock\.json$|(^|/)pnpm-lock\.yaml$|(^|/)yarn\.lock$|(^|/)npm-shrinkwrap\.json$' || true
echo
echo "browser-driver-manager references:"
rg -n 'browser-driver-manager|npx --yes|npm exec|browser-driver' .github package.json package-lock.lock pnpm-lock.yaml yarn.lock npm-shrinkwrap.json 2>/dev/null || true
echo
echo "Workflow files:"
fd -t f .github/workflows -x sh -c 'echo "--- $1"; sed -n "1,100p" "$1"' sh {}Repository: LUSKTECH/gl1tch.xyz Length of output: 1122 🌐 Web query:
💡 Result: When using npm exec or npx to run a package that is not installed locally, the following behavior occurs: 1. Identification: If the requested package is not present in the local project's dependencies, npm identifies that it needs to be fetched [1][2]. 2. Prompting: By default, npm will print a prompt to the terminal asking for confirmation to install the missing package [1][3]. 3. Suppression: If the --yes (or -y) flag is provided, this prompt is suppressed, and npm proceeds with the installation automatically [1][2]. This is also the default behavior if the command is run in a non-interactive (CI) environment where standard input is not a TTY [1][3]. 4. Fetching and Installation: The requested package is downloaded and installed into a temporary folder within the npm cache [1][2]. 5. Execution: The directory containing this newly installed package is added to the PATH environment variable for the duration of the executed process, allowing the command to run as if it were a local dependency [1][2]. After the command completes, the package remains in the npm cache but is not added to your project's local node_modules or dependencies [1][2]. [4][1][2] Citations:
🌐 Web query:
💡 Result: The browser-driver-manager is a command-line interface (CLI) tool designed to manage Chrome and Firefox browsers and their corresponding drivers [1][2][3]. It is particularly useful in continuous integration (CI) environments to ensure that the browser and its driver remain synchronized [4][3]. Key details about the package: - Purpose: It automates the installation and management of browser binaries and drivers. Version 2.0.0 and later transitioned to using Chrome for Testing, which resolves previous issues where driver packages occasionally lagged behind browser updates [5]. - Usage: The tool is typically installed via npm ( Citations:
Pin 📍 Affects 2 files
🤖 Prompt for AI Agents |
||
| working-directory: . | ||
|
Comment on lines
+34
to
+36
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n 'browser-driver-manager|CHROME_PATH|chromePath|CHROMEDRIVER_PATH|chromedriver-path|chrome-path' \
.github/workflows/a11y.yml .github/workflows/lighthouse.yml \
site/lighthouserc.cjs site/package.json site/package-lock.jsonRepository: LUSKTECH/gl1tch.xyz Length of output: 345 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '--- workflows relevant sections ---\n'
for f in .github/workflows/a11y.yml .github/workflows/lighthouse.yml; do
echo "### $f"
nl -ba "$f" | sed -n '1,180p'
done
printf '\n--- package manifests mentioning scanners/browser-driver-manager ---\n'
for f in package.json site/package.json; do
if [ -f "$f" ]; then
echo "### $f"
python3 - <<'PY' "$f"
import json, sys
p=sys.argv[1]
with open(p) as fh: data=json.load(fh)
for sec in ('dependencies','devDependencies'):
vals=data.get(sec,{})
matches={k:v for k,v in vals.items() if 'axe' in k.lower() or 'lighthouse' in k.lower() or 'browser-driver-manager' in k.lower()}
if matches:
print(sec, matches)
PY
fi
done
printf '\n--- find relevant config/package files ---\n'
fd -a 'lighthouserc|package(-lock)?\.json|axe|jest|vitest|playwright|puppeteer' site .github 2>/dev/null | sed 's#^\./##' | sortRepository: LUSKTECH/gl1tch.xyz Length of output: 248 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflows relevant sections ---'
for f in .github/workflows/a11y.yml .github/workflows/lighthouse.yml; do
echo "### ${f}"
nl -ba "$f" | sed -n '1,200p'
done
printf '%s\n' ''
printf '%s\n' '--- package manifests mentioning scanners/browser-driver-manager ---'
for f in package.json site/package.json; do
if [ -f "$f" ]; then
echo "### ${f}"
python3 - "$f" <<'PY'
import json, sys
p=sys.argv[1]
with open(p) as fh: data=json.load(fh)
for sec in ('dependencies','devDependencies','scripts'):
vals=data.get(sec)
if sec in ('dependencies','devDependencies') and vals:
matches={k:v for k,v in vals.items() if 'axe' in k.lower() or 'lighthouse' in k.lower() or 'browser-driver-manager' in k.lower()}
if matches:
print(sec, matches)
elif sec == 'scripts' and vals:
matches={k:v for k,v in vals.items() if 'axe' in k.lower() or 'lighthouse' in k.lower() or 'browser-driver-manager' in k.lower()}
if matches:
print(sec, matches)
PY
fi
done
printf '%s\n' ''
printf '%s\n' '--- find relevant config/package files ---'
fd -a 'lighthouserc|package(-lock)?\.json|axe|jest|vitest|playwright|puppeteer' site .github 2>/dev/null | sed 's#^\./##' | sort || trueRepository: LUSKTECH/gl1tch.xyz Length of output: 264 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
cat -n .github/workflows/a11y.yml
printf '%s\n' '--- end a11y.yml ---'
cat -n .github/workflows/lighthouse.yml
printf '%s\n' '--- end lighthouse.yml ---'
printf '%s\n' '--- package files ---'
if [ -f site/package.json ]; then cat -n site/package.json; fi
if [ -f site/lighthouserc.cjs ]; then cat -n site/lighthouserc.cjs; fi
printf '%s\n' '--- package search ---'
python3 - <<'PY' "$@"
import glob, json, re, os
paths=[]
for base in ('.', 'site'):
if os.path.exists(base):
for root, dirs, files in os.walk(base):
dirs[:] = [d for d in dirs if d not in {'.git', 'node_modules'}]
for f in files:
if f in {'package.json','package-lock.json'}:
paths.append(os.path.join(root, f))
for p in sorted(paths):
try:
with open(p, encoding='utf-8') as fh: data=json.load(fh)
except Exception as e:
print(f"ERR {p}: {e}")
continue
keys=[]
if 'dependencies' in data: keys+=[k for k,v in data['dependencies'].items() if any(x in k.lower() for x in ['axe','lighthouse','browser-driver-manager','playwright','puppeteer'])]
if 'devDependencies' in data: keys+=[k for k,v in data['devDependencies'].items() if any(x in k.lower() for x in ['axe','lighthouse','browser-driver-manager','playwright','puppeteer'])]
if 'scripts' in data: keys+=[k for k,v in data['scripts'].items() if any(x in k.lower() for x in ['axe','lighthouse','browser-driver-manager','playwright','puppeteer'])]
if keys:
print("FILE", p)
for k in sorted(keys):
print(k, getattr(data, {**{'dependencies': data.get('dependencies')}, **{'devDependencies': data.get('devDependencies')}, **{'scripts': data.get('scripts')}}.get(k)), type(data))
PYRepository: LUSKTECH/gl1tch.xyz Length of output: 5340 🌐 Web query:
💡 Result: The browser-driver-manager npm package automatically creates a directory in your home folder named.browser-driver-manager upon installation [1][2]. Inside this directory, it maintains a.env file that stores the absolute paths to the installed Chrome and Chromedriver binaries under the environment variable keys CHROME_TEST_PATH and CHROMEDRIVER_TEST_PATH, respectively [1][2]. To utilize these paths in your application, you must load this.env file [1][3]. A common approach in Node.js, using the dotenv package, is as follows [1][2]: require('dotenv').config({ path: '~/.browser-driver-manager/.env' }); console.log(process.env.CHROME_TEST_PATH); console.log(process.env.CHROMEDRIVER_TEST_PATH); Since these paths are generated dynamically by the browser-driver-manager, they are intended to be read from this file rather than hardcoded [4][1]. This method is especially important for version 2.0.0 and later, as it replaces the previous practice of relying on the chromedriver npm package's path property [4][2]. For non-Node.js environments, you can similarly parse this.env file using standard file I/O or environment variable loaders available in your language of choice [5][6][7]. Citations:
🌐 Web query:
💡 Result: The Citations:
🌐 Web query:
💡 Result: To specify the path of the Chrome executable for the Lighthouse CLI, you can use the CHROME_PATH environment variable [1][2]. Setting this variable allows the underlying chrome-launcher to detect and use the specific Chrome installation you designate [2][3]. For Lighthouse CI (LHCI), there is a specific chromePath configuration option available in the configuration file, which provides a more explicit way to set the path [4][5]. The priority order for resolution in Lighthouse CI is: 1. The chromePath configuration option [4]. 2. The CHROME_PATH environment variable [4][5]. 3. The executable path found via puppeteer or puppeteer-core (if installed) [4]. 4. The highest priority installation detected by the chrome-launcher package [4]. While some users have requested a direct --chrome-path command-line flag for the standard Lighthouse CLI, it is not currently a native, supported flag; users are instead encouraged to rely on the CHROME_PATH environment variable [6]. Citations:
🌐 Web query:
💡 Result: In GitHub Actions, treosh/lighthouse-ci-action provides convenient flags for managing Lighthouse report storage, while CHROME_PATH is a critical environment variable often required when running Lighthouse in headless CI environments. treosh/lighthouse-ci-action Configuration The treosh/lighthouse-ci-action supports direct configuration for report handling [1][2]: - uploadArtifacts (default: false): When set to true, this flag saves Lighthouse reports as GitHub Actions artifacts, allowing you to persist and download them from the action's run summary [1][3]. - temporaryPublicStorage (default: false): When set to true, this flag uploads your reports to Google's temporary public storage [1][3]. Reports uploaded this way are public and are automatically deleted after 7 days [1]. Because these are public, it is often recommended to use a private Lighthouse CI (LHCI) server if you are handling sensitive data [1][2]. CHROME_PATH and CI Environments When running Lighthouse in a CI environment like GitHub Actions (particularly on ubuntu-latest runners), the Lighthouse collector often requires a defined Chrome or Chromium executable [4][5]. If the runner does not have a stable version of Chrome pre-installed or detectable, you may encounter an error stating that the CHROME_PATH environment variable must be set [4]. To resolve this, you can use a browser-setup action (such as browser-actions/setup-chrome) to install Chrome and then export its path to the environment [4]: - Install Chrome: Use an action like browser-actions/setup-chrome to install the browser [4]. - Set the Path: Extract the output path from the setup step and set the CHROME_PATH environment variable [4]. Example workflow snippet [4]: - name: setup chrome uses: browser-actions/setup-chrome@v1 id: setup-chrome - name: Set CHROME_PATH run: echo "CHROME_PATH=${{ steps.setup-chrome.outputs.chrome-path }}" >> $GITHUB_ENV - name: Audit URLs using Lighthouse uses: treosh/lighthouse-ci-action@v12 with: urls: https://example.com uploadArtifacts: true temporaryPublicStorage: true browser-driver-manager While straker/browser-driver-manager is a utility for managing browser and driver installations (often for testing frameworks like Webdriver), it is not a direct requirement for the treosh/lighthouse-ci-action [6]. Its primary purpose is to provide local or CI environments with specific versions of Chrome and Chromedriver by managing their install paths in a.env file [6]. If used, you would need to read the path from that.env file and manually set the CHROME_PATH environment variable for your Lighthouse CI step, similar to the process described above [6]. Citations:
Activate the browser-driver-manager paths in the scans.
📍 Affects 2 files
🤖 Prompt for AI Agents |
||
|
|
||
| - name: Serve dist and scan | ||
| run: | | ||
| npx --yes serve dist -l 4321 & | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,20 +36,22 @@ jobs: | |
| name: Codacy Security Scan | ||
| runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }} | ||
| steps: | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow checkout usages =="
rg -n "actions/checkout|persist-credentials" .github/workflows || true
echo
echo "== workflow files sizes =="
wc -l .github/workflows/codacy.yml .github/workflows/security.yml
echo
echo "== relevant workflow snippets =="
for f in .github/workflows/codacy.yml .github/workflows/security.yml; do
echo "--- $f"
nl -ba "$f" | sed -n '1,160p'
doneRepository: LUSKTECH/gl1tch.xyz Length of output: 1822 🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in .github/workflows/codacy.yml .github/workflows/security.yml .github/workflows/lighthouse.yml .github/workflows/a11y.yml .github/workflows/qlty.yml .github/workflows/sonarqube.yml .github/workflows/ci.yml; do
[ -f "$ f" ] || true
done
for f in .github/workflows/codacy.yml .github/workflows/security.yml .github/workflows/lighthouse.yml .github/workflows/a11y.yml .github/workflows/qlty.yml .github/workflows/sonarqube.yml .github/workflows/ci.yml; do
echo "--- $f"
sed -n '1,170p' "$f"
done
echo "== all checkout step occurrences in workflows =="
grep -RIn "uses: actions/checkout@" .github/workflows || trueRepository: LUSKTECH/gl1tch.xyz Length of output: 17148 🌐 Web query:
💡 Result: In the actions/checkout action, including version v5, the persist-credentials input defaults to true [1][2][3]. When persist-credentials is set to true (the default), the action configures the authentication token or SSH key in the local git configuration [1][4]. This allows subsequent steps in your workflow to execute authenticated git commands [1][4]. The action is designed to remove these credentials during the post-job cleanup process [1][4]. In v5, the implementation of this feature was updated to store credentials under $RUNNER_TEMP rather than directly in the local git config [5], a change intended to improve security by preventing accidental leakage, such as through artifact publishing [6][5]. Users who wish to opt out of this behavior and prevent the action from configuring git credentials can explicitly set persist-credentials: false [1][4]. Citations:
🌐 Web query:
💡 Result: In actions/checkout, the persist-credentials input controls whether the action configures the authentication token or SSH key in the local git configuration [1][2][3]. When persist-credentials is set to the default value (true), the action automatically configures authentication credentials to enable your subsequent workflow steps to run authenticated Git commands [1][4][5]. In actions/checkout v5, these credentials were added to the repository's local git config [2]. In later versions (starting with v6), this behavior was updated to store credentials in a separate file within $RUNNER_TEMP, using Git's includeIf mechanism to reference them, which improves security by isolating the credentials from the main Git configuration [6][7][8]. Setting persist-credentials to false explicitly opts out of this behavior, meaning the action will not write any credentials to the local git configuration or temporary files [1][8]. This is a recommended security practice when your subsequent workflow steps do not require authenticated Git access, as it minimizes the risk of credential leakage [8]. In summary: - Default (true): Credentials are configured for use by subsequent steps [1][3]. - False: No credentials are configured, and the action performs only the initial checkout [1][8]. Citations:
Disable persisted checkout credentials where the workflow uses the checkout token. In the scan workflows, the listed 🧰 Tools🪛 zizmor (1.26.1)[warning] 39-39: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 📍 Affects 2 files
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4 | ||
| with: | ||
| format: sarif | ||
| output: results.sarif | ||
| gh-code-scanning-compat: true | ||
| max-allowed-issues: 2147483647 | ||
| tool-timeout: 30m | ||
|
|
||
| - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 | ||
| if: always() | ||
| continue-on-error: true | ||
| with: | ||
| sarif_file: results.sarif | ||
| category: codacy | ||
|
|
||
| codacy-coverage: | ||
| name: Codacy Coverage Upload | ||
|
|
@@ -60,9 +62,9 @@ jobs: | |
| run: | ||
| working-directory: ./site | ||
| steps: | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
|
|
||
| - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
|
|
@@ -74,7 +76,7 @@ jobs: | |
|
|
||
| - name: Upload coverage to Codacy | ||
| if: hashFiles('site/coverage/lcov.info') != '' | ||
| uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1 | ||
| with: | ||
| project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} | ||
| coverage-reports: site/coverage/lcov.info | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable persisted checkout credentials in both browser jobs.
zizmorreports the omitted opt-out, and these jobs execute package/browser tooling after checkout. Addpersist-credentials: falseto both checkout steps. (github.com).github/workflows/a11y.yml#L22-L22: addwith.persist-credentials: false..github/workflows/lighthouse.yml#L22-L22: addwith.persist-credentials: false.🧰 Tools
🪛 zizmor (1.26.1)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/a11y.yml#L22-L22(this comment).github/workflows/lighthouse.yml#L22-L22🤖 Prompt for AI Agents
Source: Linters/SAST tools