@@ -10,26 +10,27 @@ concurrency:
1010env :
1111 NX_CLOUD_ACCESS_TOKEN : ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
1212
13- permissions :
14- contents : read
15- pull-requests : write
16- issues : write
13+ permissions : {}
1714
1815jobs :
1916 test :
2017 name : Test
2118 runs-on : ubuntu-latest
19+ permissions :
20+ contents : read
21+ pull-requests : write
2222 steps :
2323 - name : Checkout
24- uses : actions/checkout@v6.0.2
24+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525 with :
2626 fetch-depth : 0
27+ persist-credentials : false
2728 - name : Start Nx Agents
2829 run : npx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yaml"
2930 - name : Setup Tools
30- uses : TanStack/config/.github/setup@main
31+ uses : TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3
3132 - name : Get base and head commits for `nx affected`
32- uses : nrwl/nx-set-shas@v4.4.0
33+ uses : nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
3334 with :
3435 main-branch-name : main
3536 - name : Run Checks
@@ -40,19 +41,25 @@ jobs:
4041 preview :
4142 name : Preview
4243 runs-on : ubuntu-latest
44+ permissions :
45+ contents : read
46+ pull-requests : write
4347 steps :
4448 - name : Checkout
45- uses : actions/checkout@v6.0.2
49+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50+ with :
51+ persist-credentials : false
4652 - name : Setup Tools
47- uses : TanStack/config/.github/setup@main
53+ uses : TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3
4854 - name : Build Packages
4955 run : pnpm run build:all
5056 - name : Publish Previews
5157 run : pnpx pkg-pr-new publish --pnpm --compact './packages/*' --template './examples/*/*'
5258 - name : Determine commit SHA
5359 id : determine-sha
54- run : |
55- echo "COMMIT_SHA=${{ github.event.pull_request.head.sha || github.sha }}" >> $GITHUB_ENV
60+ run : echo "COMMIT_SHA=${COMMIT_SHA}" >> "$GITHUB_ENV"
61+ env :
62+ COMMIT_SHA : ${{ github.event.pull_request.head.sha || github.sha }}
5663 - name : Size Limit
5764 uses : andresz1/size-limit-action@94bc357df29c36c8f8d50ea497c3e225c3c95d1d
5865 with :
@@ -62,20 +69,30 @@ jobs:
6269 provenance :
6370 name : Provenance
6471 runs-on : ubuntu-latest
72+ permissions :
73+ contents : read
6574 steps :
6675 - name : Checkout
67- uses : actions/checkout@v6.0.2
76+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
77+ with :
78+ persist-credentials : false
6879 - name : Check Provenance
69- uses : danielroe/provenance-action@v0.1.1
80+ uses : danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
7081 with :
7182 fail-on-downgrade : true
7283 version-preview :
7384 name : Version Preview
7485 runs-on : ubuntu-latest
86+ permissions :
87+ contents : read
88+ pull-requests : write
89+ issues : write
7590 steps :
7691 - name : Checkout
77- uses : actions/checkout@v6.0.2
92+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
93+ with :
94+ persist-credentials : false
7895 - name : Setup Tools
79- uses : TanStack/config/.github/setup@main
96+ uses : TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3
8097 - name : Changeset Preview
81- uses : TanStack/config/.github/changeset-preview@main
98+ uses : TanStack/config/.github/changeset-preview@e4b48f16568324f76f467aa4c2aac2f05db632c3
0 commit comments