Skip to content

Manage npm packages used in workflows #2571

Description

@MikeMcC399

What would you like?

Add an npm private (non-publishable) package.json to allow managing and pinning npm dependencies used in GitHub Actions workflows.

Why is this needed?

Best practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing latest or SemVer ranges.

Code-scanning alerts for the repo, report "Pinned-Dependencies" for three GitHub Actions .github/workflows:

Workflow npm Package
doctoc.yml doctoc
eclint.yml eclint
markdown-link-check.yml markdown-link-check@3.14.2

Other

PR #2570 proposes to replace eclint with prettier. In this case, prettier would be added to the package.json instead of eclint.

Metadata

Metadata

Assignees

No one assigned

    Labels

    ciCI (Continuous Integration) workflowsdependenciesPull requests that update a dependency file

    Type

    Fields

    No fields configured for Task.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions