[READ-ONLY] Mirror of https://github.com/vitest-dev/vitest. Next generation testing framework powered by Vite.
vitest.dev
test
testing-tools
vite
ci: pin all actions including the official ones (#10392)
+24
-29
-5
.github/zizmor.yml
-5
.github/zizmor.yml
+12
-12
.github/workflows/ci.yml
+12
-12
.github/workflows/ci.yml
···
26
26
runs-on: ubuntu-latest
27
27
name: 'Lint: node-latest, ubuntu-latest'
28
28
steps:
29
-
- uses: actions/checkout@v6
29
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30
30
with:
31
31
persist-credentials: false
32
32
···
67
67
should_skip: ${{ steps.changed-files.outputs.only_changed == 'true' }}
68
68
69
69
steps:
70
-
- uses: actions/checkout@v6
70
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
71
71
with:
72
72
persist-credentials: false
73
73
···
101
101
fail-fast: false
102
102
103
103
steps:
104
-
- uses: actions/checkout@v6
104
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105
105
with:
106
106
persist-credentials: false
107
107
···
130
130
- name: Unit Test UI
131
131
run: pnpm -C packages/ui test:ui
132
132
133
-
- uses: actions/upload-artifact@v7
133
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
134
134
if: ${{ !cancelled() }}
135
135
with:
136
136
name: playwright-report-${{ matrix.os }}-node-${{ matrix.node_version }}
137
137
path: test/ui/test-results/
138
138
retention-days: 30
139
139
140
-
- uses: actions/upload-artifact@v7
140
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
141
141
if: ${{ !cancelled() }}
142
142
with:
143
143
name: vitest-results-${{ matrix.os }}-node-${{ matrix.node_version }}
···
165
165
fail-fast: false
166
166
167
167
steps:
168
-
- uses: actions/checkout@v6
168
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
169
169
with:
170
170
persist-credentials: false
171
171
···
203
203
timeout-minutes: 30
204
204
205
205
steps:
206
-
- uses: actions/checkout@v6
206
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
207
207
with:
208
208
persist-credentials: false
209
209
···
238
238
timeout-minutes: 30
239
239
240
240
steps:
241
-
- uses: actions/checkout@v6
241
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
242
242
with:
243
243
persist-credentials: false
244
244
···
273
273
if: ${{ !cancelled() }}
274
274
run: pnpm run test:browser:playwright
275
275
276
-
- uses: actions/upload-artifact@v7
276
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
277
277
if: ${{ !cancelled() }}
278
278
with:
279
279
name: playwright-report-vite7
···
289
289
name: Merge Reports
290
290
timeout-minutes: 10
291
291
steps:
292
-
- uses: actions/checkout@v6
292
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
293
293
with:
294
294
persist-credentials: false
295
295
···
301
301
- name: Build
302
302
run: pnpm run build
303
303
304
-
- uses: actions/download-artifact@v4
304
+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
305
305
with:
306
306
pattern: vitest-results-*
307
307
merge-multiple: true
···
318
318
cp -rf test/e2e/html html-all/e2e
319
319
echo "short_sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT
320
320
321
-
- uses: actions/upload-artifact@v7
321
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
322
322
id: upload-report
323
323
with:
324
324
name: vitest-ci-report-${{ steps.merge-html.outputs.short_sha }}
+2
-2
.github/workflows/cr.yml
+2
-2
.github/workflows/cr.yml
···
19
19
name: 'Release: pkg.pr.new'
20
20
21
21
steps:
22
-
- uses: actions/checkout@v6
22
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23
23
with:
24
24
fetch-depth: 0
25
25
persist-credentials: false
···
28
28
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
29
29
30
30
- name: Set node version to 24
31
-
uses: actions/setup-node@v6
31
+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
32
32
with:
33
33
node-version: 24
34
34
registry-url: https://registry.npmjs.org/
+4
-4
.github/workflows/ecosystem-ci-trigger.yml
+4
-4
.github/workflows/ecosystem-ci-trigger.yml
···
21
21
actions: read # to check workflow status
22
22
contents: read # to clone the repo
23
23
steps:
24
-
- uses: actions/github-script@v8
24
+
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
25
25
with:
26
26
script: |
27
27
const user = context.payload.sender.login
···
57
57
})
58
58
throw new Error('not allowed')
59
59
}
60
-
- uses: actions/github-script@v8
60
+
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
61
61
id: get-pr-data
62
62
with:
63
63
script: |
···
73
73
repo: pr.head.repo.full_name
74
74
}
75
75
- id: generate-token
76
-
uses: actions/create-github-app-token@v3
76
+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
77
77
with:
78
78
app-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
79
79
private-key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}
···
81
81
vitest
82
82
vitest-ecosystem-ci
83
83
permission-actions: write
84
-
- uses: actions/github-script@v8
84
+
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
85
85
id: trigger
86
86
env:
87
87
COMMENT: ${{ github.event.comment.body }}
+1
-1
.github/workflows/issue-close-require.yml
+1
-1
.github/workflows/issue-close-require.yml
···
37
37
pull-requests: write # to close pull requests
38
38
steps:
39
39
- name: maybe automated PRs
40
-
uses: actions/github-script@v8
40
+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
41
41
with:
42
42
script: |
43
43
const cutoff = new Date(Date.now() - 3 * 24 * 60 * 60 * 1000)
+2
-2
.github/workflows/publish.yml
+2
-2
.github/workflows/publish.yml
···
21
21
id-token: write # trusted publishing requirement
22
22
environment: Release
23
23
steps:
24
-
- uses: actions/checkout@v6
24
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25
25
with:
26
26
fetch-depth: 0
27
27
persist-credentials: false
···
30
30
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
31
31
32
32
- name: Set node version to 24
33
-
uses: actions/setup-node@v6
33
+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
34
34
with:
35
35
node-version: 24
36
36
registry-url: https://registry.npmjs.org/
+1
-1
.github/workflows/zizmor.yml
+1
-1
.github/workflows/zizmor.yml
···
22
22
permissions:
23
23
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
24
24
steps:
25
-
- uses: actions/checkout@v6
25
+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26
26
with:
27
27
persist-credentials: false
28
28
+1
-1
.github/actions/setup-and-cache/action.yml
+1
-1
.github/actions/setup-and-cache/action.yml
···
14
14
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
15
15
16
16
- name: Set node version to ${{ inputs.node-version }}
17
-
uses: actions/setup-node@v6
17
+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
18
18
with:
19
19
node-version: ${{ inputs.node-version }}
20
20
cache: pnpm
+1
-1
.github/actions/setup-playwright/action.yml
+1
-1
.github/actions/setup-playwright/action.yml
···
25
25
run: echo "Failed to resolve package versions. See log above." && exit 1
26
26
27
27
- name: Cache Playwright v${{ steps.resolve-package-versions.outputs.PLAYWRIGHT_VERSION }}
28
-
uses: actions/cache@v5
28
+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
29
29
id: playwright-cache
30
30
with:
31
31
path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}