Skip to content

ci(api-docs/ts): bring npm's cache-poisoning fix upstream, reconcile the rest #134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WomB0ComB0 merged 3 commits into from
Sep 22, 2026
Merged

ci(api-docs/ts): bring npm's cache-poisoning fix upstream, reconcile the rest #134

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bb10727
fix(api-docs/ts): disable setup-bun's cache in the template
WomB0ComB0 Sep 22, 2026
0bdd540
docs(api-docs/ts): show the live scope in the DOCS_REF_SLUG example
WomB0ComB0 Sep 22, 2026
df63a17
chore(api-docs/ts): pin the actions every consumer already runs
WomB0ComB0 Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions automation/source-repo-templates/api-docs.typescript.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
# workflow_dispatch can pass an alternate ref via inputs.ref;
# fall back to github.ref_name (already stripped of refs/...).
# DOCS_REF_SLUG is branch-safe for use in PR/branch names
# (`@resq-sw/ui@v0.35.6` → `resq-sw-ui-v0.35.6`).
# (`@resq-systems/ui@v0.35.6` → `resq-systems-ui-v0.35.6`).
#
# The ref is routed through env: instead of being inlined via
# ${{ }}. Inlining at template-expansion time would interpolate
Expand All @@ -98,15 +98,22 @@ jobs:
} >> "$GITHUB_ENV"

- name: Checkout source repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.ref || github.ref }}
persist-credentials: false

- name: Setup Bun
uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: latest
# This job runs on release tags and opens a cross-repo PR using
# DOCS_REPO_PR_TOKEN, so it is a privileged context. Disable
# setup-bun's default dependency cache: a cache populated by a
# less-trusted run must not be restorable here (zizmor
# cache-poisoning, error severity). The install step below is
# --frozen-lockfile, so a cold install is functionally identical.
no-cache: true

- name: Install workspace deps
run: bun install --frozen-lockfile
Expand Down Expand Up @@ -503,7 +510,7 @@ jobs:
rm _pages.txt

- name: Checkout docs repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: resq-software/docs
path: docs-checkout
Expand Down Expand Up @@ -617,7 +624,7 @@ jobs:
PYINNER

- name: Open PR in docs repo
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
path: docs-checkout
token: ${{ secrets.DOCS_REPO_PR_TOKEN }}
Expand Down
Loading