Skip to content

Harden the action and the release before 0.3.2 - #22

Merged
tmashara merged 1 commit into
mainfrom
action-hardening
Oct 24, 2026
Merged

tmashara merged 1 commit into
mainfrom
action-hardening

Conversation

@tmashara

Copy link
Copy Markdown
Owner

Fixes from the review of #19 and #20.

action.yml

  • The wait for left runs inside the run step with curl --max-time 10 and a numeric check on wait-timeout, so a down origin sets exit-code=2 and gets a summary instead of a bare failure.
  • Every flag passes as --flag=value, so an accept reason or path starting with - isn't refused.
  • artifact-name goes through env (it was interpolated into the script).
  • Node 24 with package-manager-cache: false. Chromium goes to PLAYWRIGHT_BROWSERS_PATH under the tool cache, so the cache works on macOS and Windows too.

release.yml

  • publish keeps contents: read. A separate move-v0 job with contents: write moves v0 and can be rerun alone. It runs only for v0.x tags without a prerelease suffix.

Self-test

  • Times out waiting for the fixture server.
  • Asserts that both /color and /tint score below the threshold, that the accepted file names /color, and that an unreachable left gives exit-code 2.

Docs

  • Threshold 0.05 and the half-pixel trade-off in how-it-works.
  • Re-accept after upgrading.
  • Accurate wording for Vercel protection, skipping production's own deployment_status, running twice or in a matrix, out overriding outDir, and the Node 24 side effect.

Not done: a half-pixel fixture asserting a known small score; it's documented instead.

🤖 Generated with Claude Code

Action: wait inside the run step with a curl timeout so a down origin reports
exit-code 2, --flag=value for every input, artifact name via env, Node 24
without package-manager cache, Chromium cached on every OS. Release: publish
keeps contents: read; a separate job moves v0, only for v0.x without a
prerelease suffix. Self-test asserts /tint and the down case. Docs: threshold
and half-pixel note, re-accept after upgrading, protection and production
deployments, running twice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@tmashara
tmashara merged commit 726a118 into main Oct 24, 2026
3 checks passed
@tmashara tmashara mentioned this pull request Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant