chore(deps): bump websocket-driver to 0.7.5 to fix CVE-2026-54466 (#672) #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check & Release | |
| on: | |
| # Push to master will deploy a beta version | |
| push: | |
| branches: | |
| - master | |
| # A release via GitHub releases will deploy a latest version | |
| release: | |
| types: [published] | |
| # Necessary permissions for publishing to NPM with OIDC | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| lint_and_test: | |
| name: Lint and test | |
| uses: ./.github/workflows/check.yaml | |
| deploy: | |
| name: Publish to NPM | |
| needs: [lint_and_test] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Use Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install pnpm and dependencies | |
| uses: apify/actions/pnpm-install@v1.1.2 | |
| # Determine if this is a beta or latest release | |
| - name: Get release tag | |
| id: get_release_tag | |
| run: echo "release_tag=$(if [ ${{ github.event_name }} = release ]; then echo latest; else echo beta; fi)" >> $GITHUB_OUTPUT | |
| # Check version consistency and increment pre-release version number for beta only. | |
| - name: Bump pre-release version | |
| if: steps.get_release_tag.outputs.release_tag == 'beta' | |
| run: node ./.github/scripts/before-beta-release.cjs | |
| # `pnpm publish` honours the dist-tag flag and keeps the workflow on a | |
| # single package manager. `--no-git-checks` is required because the | |
| # `release` event checks out a tag in detached HEAD, which trips pnpm's | |
| # default "publish only from a tracked branch" guard. | |
| - name: Publish to NPM | |
| run: pnpm publish --tag ${{ steps.get_release_tag.outputs.release_tag }} --no-git-checks | |
| # Latest version is tagged by the release process so we only tag beta here. | |
| - name: Tag version | |
| if: steps.get_release_tag.outputs.release_tag == 'beta' | |
| run: | | |
| git_tag=v`node -p "require('./package.json').version"` | |
| git tag $git_tag | |
| git push origin $git_tag |