mirror of
https://github.com/jnMetaCode/superpowers-zh.git
synced 2026-09-03 07:23:56 +08:00
e26c26f3df
部署 job 持有可写的 Cloudflare API token，第三方 action 用可变标签 （@v3 等）存在标签劫持/供应链风险。改为 commit SHA 固定，附版本注释： - actions/checkout@34e1148… # v4 - actions/setup-node@49933ea… # v4 - cloudflare/wrangler-action@9acf94a… # v3 SHA 与 GitHub 当前标签解析一致（checkout/setup-node 的 SHA 也与既往 CI 日志中运行器解析的值吻合）。YAML 已校验合法。
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
name: Deploy site to Cloudflare Pages
|
||
|
||
# 官网自动部署：site/ 或 skills/ 变更时重建并发布。
|
||
# 需在仓库 Settings → Secrets 配置 CLOUDFLARE_API_TOKEN 与 CLOUDFLARE_ACCOUNT_ID。
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'site/**'
|
||
- 'skills/**'
|
||
- '.github/workflows/deploy-site.yml'
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
deploy:
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
deployments: write
|
||
steps:
|
||
# Action 全部 SHA 固定（防供应链/标签劫持，因本 job 持有可写的 Cloudflare token）
|
||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
||
with:
|
||
node-version: 20
|
||
- name: Build site
|
||
run: node site/build.mjs
|
||
- name: Deploy to Cloudflare Pages
|
||
uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
|
||
with:
|
||
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||
command: pages deploy site/dist --project-name=superpowers-zh-site
|