CI: do not persist the checkout token, and test the minimum supported Node

Open Beginner friendly
  • Is something wrong?
#111 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
git, github-actions, nodejs
Domain
build-system, ci-cd

Research direction

Start with .github/workflows/ci.yml and .github/workflows/deploy.yml, where both actions/checkout steps need persist-credentials: false. For the Node item, compare package.json engines, .nvmrc, and .github/dependabot.yml, then decide with a maintainer whether to add a Node 22 matrix leg or raise engines to 24. Done when both workflows pass with the checkout change and CI tests the version that engines declares.

Written by the indexing model from the issue text.

Description

ci good first issue severity: low

Summary

Two small gaps in the GitHub Actions workflows: the checkout step leaves the job token in the local git config while dependency scripts run, and CI only tests Node 24 although the project says it supports Node 22.12 and later.

Checklist

  • Do not persist the checkout token. .github/workflows/ci.yml:18 and .github/workflows/deploy.yml:24 use actions/checkout without persist-credentials: false, so the job's GITHUB_TOKEN stays in .git/config while npm ci, lint, tests and the build run code from node_modules. The token is already least-privilege (contents: read, plus pages: read in the deploy build job), and nothing later in either job uses git with it, so add with: { persist-credentials: false } to both checkout steps. This is defence in depth: it matters if job permissions are widened later.
  • Test the oldest supported Node. package.json:7-9 declares "node": ">=22.12" and Dependabot pins @types/node to the oldest supported major (.github/dependabot.yml:15-17), but .nvmrc and both workflows use Node 24 only (ci.yml:21). Either add a Node 22 leg to ci.yml, or raise engines to >=24 and move @types/node to 24.

Acceptance criteria

  • Both checkout steps set persist-credentials: false, and both workflows still pass.
  • CI runs the declared minimum Node version, or engines matches what CI tests.

Getting started

  • Relevant files: .github/workflows/ci.yml, .github/workflows/deploy.yml, package.json, .nvmrc, .github/dependabot.yml
  • Related: #20, #23

Filed by repo-audit/full-audit at de2b25b. Severity: low. Effort: S. audit-key: ci|.github/workflows/ci.yml|actions/checkout persist-credentials

Dominant language
TypeScript
Stars
3
Forks
3
Avg merge
8h 13m
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from TMHSDigital/GH-Arcade

All issues in TMHSDigital/GH-Arcade

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.