mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
bbe894bb96
Every GitHub action is now pinned to a full commit SHA with its version in a trailing comment, verified against each upstream repo's tags, so a retagged release cannot swap code under CI. The publish workflow pins npm to an exact version instead of @latest, the experiment Dockerfile pins its base image by digest, and codeql.yml gets a top-level read-all permissions block so the default token grants nothing the analyze job does not ask for. SECURITY.md points reports at GitHub private vulnerability reporting, which is now enabled, and scopes out experiments/. Branch protection on main now blocks force pushes and deletions.
21 lines
568 B
Docker
21 lines
568 B
Docker
FROM node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install --yes --no-install-recommends ca-certificates git \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& mkdir -p /experiment \
|
|
&& chown node:node /experiment
|
|
|
|
ENV LOOP_DELAY_SECONDS=5 \
|
|
MAX_ITERATIONS=0 \
|
|
SKILL_NAME=web-browsing-cli \
|
|
SKILL_SOURCE=https://github.com/only-cli/oc
|
|
|
|
WORKDIR /experiment
|
|
|
|
COPY --chmod=0755 loop.sh /usr/local/bin/skills-install-remove-loop
|
|
|
|
USER node
|
|
|
|
CMD ["skills-install-remove-loop"]
|