fix(deps): bump lopdf to 0.42.0 for nesting-depth DoS (#198) #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Rust crate | |
| on: | |
| push: | |
| branches: [main] | |
| paths: ['Cargo.toml'] | |
| # Manual fallback: retry a publish that failed after the version was | |
| # already merged (a plain re-push won't register as a version change). | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| check-version: | |
| name: Check version change | |
| # Guard manual dispatches: crates.io trusted publishing matches | |
| # repo+workflow+environment but NOT branch, so without this a | |
| # workflow_dispatch from any branch could publish unmerged code. | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| changed: ${{ steps.check.outputs.changed }} | |
| published: ${{ steps.check.outputs.published }} | |
| version: ${{ steps.check.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 2 | |
| - name: Check if version changed | |
| id: check | |
| run: | | |
| NEW_VERSION=$(python3 -c 'import pathlib, tomllib; print(tomllib.loads(pathlib.Path("Cargo.toml").read_text())["package"]["version"])') | |
| echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT" | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| # Manual dispatch publishes the current version regardless of the | |
| # previous commit; the crates.io check below still prevents | |
| # double-publishing an already-released version. | |
| echo "manual dispatch: publishing v$NEW_VERSION" | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| else | |
| OLD_VERSION=$(git show HEAD~1:Cargo.toml | python3 -c 'import sys, tomllib; print(tomllib.loads(sys.stdin.read())["package"]["version"])') | |
| echo "old=$OLD_VERSION new=$NEW_VERSION" | |
| if [ "$NEW_VERSION" = "$OLD_VERSION" ]; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| HTTP_STATUS=$(curl --silent --show-error --output /tmp/crate-version.json --write-out "%{http_code}" \ | |
| -H "User-Agent: firecrawl/pdf-inspector publish workflow (https://github.com/firecrawl/pdf-inspector)" \ | |
| "https://crates.io/api/v1/crates/pdf-inspector/$NEW_VERSION") | |
| case "$HTTP_STATUS" in | |
| 200) | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "pdf-inspector v$NEW_VERSION is already published" | |
| ;; | |
| 404) | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| ;; | |
| *) | |
| cat /tmp/crate-version.json | |
| echo "Unexpected crates.io response: $HTTP_STATUS" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| publish: | |
| name: Publish to crates.io | |
| needs: check-version | |
| if: needs.check-version.outputs.changed == 'true' && needs.check-version.outputs.published == 'false' | |
| runs-on: ubuntu-latest | |
| environment: crates-io | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| toolchain: stable | |
| - name: Verify package | |
| run: cargo publish --dry-run | |
| - name: Authenticate with crates.io | |
| id: auth | |
| uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 | |
| - name: Publish crate | |
| run: cargo publish | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} |