From 23436ba9e8746b0d89d08e9a37243fec473d9b48 Mon Sep 17 00:00:00 2001 From: Javier Alonso Date: Tue, 23 Jun 2026 11:13:54 +0200 Subject: [PATCH 1/4] feat(ci): migrate aws credentials to secure oidc --- .github/workflows/main-publish.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/main-publish.yaml b/.github/workflows/main-publish.yaml index 4b9bf6a..1db3fac 100644 --- a/.github/workflows/main-publish.yaml +++ b/.github/workflows/main-publish.yaml @@ -11,6 +11,9 @@ jobs: name: Push image to ECR and update Lambda timeout-minutes: 10 runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - name: Check out code @@ -22,11 +25,9 @@ jobs: node-version: 20.17.0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 + uses: aws-actions/configure-aws-credentials@v4 with: - # Created the Secrets Under the Repo only with These Variables - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + role-to-assume: arn:aws:iam::480535519801:role/github-actions-linkedin-api-lambda aws-region: ${{ secrets.AWS_REGION }} - name: Build image From 865077240f19e2c9e6b114b52b8e7bcfb9d1f542 Mon Sep 17 00:00:00 2001 From: Javier Alonso Date: Tue, 23 Jun 2026 12:40:52 +0200 Subject: [PATCH 2/4] chore(ci): upgrade actions to latest stable versions for node 24 --- .github/workflows/main-publish.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main-publish.yaml b/.github/workflows/main-publish.yaml index 1db3fac..2c68afb 100644 --- a/.github/workflows/main-publish.yaml +++ b/.github/workflows/main-publish.yaml @@ -17,7 +17,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js environment uses: actions/setup-node@v4 @@ -25,7 +25,7 @@ jobs: node-version: 20.17.0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v5 with: role-to-assume: arn:aws:iam::480535519801:role/github-actions-linkedin-api-lambda aws-region: ${{ secrets.AWS_REGION }} From f00cb12b9c9a415c5cac648b326323de58841f54 Mon Sep 17 00:00:00 2001 From: Javier Alonso Date: Tue, 23 Jun 2026 13:26:08 +0200 Subject: [PATCH 3/4] chore(ci): upgrade setup-node and checkout to latest stable versions for node 24 --- .github/workflows/main-audit.yaml | 4 ++-- .github/workflows/main-pr-verify.yaml | 4 ++-- .github/workflows/main-publish.yaml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/main-audit.yaml b/.github/workflows/main-audit.yaml index 4043e47..e8fe912 100644 --- a/.github/workflows/main-audit.yaml +++ b/.github/workflows/main-audit.yaml @@ -19,10 +19,10 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js environment - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 20.17.0 diff --git a/.github/workflows/main-pr-verify.yaml b/.github/workflows/main-pr-verify.yaml index 03c78b9..e442ad0 100644 --- a/.github/workflows/main-pr-verify.yaml +++ b/.github/workflows/main-pr-verify.yaml @@ -16,10 +16,10 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js environment - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 20.17.0 diff --git a/.github/workflows/main-publish.yaml b/.github/workflows/main-publish.yaml index 2c68afb..e8c6f67 100644 --- a/.github/workflows/main-publish.yaml +++ b/.github/workflows/main-publish.yaml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@v7 - name: Setup Node.js environment - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 20.17.0 From 0baf807cee25be709b9db23800a13148b30fe9a9 Mon Sep 17 00:00:00 2001 From: Javier Alonso Date: Wed, 24 Jun 2026 15:59:31 +0200 Subject: [PATCH 4/4] chore(ci): override vulnerable nested dependencies fast-xml-parser and form-data --- package.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/package.json b/package.json index d6a4d05..e8916df 100644 --- a/package.json +++ b/package.json @@ -54,5 +54,13 @@ }, "engines": { "node": "20.17.0" + }, + "overrides": { + "fast-xml-parser": "^5.5.6", + "form-data": "^4.0.6" + }, + "resolutions": { + "fast-xml-parser": "^5.5.6", + "form-data": "^4.0.6" } }