Added security fixes (ToolJet#15766)

adishM98 · web-flow · commit 0357060e63e5 · 2026-03-31T15:08:50.000+05:30
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
@@ -1,40 +1,48 @@
 name: Cypress Code-Coverage
 
 on:
-  pull_request_target:
-    types: [labeled, unlabeled, closed]
+  pull_request:
+    types: [labeled, unlabeled, synchronize, closed]
 
   workflow_dispatch:
 
 env:
-  PR_NUMBER: ${{ github.event.number }}
+  PR_NUMBER: ${{ github.event.pull_request.number }}
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
 jobs:
   Cypress-Code-Coverage:
     name: Code coverage
     runs-on: ubuntu-22.04
 
-    if: ${{ github.event.action == 'labeled' && (github.event.label.name == 'check-coverage') }}
+    if: >-
+      (
+        (github.event.action == 'labeled' && github.event.label.name == 'check-coverage')
+        || (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'check-coverage'))
+      )
+      && github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
       - name: Setup Node.js
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
           node-version: 18.18.2
 
       - name: Set up Docker
         uses: docker-practice/actions-setup-docker@master
 
-      - name: Run PosgtreSQL Database Docker Container
+      - name: Run PostgreSQL Database Docker Container
         run: |
           sudo docker network create tooljet
-          sudo docker run -d --name postgres --network tooljet -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres -e POSTGRES_PORT=5432 -d postgres:13
+          sudo docker run -d --name postgres --network tooljet \
+            -p 5432:5432 \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_USER=postgres \
+            -e POSTGRES_PORT=5432 \
+            postgres:13
 
       - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
+        uses: actions/checkout@v4
 
       - name: Install and build dependencies
         run: |
@@ -61,22 +69,24 @@ jobs:
           echo "TOOLJET_DB_PASS=postgres" >> .env
           echo "PGRST_JWT_SECRET=r9iMKoe5CRMgvJBBtp4HrqN7QiPpUToj" >> .env
           echo "PGRST_HOST=localhost:3001" >> .env
-          echo "NODE_ENV=developement" >> .env
+          echo "NODE_ENV=development" >> .env
 
       - name: Set up database
         run: |
           npm run --prefix server db:create
           npm run --prefix server db:reset
           npm run --prefix server db:seed
 
-      - name: sleep 5
+      - name: Wait for database seed to settle
         run: sleep 5
 
       - name: Run PostgREST Docker Container
         run: |
           sudo docker run -d --name postgrest --network tooljet -p 3001:3000 \
-          -e PGRST_DB_URI="postgres://postgres:postgres@postgres:5432/tooljet" -e PGRST_DB_ANON_ROLE="postgres" -e PGRST_JWT_SECRET="r9iMKoe5CRMgvJBBtp4HrqN7QiPpUToj" \
-          postgrest/postgrest:v10.1.1.20221215
+            -e PGRST_DB_URI="postgres://postgres:postgres@postgres:5432/tooljet" \
+            -e PGRST_DB_ANON_ROLE="postgres" \
+            -e PGRST_JWT_SECRET="r9iMKoe5CRMgvJBBtp4HrqN7QiPpUToj" \
+            postgrest/postgrest:v10.1.1.20221215
 
       - name: Run plugins compilation in watch mode
         run: cd plugins && npm start &
@@ -94,7 +104,7 @@ jobs:
             sleep 5
           done'
 
-      - name: docker logs
+      - name: PostgREST logs
         run: sudo docker logs postgrest
 
       - name: Create Cypress environment file
@@ -107,25 +117,22 @@ jobs:
 
       - name: Install Cypress
         working-directory: ./cypress-tests
-        run: |
-          npm install
-        
+        run: npm install
 
       - name: Run Cypress tests
         working-directory: ./cypress-tests
-        run: |
-          npm run cy:run
+        run: npm run cy:run
 
       - name: Debugging
+        if: always()
         run: |
           ls -R cypress-tests
           ls -R /home/runner/work/ToolJet/ToolJet/cypress-tests
           cat /home/runner/work/ToolJet/ToolJet/cypress-tests/.nyc_output/out.json
-        
 
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: always()
         with:
           name: coverage
-          path: cypress-tests/coverage
+          path: cypress-tests/coverage
