Feat 356

.ckb-light-version

@@ -1 +1 @@
-v0.3.6
+v0.4.1

.ckb-version

@@ -1 +1 @@
-v0.113.1
+v0.121.0

.github/workflows/check-code-style.yml

@@ -18,7 +18,7 @@ jobs:
           cache: "yarn"
 
       - name: Restore
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             node_modules
@@ -31,7 +31,7 @@ jobs:
 
       - name: Changed Files
         id: changed-files
-        uses: tj-actions/changed-files@v41
+        uses: tj-actions/changed-files@v44
         with:
           files: "packages/**/*.{js,cjs,mjs,jsx,ts,tsx,css,scss}"
 

.github/workflows/check_checksums.yml

@@ -8,13 +8,16 @@ jobs:
   compare:
     name: Compare checksums
     runs-on: macos-latest
+    environment: Release
+    permissions:
+      contents: write # to append checksum for each commit
+      actions: read # to read artifacts
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Generate checksums from artifacts
-        run:
-          ruby ./scripts/release-checksums.rb ${{ github.event.release.tag_name }} | tee generated_checksums.txt
+        run: ruby ./scripts/release-checksums.rb ${{ github.event.release.tag_name }} | tee generated_checksums.txt
 
       - name: Fetch checksums from release note
         run: |
@@ -36,4 +39,3 @@ jobs:
       - uses: peter-evans/commit-comment@v3
         with:
           body: ${{ steps.comment_body.outputs.body }}
-

.github/workflows/check_storybook.yml

@@ -9,7 +9,7 @@ jobs:
     strategy:
       matrix:
         node:
-          - 18.12.0
+          - 20.15.1
         os:
           - macos-latest
           - ubuntu-20.04
@@ -35,7 +35,7 @@ jobs:
           cache: "yarn"
 
       - name: Restore
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             node_modules

.github/workflows/checksums-of-release-draft.yml

@@ -10,6 +10,9 @@ on:
 jobs:
   checksums:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
     if: github.event.workflow_run.conclusion == 'success'
     steps:
       - name: Checkout

.github/workflows/merge_released_into_develop.yml

@@ -9,8 +9,11 @@ jobs:
   merge-to-dev:
     name: Merge into develop
     runs-on: ubuntu-latest
+    environment: Release
+    permissions:
+      pull-requests: write
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: Request
         uses: repo-sync/pull-request@v2
         with:

.github/workflows/package.yml

@@ -12,14 +12,18 @@ jobs:
     strategy:
       matrix:
         node:
-          - 18.12.0
+          - 20.15.1
         os:
           - macos-latest
           - ubuntu-20.04
           - windows-2019
 
     runs-on: ${{ matrix.os }}
 
+    environment: Release
+    permissions:
+      contents: write
+
     name: ${{ matrix.os }}(Node.js ${{ matrix.node }})
 
     steps:
@@ -38,7 +42,7 @@ jobs:
           cache: "yarn"
 
       - name: Restore
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             node_modules
@@ -47,7 +51,7 @@ jobs:
 
       - name: Add msbuild to PATH
         if: matrix.os == 'windows-2019'
-        uses: microsoft/setup-msbuild@v1.3.1
+        uses: microsoft/setup-msbuild@v2
         env:
           ACTIONS_ALLOW_UNSECURE_COMMANDS: "true"
 
@@ -99,6 +103,11 @@ jobs:
         env:
           CI: false
 
+        # Inject LOG_ENCRYPTION_PUBLIC_KEY to encrypt sensitive log
+      - name: Inject environment variables
+        run: |
+          echo "LOG_ENCRYPTION_PUBLIC_KEY=${{ secrets.LOG_ENCRYPTION_PUBLIC_KEY }}" >> packages/neuron-wallet/.env
+
       - name: Package for MacOS
         if: matrix.os == 'macos-latest'
         run: |
@@ -134,28 +143,28 @@ jobs:
         if: matrix.os == 'macos-latest'
         uses: actions/upload-artifact@v4
         with:
-          name: Neuron-Mac
+          name: Neuron-Mac-x64
           path: release/Neuron-*-mac-x64.zip
 
       - name: Upload Neuron App Zip(arm64)
         if: matrix.os == 'macos-latest'
         uses: actions/upload-artifact@v4
         with:
-          name: Neuron-Mac
+          name: Neuron-Mac-arm64
           path: release/Neuron-*-mac-arm64.zip
 
       - name: Upload Neuron Dmg
         if: matrix.os == 'macos-latest'
         uses: actions/upload-artifact@v4
         with:
-          name: Neuron-Dmg
+          name: Neuron-Dmg-x64
           path: release/Neuron-*-x64.dmg
 
       - name: Upload Neuron Dmg(arm64)
         if: matrix.os == 'macos-latest'
         uses: actions/upload-artifact@v4
         with:
-          name: Neuron-Dmg
+          name: Neuron-Dmg-arm64
           path: release/Neuron-*-arm64.dmg
 
       - name: Upload Neuron Win

.github/workflows/package_for_test.yml

@@ -2,24 +2,28 @@ name: Package Neuron for Test
 
 on: 
   issue_comment:
-    types: [created, edited]
+    types: [created]
   push:
 
 jobs:
   packaging:
-    if: ${{ (github.event_name == 'issue_comment' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/package')) || github.event_name == 'push' }}
+    if: ${{ (github.event_name == 'issue_comment' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/package') && contains(fromJSON('["OWNER", "COLLABORATOR"]'), github.event.comment.author_association)) || github.event_name == 'push' }}
 
     strategy:
       matrix:
         node:
-          - 18.12.0
+          - 20.15.1
         os:
           - macos-latest
           - ubuntu-20.04
           - windows-2019
 
     runs-on: ${{ matrix.os }}
 
+    permissions:
+      contents: read
+      pull-requests: read
+
     name: ${{ matrix.os }}(Node.js ${{ matrix.node }})
 
     env:
@@ -42,14 +46,45 @@ jobs:
         with:
           ref: refs/pull/${{ github.event.issue.number }}/merge
 
+      - name: Ensure no more commits after the triggering comment
+        uses: actions/github-script@v7
+        if: ${{ github.event_name == 'issue_comment' }}
+        env:
+          ISSUE_NUMBER: ${{github.event.issue.number}}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        with:
+          script: |
+            const { ISSUE_NUMBER, COMMENT_ID } = process.env
+            let page = 1
+            let hasFoundComment = false
+            while(true) {
+              const { data: timelines } = await github.rest.issues.listEventsForTimeline({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: ISSUE_NUMBER,
+                page,
+                per_page: 100,
+              })
+              if (timelines.some(v => {
+                hasFoundComment = hasFoundComment || (v.event === 'commented' && `${v.id}` === `${COMMENT_ID}`)
+                return hasFoundComment && v.event === 'committed'
+              })) {
+                throw new Error('The last commit comes after the comment, please comment and package after last commit')
+              }
+              if (timelines.length === 0) {
+                return
+              }
+              page += 1
+            }
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           cache: "yarn"
 
       - name: Restore
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             node_modules
@@ -58,7 +93,7 @@ jobs:
 
       - name: Add msbuild to PATH
         if: matrix.os == 'windows-2019'
-        uses: microsoft/setup-msbuild@v1.3.1
+        uses: microsoft/setup-msbuild@v2
         env:
           ACTIONS_ALLOW_UNSECURE_COMMANDS: "true"
 
@@ -208,6 +243,9 @@ jobs:
     needs: [packaging]
     name: Append links to the Pull Request
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
       - name: Comment by push event
         if: ${{ github.event_name == 'push' }}
@@ -218,7 +256,7 @@ jobs:
 
       - name: Comment by pull request comment event
         if: ${{ github.event_name == 'issue_comment' }}
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@v4
         with:
           comment-id: ${{ github.event.comment.id }}
           body: |
@@ -230,10 +268,12 @@ jobs:
     if: ${{ always() && needs.packaging.result == 'failure' }}
     name: Append failed comment to the comment
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: Comment by pull request comment event when package failed
         if: ${{ github.event_name == 'issue_comment' }}
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@v4
         with:
           comment-id: ${{ github.event.comment.id }}
           body: Packageing failed in [${{ github.run_id }}](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}). @${{ github.event.comment.user.login }}

.github/workflows/spam-comment-detection.yaml

@@ -0,0 +1,49 @@
+name: Spam detection
+
+on:
+  issue_comment:
+    types: [created, edited]
+
+permissions:
+  issues: write
+
+jobs:
+  detect-spam:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Node.js
+        uses: actions/setup-node@main
+
+      - name: Check for Spam
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const comment = process.env.COMMENT_BODY.toLowerCase()
+            const spam_words = process.env.SPAM_WORDS.split(',').map(w => w.toLowerCase())
+            const comment_id = process.env.COMMENT_ID
+            const issue_number = process.env.ISSUE_NUMBER
+            const owner = process.env.REPO_OWNER
+            const repo = process.env.REPO_NAME
+            const EXTERNAL_LINK_REGEXT = /https?:\/\/(?!((\w+\.)?github\.com|github\.com|(\w+\.)?magickbase\.com|(\w+\.)?nervos\.org))/gi
+            if (spam_words.some(w => comment.includes(w))) {
+              console.info(`Spam comment: ${comment}`)
+              github.rest.issues.deleteComment({ owner, repo, comment_id })
+            } else if (EXTERNAL_LINK_REGEXT.test(comment)) {
+              console.info(`External link detected, append an annotation`)
+              github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number,
+                body: `An external link is mentioned in the comment above. Please verify the link's safety before visiting.`
+              })
+            } else {
+              console.info("No spam detected")
+            }
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          REPO_OWNER: ${{github.repository_owner }}
+          REPO_NAME: ${{ github.event.repository.name }}
+          SPAM_WORDS: ${{ secrets.SPAM_WORDS }}

.github/workflows/unit_tests.yml

@@ -9,7 +9,7 @@ jobs:
     strategy:
       matrix:
         node:
-          - 18.12.0
+          - 20.15.1
         os:
           - macos-latest
           - ubuntu-20.04
@@ -35,7 +35,7 @@ jobs:
           cache: "yarn"
 
       - name: Restore
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             node_modules

.github/workflows/update_ckb_client_versions.yml

@@ -8,6 +8,7 @@ jobs:
   default:
     name: Update CKB client versions
     runs-on: ubuntu-latest
+    environment: neuron-bot
     permissions:
       pull-requests: write # open PR
       contents: write # update version files
@@ -19,7 +20,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 20.15.1
 
       - name: Update versions
         id: update_versions
@@ -36,7 +37,7 @@ jobs:
           git_commit_gpgsign: true
 
       - name: Open PR to develop branch
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@v6
         with:
           title: Update ckb client versions
           commit-message: 'feat: update ckb client versions'