Security: Use npm ci instead of npm install in release-notes.yml to enforce lockfile integrity

[LucasMaupin]

Severity

Low

Description

The .github/workflows/release-notes.yml workflow installs @anthropic-ai/sdk using npm install without a pre-committed lockfile. npm install resolves the latest satisfying version at run time, meaning different CI runs can silently pull in different (potentially malicious or buggy) transitive dependency versions.

This workflow runs with access to ANTHROPIC_API_KEY and GITHUB_TOKEN, making it a worthwhile supply-chain target.

Risk

• Non-reproducible builds — transitive dependency versions can differ between runs
• A compromised package version could be silently introduced without lockfile pinning
• No integrity check is performed against a known-good dependency tree

Remediation

1. Create a small dedicated directory (e.g., .github/scripts/release-notes/) containing:
   • package.json declaring @anthropic-ai/sdk as a dependency
   • A committed package-lock.json generated by npm install locally
2. Update the workflow to use npm ci from that directory:

   - name: Install dependencies
     working-directory: .github/scripts/release-notes
     run: npm ci

3. Keep the lockfile up to date via Dependabot or Renovate (see issue Add Dependabot config to backend repo for automated dependency updates #253).
4. Pin the GitHub Actions used in this workflow to full commit SHAs (see issue Security: Pin GitHub Actions to commit SHAs to prevent supply chain attacks #235).

[birme]

Picked up by daily-backlog-pr but cannot be auto-implemented this run: the fix requires editing files under .github/workflows/, and the automation's GitHub token lacks the workflow OAuth scope needed to push workflow changes (GitHub rejects such pushes with refusing to allow ... without workflow scope).

Leaving this in Ready. It needs either a maintainer with a workflow-scoped token/PAT, or a token upgrade for the automation. No code change was made.

[birme]

Partially implemented in PR #323 by today's daily-backlog-pr run: the dedicated .github/scripts/release-notes/ dir (package.json + committed package-lock.json + extracted script) is in the PR. The release-notes.yml workflow edit itself (npm install → npm ci with working-directory) is NOT included — the automation token lacks workflow scope, so GitHub blocks changes to files under .github/workflows/. A maintainer with workflow scope needs to apply that one-line workflow change on top of this PR to fully close the issue.