Conversation
Apply the standard hardening recipe (mirrors euler-vault-creator PR #50, adapted for npm): - package.json: pin all deps to exact versions; pin packageManager (npm@10.8.2) and engines.node (>=20). Remove unused express dep (eliminates 4 prod audit findings: express/body-parser/path-to-regexp/qs). - .nvmrc: pin Node to 20 (matches existing check-adapters workflow). - .npmrc: audit-level=high, engine-strict=true, save-exact=true, fund=false. - .github/dependabot.yml: weekly npm + github-actions updates with 7-day release cooldown. - .github/workflows/ci.yml: new least-priv PR validation workflow — npm ci, lockfile-drift gate, and npm audit --audit-level=high --omit=dev. - .github/workflows/check-adapters.yml: SHA-pin actions/checkout, actions/setup-node, jakejarvis/s3-sync-action; switch setup-node to read .nvmrc. Lint is intentionally not gated in CI — repo has pre-existing lint errors on master that are out of scope for this hardening pass. Note: the prebuild step still pulls @objectivelabs/oracle-sdk from github:euler-xyz/oracle-sdk#main on every build, which floats by design. That's a separate concern from this hardening pass.
- Bump Node 20 → 22 (.nvmrc, engines.node, @types/node) — Node 20 hits EOL 2026-04-30. - Bump packageManager to npm@10.9.8 and add min-release-age=7 to .npmrc (install-time release-age gate; requires npm 10.9+). - Pin @objectivelabs/oracle-sdk to commit SHA (41d9222415ec276b89d1d82bc166c4b6ccff2d0b) instead of floating #main, and drop the prebuild script that re-pulled #main on every build. The check-adapters workflow remains the canonical update path — it ephemerally installs #main at runtime but does not commit the bump. - check-adapters.yml: workflow-level permissions now contents:read; job-level retains contents:write (needed for the data/ + submodule push). Narrows the scope inherited by reusable/composite actions. - ci.yml: drop --omit=dev from the audit gate so dev-tree CVEs are not silently skipped. - npm audit fix: resolved all 10 prior findings (rollup, glob, picomatch, minimatch, brace-expansion, ajv, flatted, js-yaml, yaml, @isaacs/brace-expansion).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
End-to-end supply-chain hardening for the oracle-checks repo. Two commits:
.npmrcknobs, frozen-lockfile installs, lockfile-drift CI gate, npm audit gate, Dependabot cooldown, least-priv workflow perms, GH Actions pinned to SHAs.min-release-age=7,oracle-sdkpinned to a SHA, narrowercheck-adaptersperms, audit gate covers dev tree,npm audit fixzeroes the prior 10 findings.Controls applied
packageManagerpinned via Corepack —npm@10.9.8.nvmrc=22,engines.node>=22,engine-strict=true.npmrchardened —audit-level=high,engine-strict=true,save-exact=true,fund=false,min-release-age=7npm ciin both workflowsnpm audit --audit-level=high(no--omit=dev)npmandgithub-actionsci.ymliscontents: read;check-adapters.ymliscontents: readat workflow level withcontents: writeonly on the job that needs to pushactions/checkout,actions/setup-node,jakejarvis/s3-sync-actionSkipped:
Notable design choices
@objectivelabs/oracle-sdkis pinned to a commit SHA (41d9222415…) instead of floating#main. Theprebuildscript that re-pulled#mainon every build was removed. The hourlycheck-adaptersworkflow still installs#mainephemerally at runtime — that's its job — but it commits onlydata/, so the SHA pin inmasterstays stable. To bump the SDK, open a PR.check-adapters.ymlruns ascontents: readat workflow level; the single job retainscontents: writebecause it commitsdata/and submodule changes. Narrows the scope inherited by composite/reusable actions.min-release-age=7is in days (verified against npm cli source —default: null, hint: '<days>', type: [null, Number]). Requires npm 10.9+; that's whypackageManageris bumped to10.9.8.Test plan
npm ciclean on Node 22 + npm 10.9.xnpm run buildproduces working output on Node 22npm audit --audit-level=highreportsfound 0 vulnerabilitiesmaster(8 high, 4 moderate, 1 low) close