Repository navigation
ci: supply-chain baseline (P3): no cache in release, npm scripts off, exact Node, cooldowns, zizmor - #5
Merged
Conversation
… exact Node, cooldowns, zizmor - release.yml: no npm cache (a cache written by another run never reaches the job that writes the release and signs attestations), Node 24.21.0 by exact version (npm 11.19.0), npm ci --ignore-scripts. - ci.yml: npm ci --ignore-scripts in build and instance-test (the SDK builds and packs without install scripts); no npm cache in instance-test, which holds the instance's OAuth secret; a zizmor 1.30.1 job. - Both workflows grant nothing at the top; each job asks for what it needs. - Dependabot cooldowns (7 days, 14 for a semver-major npm bump); .npmrc min-release-age=7. - CHANGELOG: one line under [Unreleased] Added (placed so it merges cleanly with #2).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supply-chain baseline, step P3 (Tier 2: public and publishing repos), finding F7. References: jschuller/homelab-governance (
ci.yml,.github/zizmor.yml,.github/dependabot.yml), jschuller/health-lakehouse#25, jschuller/chatops#15.What changed
release.yml(F7, SC-7/SC-10): this job writes the release and signs attestations.cache: npmis removed andpackage-manager-cache: falseis set. Before, the job restored a cache that other runs had written..nvmrc. 24.22.0 came out on 2026-10-14 and fails the cooldown.npm ci --ignore-scripts.ci.yml:npm ci --ignore-scriptsinbuildandinstance-test.instance-test, which holds the instance's OAuth client secret.cc914d7f), configured by.github/zizmor.yml.permissions: {}. Each job asks for what it needs: thereleasejob's grants are unchanged, and the CI jobs getcontents: read..github/dependabot.ymlcooldowns: npm 7 days (14 for a semver-major bump), github-actions 7 days. Groups and the React ignores are unchanged..npmrcwithmin-release-age=7. Node 24's npm 11.19 supports it (from 11.10).[Unreleased]→ Added. It is placed so that it merges cleanly with docs: explain SDK development-dependency advisories #2 (checked withgit merge-tree).Install scripts
With scripts off, four packages skip their install scripts:
@parcel/watcher,@swc/core,fseventsandlibxmljs2.min-release-age=7active):npm ci --ignore-scripts,npm run lint,npm run sync:skills -- --check,npm run build:ci(frozen keys) andnpm run packall pass.libxmljs2is only used by the SDK's SBOM library.npm run deployandnpm run test:instancewithout install scripts. They run only on main whenSN_SDK_INSTANCE_URLis set.Checks
check_pr_ci.py: no findings.Unchanged pins: checkout v7.0.1, setup-node v7.1.0, attest v4.2.2. Open Dependabot PR #4 (eslint 10.13.0) and docs PR #2 are left alone.
Nothing to apply; merging is the owner's.