test: verify CI with npm hardening changes (fork-only, not for upstream) - #3
Draft
NickJavaDev88 wants to merge 4 commits into
Draft
test: verify CI with npm hardening changes (fork-only, not for upstream)#3NickJavaDev88 wants to merge 4 commits into
NickJavaDev88 wants to merge 4 commits into
Conversation
Copy link
Copy Markdown
Owner
Sorry, something went wrong.
Add .npmrc with min-release-age=1, refusing to resolve any version published less than a day ago. Recent npm compromises were detected well inside that window (debug/chalk ~2.5h, Shai-Hulud ~12h), so a one-day delay would have blocked them while staying compatible with the daily Dependabot cadence. min-release-age is silently ignored by npm < 11.10.0, and .nvmrc pins only the Node major, so engine-strict plus engines.npm turns that silent no-op into a hard failure. Also record allowScripts: every dependency in the current lockfile flagged hasInstallScript, all native-binary packages that legitimately need a build step. This is deliberately not ignore-scripts=true, which would stop npm from running the postbuild hook around npm run build and would silently ship builds without a search index. allowScripts applies to dependencies' install scripts only, and matches the default npm 12 is expected to adopt.
npm install is allowed to re-resolve the graph and rewrite the lockfile, so CI could install versions that were never reviewed and that package-lock.json does not pin. npm ci installs exactly the lockfile and fails if it disagrees with package.json. Pin npm explicitly first: .nvmrc pins only the Node major, and the bundled npm differs per Node 24 patch release (24.11.1 ships 11.6.2, 24.16.0 ships 11.13.0, 24.18.0 ships 11.16.0), so without this the min-release-age quarantine holds only by accident. Add a dependency-review job on pull requests so new dependencies and known vulnerabilities are visible during review instead of buried in a lockfile diff. It keeps its own minimal permissions rather than widening the workflow-level contents: read.
Copy link
Copy Markdown
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 0095d6b5-765c-45d6-b124-591860f9c701 You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file. Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
Fix what the fork's Linter workflow caught on this file: a fenced code block missing a language hint (MD040), two terminology hits from the textlint natural-language check (git -> Git, github-actions -> the literal ecosystem name in code span), and Prettier formatting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR opened only to trigger the pull_request CI event on my own fork and confirm the workflow changes run correctly (npm ci, min-release-age quarantine, allowScripts, dependency-review job). Not intended to be merged or sent upstream.