ci: add trusted npm release gates - #67
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c8a7949f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| requireText(publish, 'release-artifact/${{ needs.prepare.outputs.tarball }}', publishFile); | ||
| requireText(publish, 'npm publish "release-artifact/${{ needs.prepare.outputs.tarball }}"', publishFile); | ||
| check( | ||
| publish.trimEnd().endsWith('run: npm publish "release-artifact/${{ needs.prepare.outputs.tarball }}"'), |
There was a problem hiding this comment.
Because this only checks that the file ends with the approved npm publish, validate:supply-chain still passes if a new publish-job step after Download prepared release artifact runs npm publish ... before the artifact/draft-release gates; I verified by inserting such a step and the validator still reported OK. Since npm publish --help identifies this as “Publish a package”, that bypass would publish once the npm-release environment is approved, before the machine checks this workflow is meant to enforce.
Useful? React with 👍 / 👎.
|
|
||
| const workflowDir = '.github/workflows'; | ||
| const workflowFiles = fs.readdirSync(workflowDir) | ||
| .filter((name) => name.endsWith('.yml')) |
There was a problem hiding this comment.
GitHub Actions accepts both .yml and .yaml workflow files (official syntax docs: “must have either a .yml or .yaml file extension”), but this directory scan drops everything except .yml. A future .github/workflows/*.yaml file can use mutable actions or checkout credentials and validate:supply-chain will still pass—I verified with an evil.yaml containing actions/checkout@v4—so the supply-chain policy is not actually repo-wide.
Useful? React with 👍 / 👎.
1 participant
What changed
main/source SHA bindingSECURITY.md, the release contract, and a dependency-free supply-chain validatorWhy
The repository had no trusted-publishing path, no required supply-chain policy check, mutable Action tags, and release documentation that could not prove the npm artifact, provenance, and GitHub release referred to the same source.
Impact
This does not publish npm or mutate consumer files. It adds release-only CI policy and documentation. Live
npm-release, trusted publisher, release immutability, registry publication, and provenance readback remain explicit post-merge gates.Validation
npm run validategit diff --check 36be35f..HEADnpm pack --dry-runRepository note: there is one maintainer, so GitHub's independent approval requirement cannot be satisfied by a second collaborator. Do not confuse the independent task review above with a GitHub approval; any merge must use the existing documented admin exception after CI is green.
Refs #57
Refs #55