chore(ci): harden workflows and bump packageManager to pnpm@11.1.1#215
Closed
AlemTuzlak wants to merge 1 commit into
Closed
chore(ci): harden workflows and bump packageManager to pnpm@11.1.1#215AlemTuzlak wants to merge 1 commit into
AlemTuzlak wants to merge 1 commit into
Conversation
AlemTuzlak
force-pushed
the
chore/cicd-hardening-pnpm-bump
branch
from
ec050bd to
9aff9a4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens GitHub Actions workflows against common CI/CD attack vectors (action pinning, persist-credentials, timeouts) and bumps the package manager to pnpm@11.1.1.
Findings & fixes applied
.github/workflows/autofix.yml,.github/workflows/pr.yml,.github/workflows/release.yml.actions/checkout@v6.0.2→actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2nrwl/nx-set-shas@v4.4.0→nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0changesets/action@v1.8.0→changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0autofix-ci/actionalready pinned to SHA — added# v1comment.permissions:(no change needed). Newzizmor.ymldeclarespermissions: {}(empty, least-privilege).persist-credentials: false— added to 3actions/checkoutinvocations inautofix.yml(the autofix-ci action uses GitHub's app-token flow, not the checkout credential) andpr.yml(test + preview jobs, neither pushes back). NOT added torelease.ymlsince the changesets action pushes version PRs and tags.timeout-minutes:— addedtimeout-minutes: 20to autofix, test, preview jobs;timeout-minutes: 40to release job;timeout-minutes: 10on the new zizmor job.cancel-in-progress: trueon PR-triggered workflows. Removedcancel-in-progress: truefromrelease.ymlsince cancelling mid-publish is dangerous (kept the concurrency group so concurrent release runs still serialise)..github/workflows/zizmor.ymlto lint workflows for security weaknesses on push tomainand on every PR.Findings deferred (need maintainer review)
pull_request_targetusage, no obvious script-injection sinks, no echoed secrets, nocurl | sh.pnpm bump
packageManager: pnpm@11.1.0 → pnpm@11.1.1 (corepack-written integrity hash).pnpm install: succeeds cleanly. No "Ignored build scripts" warnings — the existingpnpm-workspace.yamlalready declares anallowBuildsallowlist withnx,esbuildenabled andunrs-resolver,@parcel/watcher,lmdb,msgpackr-extractexplicitly disabled.onlyBuiltDependenciesallowlist: n/a — already configured underallowBuildsinpnpm-workspace.yaml; no additions required for clean install.pnpm.overridesmigration: n/a — no"pnpm": { ... }block exists inpackage.json. Theoverridesfield at the top level ofpackage.jsonis the standard npm-compatible overrides format (not the pnpm-specific nested form) and was left as-is.packageManagervia theTanStack/config/.github/setupcomposite action.Validation
autofix.yml,pr.yml,release.yml,zizmor.yml)gh api.pnpm install: clean (169 workspace projects, no warnings)pnpm run build:all: build itself succeeded for all 10 projects; a downstreamsize-limitstep hit a Windows path quirk (EISDIR: ... 'F:') unrelated to pnpm 11 or these workflow changes — will resolve in CI's Linux environment.What I did NOT change
.npmrcedits (no warnings from pnpm 11)release.ymlcheckout'spersist-credentialssetting — release publishes via changesets/action which pushes back