Supply chain hardening for npm and actions by data-douser · Pull Request #258 · advanced-security/codeql-development-mcp-server

data-douser · 2026-04-18T01:22:54Z

Summary of Changes

This pull request introduces several improvements to the repository's CI/CD workflows and dependency management practices, with a primary focus on increasing security and reliability when installing npm dependencies. The most significant change is the adoption of --ignore-scripts for all npm install/ci commands in CI workflows, preventing the execution of potentially unsafe lifecycle scripts from dependencies. Minor enhancements and cleanups are also made to workflow triggers and configuration.

Outline of Changes

CI/CD Security and Reliability Improvements:

Enforces --ignore-scripts for all npm install and npm ci commands across workflows to prevent execution of potentially unsafe lifecycle scripts from dependencies. This is backed by adding ignore-scripts=true to .npmrc for extra safety. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15]

Dependency Management Enhancements:

Updates the Dependabot configuration to ignore updates for @types/vscode, aligning its versioning with the minimum supported VS Code version and preventing accidental exposure of unsupported APIs. Also updates the upgrade:node script to reject updates for @types/vscode as well as zod. [1] [2]

Workflow and Trigger Cleanup:

Removes unnecessary workflow_dispatch (manual trigger) entries from GitHub Actions workflows, reducing clutter and ensuring workflows are only triggered automatically as intended. [1] [2] [3] [4] [5] [6] [7] [8] [9]

These changes collectively improve the security, maintainability, and automation of the project's CI/CD pipeline.

- Add `--ignore-scripts` to all CI `npm ci`/`npm install` invocations and set `ignore-scripts=true` in `.npmrc` so install-time scripts from transitive dependencies cannot run during PR builds. - Pin `@types/vscode` in Dependabot config and in the root `upgrade:node` script's `--reject` list so it cannot be auto-upgraded past the `engines.vscode` floor. - Add a two-workflow handoff to rebuild `server/dist/**` for Dependabot PRs without granting write tokens to untrusted PR code: * `build-server.yml` (pull_request, read-only) uploads the built `server/dist` artifact and skips the drift check for Dependabot. * `dependabot-commit-dist.yml` (workflow_run, trusted, contents:write) downloads the artifact, verifies the head SHA, and commits the rebuilt files back to the PR branch as `dependabot[bot]`. - Remove unused `workflow_dispatch:` triggers from workflows that have no inputs (lint-and-format, client-integration-tests, query-unit-tests, query-unit-tests-swift, copilot-setup-steps); keep it on `release.yml` and `update-codeql.yml` (the latter has a meaningful `target_version` input). - Update the add-language skill's `SKILL.md` and `workflow-template.yml` to match: drop `workflow_dispatch:`, pin actions to SHAs, and use `npm ci --ignore-scripts`.

github-actions · 2026-04-18T01:23:12Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

This PR hardens the repository’s CI/CD and dependency-update pipeline by preventing npm lifecycle scripts from running in CI and by adding a trusted-workflow handoff to regenerate and commit server/dist for Dependabot PRs.

Changes:

Enforce --ignore-scripts across CI npm install/ci steps and add ignore-scripts=true to .npmrc.
Add a workflow_run-based workflow to commit rebuilt server/dist back to Dependabot PR branches, and upload server/dist as an artifact from the server build workflow.
Prevent automated updates to @types/vscode (Dependabot + upgrade:node) to keep it aligned with the VS Code engine floor.

Show a summary per file

File	Description
package.json	Prevent `upgrade:node` from bumping `@types/vscode`.
.npmrc	Enforce `ignore-scripts=true` repo-wide for npm installs.
.github/workflows/update-codeql.yml	Add `--ignore-scripts` to dependency installation.
.github/workflows/release.yml	Add `--ignore-scripts` for release-time production install.
.github/workflows/release-vsix.yml	Add `--ignore-scripts` to CI installs for VSIX release workflow.
.github/workflows/release-tag.yml	Add `--ignore-scripts` to CI installs for tag workflow.
.github/workflows/release-npm.yml	Add `--ignore-scripts` to CI installs for npm release workflow.
.github/workflows/query-unit-tests.yml	Remove `workflow_dispatch`; add `--ignore-scripts` to installs.
.github/workflows/query-unit-tests-swift.yml	Remove `workflow_dispatch`; add `--ignore-scripts` to installs.
.github/workflows/lint-and-format.yml	Remove `workflow_dispatch`; add `--ignore-scripts` to installs.
.github/workflows/dependabot-commit-dist.yml	New trusted workflow to push rebuilt `server/dist` to Dependabot PRs.
.github/workflows/copilot-setup-steps.yml	Tighten triggers and add `--ignore-scripts` to installs.
.github/workflows/client-integration-tests.yml	Remove `workflow_dispatch`; add `--ignore-scripts` to installs.
.github/workflows/build-server.yml	Remove `workflow_dispatch`; add `--ignore-scripts`; upload `server/dist` artifact; skip “dirty tree” check for Dependabot.
.github/workflows/build-and-test-extension.yml	Remove `workflow_dispatch`; add `--ignore-scripts` to installs.
.github/skills/add-mcp-support-for-new-language/workflow-template.yml	Remove `workflow_dispatch` from the workflow template.
.github/skills/add-mcp-support-for-new-language/SKILL.md	Update documented workflow example to pinned SHAs and `--ignore-scripts`.
.github/dependabot.yaml	Ignore `@types/vscode` updates via Dependabot.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/dependabot-commit-dist.yml:116

These cp commands copy from artifact/<filename>, but the downloaded artifact will likely contain the files under artifact/server/dist/<filename> (matching the upload paths). Align the copy source paths with the downloaded artifact layout so the workflow can actually update server/dist/ in the PR branch.

          cp artifact/codeql-development-mcp-server.js server/dist/
          cp artifact/codeql-development-mcp-server.js.map server/dist/

Files reviewed: 18/18 changed files
Comments generated: 1

Copilot

Copilot's findings

Files reviewed: 21/21 changed files
Comments generated: 3

Avoid Code Scanning alert for newly added workflow. To be revisited in future work. Removes the workflow_run-based handoff that rebuilt and pushed 'server/dist/**' back to Dependabot PR branches, along with the upload-artifact step and Dependabot-specific dirty-tree guard in 'build-server.yml' that fed it. - Delete '.github/workflows/dependabot-commit-dist.yml' - Remove 'server-dist' upload-artifact step from build-server.yml - Drop 'if: github.actor != dependabot[bot]' on the dirty-tree check so it now fails loudly for all PRs, including Dependabot

Copilot

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/client-integration-tests.yml:180

In this job, npm run bundle -w server now rebuilds esbuild internally (via server/package.json’s updated bundle script). The explicit npm rebuild esbuild --ignore-scripts=false step is therefore redundant and can likely be removed.

      ## esbuild's optional platform binary is normally wired up by its postinstall
      ## script; .npmrc 'ignore-scripts=true' suppresses that, so rebuild here.
      - name: CODEQL_PATH Tests - Rebuild esbuild platform binary
        run: npm rebuild esbuild --ignore-scripts=false

Files reviewed: 20/20 changed files
Comments generated: 6

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/build-and-test-extension.yml:47

This explicit npm rebuild esbuild step looks redundant now that both server and extensions/vscode bundle scripts run rebuild:esbuild themselves. Keeping both causes duplicated work (and can be confusing about where the rebuild is supposed to happen). Consider removing this workflow step and relying on the package scripts, or adjust the scripts so the rebuild happens in exactly one place.

      - name: Build server (dependency)
        run: npm run build -w server

      - name: Run extension unit tests with coverage

Files reviewed: 19/19 changed files
Comments generated: 2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 19/19 changed files
Comments generated: 0 new

data-douser added 2 commits April 17, 2026 18:15

Avoid auto-upgrade of node "@types/vscode"

50f63f3

data-douser self-assigned this Apr 18, 2026

Copilot AI review requested due to automatic review settings April 18, 2026 01:22

data-douser added enhancement New feature or request dependencies Pull requests that update a dependency file testing labels Apr 18, 2026

Copilot started reviewing on behalf of data-douser April 18, 2026 01:23 View session

github-advanced-security AI found potential problems Apr 18, 2026

View reviewed changes

Comment thread .github/workflows/dependabot-commit-dist.yml Fixed

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread .github/workflows/dependabot-commit-dist.yml Outdated

data-douser added 2 commits April 17, 2026 19:32

Fix esbuild rebuild w/ "--ignore-scripts"

80111a9

More fixes for failing CI workflows

76543db

Copilot AI review requested due to automatic review settings April 18, 2026 01:50

Copilot started reviewing on behalf of data-douser April 18, 2026 01:50 View session

Fix download path in dependabot-commit-dist.yml

563ed1d

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread server/package.json Outdated

Comment thread extensions/vscode/package.json Outdated

Comment thread .github/workflows/update-codeql.yml

data-douser added 2 commits April 18, 2026 10:44

Address review feedback for PR #258

34d88c3

data-douser requested a review from Copilot April 18, 2026 16:56

Copilot started reviewing on behalf of data-douser April 18, 2026 16:56 View session

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Apply suggestions from code review

a30be1d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 18, 2026 17:05

Copilot started reviewing on behalf of data-douser April 18, 2026 17:06 View session

Update .github/workflows/build-and-test-extension.yml

1cfaf0f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread .github/workflows/build-server.yml

Comment thread .github/workflows/client-integration-tests.yml Outdated

Update .github/workflows/client-integration-tests.yml

48e9791

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 18, 2026 17:15

Copilot started reviewing on behalf of data-douser April 18, 2026 17:16 View session

Merge branch 'main' into dd/actions-hardening/1

ceafb04

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Supply chain hardening for npm and actions#258

Supply chain hardening for npm and actions#258
data-douser wants to merge 11 commits intomainfrom
dd/actions-hardening/1

data-douser commented Apr 18, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

data-douser commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Outline of Changes

Uh oh!

github-actions bot commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

data-douser commented Apr 18, 2026 •

edited

Loading

github-actions bot commented Apr 18, 2026 •

edited

Loading