ci: harden release pipeline against supply-chain attacks#20
Merged
Conversation
- ci.yaml: explicit minimum permissions, correct master branch trigger - release.yaml: gate publish on npm-publish environment, add concurrency group, publish with --provenance for SLSA build attestation - AGENTS.md: codify package.json supply-chain hygiene (no optionalDependencies, no extra install-time lifecycle scripts, no floating/url/git dependency specifiers) NOTE: the npm-publish environment must be created in GitHub repo settings with required reviewers, otherwise the gate is a no-op.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Apply lessons from the May 2026 TanStack npm supply-chain compromise to this repo's CI/release pipeline.
ci.yaml: add explicitpermissions: contents: read; fix push trigger that pointed at the non-existentmainbranch (default here ismaster).release.yaml: gate the publish job on a newnpm-publishGitHub Environment (required reviewer); add aconcurrencygroup keyed ongithub.ref; pass--provenancetonpm publishso the tarball carries SLSA build attestation verifiable vianpm audit signatures.AGENTS.md: new "package.json — supply-chain hygiene" section forbiddingoptionalDependencies, extra install-time lifecycle scripts, floating version ranges, and git/url/tarball specifiers — the shapes the TanStack worm payload used.Manual follow-up
The
npm-publishGitHub Environment must be created in repo Settings → Environments with a required reviewer, otherwise the newenvironment:key is a no-op gate.Test plan
vX.Y.Z-rc.1prerelease tag and confirm the publish job pauses awaiting environment approvalnpm audit signatures opencode-presets@<new>reports provenance verified