From f8c88970fcd8fff8e97bc62edc5f5c073a0527fe Mon Sep 17 00:00:00 2001 From: zaniebot Date: Wed, 14 Oct 2026 03:52:00 -0500 Subject: [PATCH] Verify npm dependency signatures before builds (#1027) CI installs the locked npm dependency tree without running lifecycle scripts, but it does not verify registry signatures or available provenance attestations. Run `npm audit signatures` after installation in both the test and checksum-update workflows, before `npm run all` executes dependency tooling. The check follows npm's registry-signature support and verifies attestations when present; it does not require every dependency to publish provenance. Related: astral-sh/ruff-action#402 adds the same signature and provenance verification. astral-sh/setup-uv#1026 separately hardens `npm` install defaults. Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com> --- .github/workflows/test.yml | 2 ++ .github/workflows/update-known-checksums.yml | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e61e806..9940a5c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -34,6 +34,8 @@ jobs: cache: npm - run: | npm ci --ignore-scripts + - name: Verify npm package signatures + run: npm audit signatures - run: | npm run all - name: Check all jobs are in all-tests-passed.needs diff --git a/.github/workflows/update-known-checksums.yml b/.github/workflows/update-known-checksums.yml index 4f3fc29..1ed3b04 100644 --- a/.github/workflows/update-known-checksums.yml +++ b/.github/workflows/update-known-checksums.yml @@ -38,7 +38,10 @@ jobs: fi - name: Compile changes if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }} - run: npm ci --ignore-scripts && npm run all + run: | + npm ci --ignore-scripts + npm audit signatures + npm run all - name: Create Pull Request if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }} uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1