hookified - chore: defense - align with the latest Node.js checklist - #212
Conversation
Refresh DEFENSE_IN_DEPTH.md to the current catalog and record the digest-pinned Dev Container image in SECURITY.md. Co-authored-by: Jared Wray <me@jaredwray.com>
GitHub rulesets cannot require a status check whose name contains a space. Co-authored-by: Jared Wray <me@jaredwray.com>
Fork pull requests cannot upload SARIF. Same-repo runs still use Advanced Security. Co-authored-by: Jared Wray <me@jaredwray.com>
Run the pinned installer outside the repo so .nvmrc cannot break it, and add the GitHub CLI and Docker-in-Docker features. Co-authored-by: Jared Wray <me@jaredwray.com>
The package is not in the lockfile, so the lifecycle-script allowlist no longer names it. Co-authored-by: Jared Wray <me@jaredwray.com>
Co-authored-by: Jared Wray <me@jaredwray.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #212 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 5 5
Lines 433 433
Branches 109 109
=========================================
Hits 433 433 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 591ff83121
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| if [[ -f package.json ]] && grep -q '"packageManager"' package.json && command -v corepack >/dev/null; then | ||
| corepack enable | ||
| if ! command -v pnpm >/dev/null \ |
There was a problem hiding this comment.
When a Codespace or cloud-agent image already exposes pnpm, this condition skips Corepack and the later install runs whichever version the image provides rather than the exact pnpm@12.4.1 declared in package.json. An older pnpm can reject or ignore newer workspace security settings such as trustPolicy and minimumReleaseAgeStrict, undermining this bootstrap's protections or breaking installation; create the Corepack shim whenever Corepack and packageManager are available, or explicitly verify that the existing executable matches the pinned version.
Useful? React with 👍 / 👎.
2 participants
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
Supply-chain hardening. No library behavior change, so no new unit tests.
Summary
Bring the repo in line with the current defense-in-depth-nodejs catalog: CODEOWNERS, kebab-case check names, Safe Chain bootstrap, Dev Container features, and fork-PR zizmor.
Status update
DEFENSE_IN_DEPTH.md: CODEOWNERS (/.vscode/) and kebab-case workflow/job names →(PR #212 pending). Dev Container digest pin recorded as done (PR #208).unrs-resolverremoved from theallowBuildsnote.What changed
.github/CODEOWNERSnow covers/.vscode/for@jaredwray, before that directory exists.check-workflows,aikido-gate,deploy-website,analyze. Required checks staytestandzizmor.check-workflowsskips Advanced Security SARIF upload on fork PRs and uses zizmor annotations there.scripts/setup-cloud-environment.shmatches the skill: Corepack installspnpminto~/.safe-chain/binonly whenpnpmis missing, and the pinned installer runs from/so.nvmrccannot break NVM..devcontainer/devcontainer.jsonkeeps the existing digest pin and addsgithub-cli:1anddocker-in-docker:4(moby: false).allowBuildsno longer listsunrs-resolver(not in the lockfile).esbuild,sharp, andworkerdstay.SECURITY.mdlists the digest-pinned Dev Container image.Still for a maintainer
npm login, thencheck-npmjs.sh --repo jaredwray/hookified --workflow release.yaml(not copied into this repo). Stage-only publishing, Drydock, and 2FA promotion were not re-checked here.lockdown-repo.shapply is still required. Latest--checkfails because the branch ruleset has no ownerpull_requestbypass, and the tag ruleset has no repository-admin bypass. This PR does not run apply and does not add the script.Verification
bash -n scripts/setup-cloud-environment.shname:fields contain no spacespnpm test— 312 passed, 100% coverage (Node 22.22.2)defense-in-depth-nodejs § 2, § 3, § 4