Repository navigation
[P2][ci] Pin JSR publish CLI to exact version #24
Description
Summary
JSR publish job runs npx --yes jsr publish without pinning the CLI version. A publish-capable OIDC token is exposed to whatever @latest resolves to at run time — supply-chain risk.
Audit ID: Section 2 Med — Wave 2
Note: npm provenance tracked separately in #7.
Root cause
.github/workflows/publish.yml:84:
- run: npx --yes jsr publishFix
Pin exact version, e.g.:
- run: npx --yes jsr@0.13.4 publishLook up current jsr CLI version in lockfile or npm registry at implementation time; document bump process in workflow comment.
Acceptance criteria
- JSR CLI version pinned in
publish.yml. - Workflow comment explains how to bump.
- No changeset (CI only).
Verification
- Dry-run or review workflow syntax; full verify on next release.
Activity
feat: pre-announcement hardening across kernel, adapters, lenses, CLI…
cevheri commentedon Jul 3, 2026
Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.