chore: add a release cooldown and pin CI actions to commit SHAs - #13
Merged
Conversation
minimumReleaseAge, available since pnpm 10.16, keeps freshly published versions unresolvable for 48 hours — the window in which registry compromises are typically caught and yanked. minimumReleaseAgeExclude is the escape hatch when a security fix is needed sooner: a reviewable config change rather than a standing hole. The pnpm bump also carries the fix for the fail-open integrity check in CVE-2026-50021. The new workspace file is settings-only; this repo is a single package, not a pnpm workspace.
setup-flyctl tracked @master in the deploy job — an arbitrary future commit executing with the Fly deploy token in scope. It now takes the same SHA platform already pins, which master, 1.6 and v1 all point at, so nothing moves except the mutability. pnpm/action-setup follows the same principle: a tag can be retagged at a malicious commit without any version string in the workflow changing. Each SHA is what its tag resolves to today, and the trailing version comment keeps the diff readable.
Reports known advisories in the production graph without gating the build — the graph carries a sizeable transitive backlog, so a blocking gate would be red on its first run and ignored soon after. The number being visible and trending is the point. Dependabot's github-actions entry keeps the pinned action SHAs current; without it they silently rot.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two mutable inputs reach this repo without anyone reviewing them: a package version published minutes ago, and whatever commit a third-party action's branch or tag points at when a job starts.
Why
setup-flyctltracked@masterin the deploy job, so an arbitrary future commit would have run inside the job holding the production Fly deploy token, and a tag is no safer since it can be moved to a malicious commit without any version string in the workflow changing. On the registry side, a compromised release is usually caught and yanked within a day or two, and nothing here kept an install off it on day zero.What changed
pnpm-workspace.yaml(new): settings only, this repo is a single package.minimumReleaseAge: 2880makes anything published in the last 48h unresolvable.minimumReleaseAgeExcludeis the escape hatch when a security fix is needed sooner, a reviewable config change rather than a standing hole.package.json: pnpm 10.11.0 to 10.34.5.minimumReleaseAgeneeds 10.16+, and 10.34.1 is where the integrity-check bypass in CVE-2026-50021 was fixed.setup-flyctlandpnpm/action-setuppinned to commit SHAs, with the version kept in a trailing comment. Each SHA is exactly what the ref it replaces resolves to today (master,v1and1.6on flyctl are all one commit), so nothing about these runs changes except the mutability. GitHub-owned actions stay on tags..github/dependabot.yml(new): SHAs never move on their own, so this is what keeps the pins from rotting.github-actionsonly, grouped into one PR a month. npm version-update and security-update PRs stay off: frozen-lockfile installs plus the cooldown already handle drift, and advisories get triaged against real exposure rather than auto-patched.verify.yml:pnpm audit --prodwithcontinue-on-error, informational by design. What it reports is dominated by deep transitive packages we do not control, so a blocking gate would be red on day one and routed around by day two. Visible and trending is the point.Verify