Commit `99adbe3c14`

99adbe3c140718fc1dde69ae1b1143bf1ef388cc

parent: 63ba83a190

Unsigned

cmc <hello@cleberg.net> · 2026-08-21 04:41 UTC

Harden the workflows against supply-chain execution

SonarCloud flagged the new files it was meant to gate, which is the check
working. Four findings, all fixed rather than dismissed:

- npm ci now passes --ignore-scripts in both workflows (S6505). No
  dependency here needs a lifecycle hook; verified from a clean clone.
- The drift job calls ./node_modules/.bin/wrangler instead of npx (S6505,
  S8543). npx resolves and executes on demand at an unpinned version;
  the local binary is the one package-lock pins.

Layout: unified · split

.github/workflows/ci.yml +3 −1

		@@ -19,7 +19,9 @@ jobs:
19	19	node-version: '26'
20	20	cache: npm
21	21
22		- run: npm ci
	22	# --ignore-scripts: no dependency here needs a lifecycle hook, and CI
	23	# should not run arbitrary postinstall code from the tree.
	24	- run: npm ci --ignore-scripts
23	25
24	26	# worker-configuration.d.ts is generated, not committed, and tsconfig
25	27	# lists it under "types" — so tsc cannot run on a fresh checkout without

.github/workflows/migration-drift.yml +4 −2

		@@ -25,7 +25,9 @@ jobs:
25	25	node-version: '26'
26	26	cache: npm
27	27
28		- run: npm ci
	28	# --ignore-scripts: no dependency here needs a lifecycle hook, and CI
	29	# should not run arbitrary postinstall code from the tree.
	30	- run: npm ci --ignore-scripts
29	31
30	32	- name: Every migration in migrations/ is applied to production
31	33	env:
		@@ -35,7 +37,7 @@ jobs:
35	37	echo "::error::CLOUDFLARE_API_TOKEN is not set — this check cannot see production."
36	38	exit 1
37	39	fi
38		out=$(npx wrangler d1 migrations list DB --remote 2>&1) \|\| true
	40	out=$(./node_modules/.bin/wrangler d1 migrations list DB --remote 2>&1) \|\| true
39	41	echo "$out"
40	42	if echo "$out" \| grep -q "No migrations to apply"; then
41	43	echo "Production schema matches migrations/."

Commit 99adbe3c14

Commit `99adbe3c14`