audit-labs/gh-attest

GitHub Audit Evidence Extractor

clone: git clone https://gitbay.org/audit-labs/gh-attest.git

ec3e573dffc983790ed6db8daac57decfe190ac3

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-21T04:41:16Z

Harden the workflows against supply-chain execution

SonarCloud flagged the new files it was meant to gate, which is the check
working. Four findings, all fixed rather than dismissed:

- npm ci now passes --ignore-scripts in both workflows (S6505). No
  dependency here needs a lifecycle hook; verified from a clean clone.
- The drift job calls ./node_modules/.bin/wrangler instead of npx (S6505,
  S8543). npx resolves and executes on demand at an unpinned version;
  the local binary is the one package-lock pins.

 .github/workflows/ci.yml              | 4 +++-
 .github/workflows/migration-drift.yml | 6 ++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd80160..fe35618 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,9 @@ jobs:
           node-version: '26'
           cache: npm
 
-      - run: npm ci
+      # --ignore-scripts: no dependency here needs a lifecycle hook, and CI
+      # should not run arbitrary postinstall code from the tree.
+      - run: npm ci --ignore-scripts
 
       # worker-configuration.d.ts is generated, not committed, and tsconfig
       # lists it under "types" — so tsc cannot run on a fresh checkout without
diff --git a/.github/workflows/migration-drift.yml b/.github/workflows/migration-drift.yml
index 3372b5b..2e64cf3 100644
--- a/.github/workflows/migration-drift.yml
+++ b/.github/workflows/migration-drift.yml
@@ -25,7 +25,9 @@ jobs:
           node-version: '26'
           cache: npm
 
-      - run: npm ci
+      # --ignore-scripts: no dependency here needs a lifecycle hook, and CI
+      # should not run arbitrary postinstall code from the tree.
+      - run: npm ci --ignore-scripts
 
       - name: Every migration in migrations/ is applied to production
         env:
@@ -35,7 +37,7 @@ jobs:
             echo "::error::CLOUDFLARE_API_TOKEN is not set — this check cannot see production."
             exit 1
           fi
-          out=$(npx wrangler d1 migrations list DB --remote 2>&1) || true
+          out=$(./node_modules/.bin/wrangler d1 migrations list DB --remote 2>&1) || true
           echo "$out"
           if echo "$out" | grep -q "No migrations to apply"; then
             echo "Production schema matches migrations/."