From e887056030de1e5fdb4a147f196848e1fa656c1f Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 9 Sep 2026 21:35:11 +0000 Subject: [PATCH 1/2] root - chore: defense - disable setup-node cache on release Set package-manager-cache: false on the artifact-publishing release workflow so a poisoned Actions cache cannot run in a job that holds publish credentials. Reconcile persist-credentials as merged in PR #72. Co-authored-by: Jared Wray --- .github/workflows/release.yaml | 1 + DEFENSE_IN_DEPTH.md | 2 +- SECURITY.md | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 5e4940b..352f847 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -37,6 +37,7 @@ jobs: with: node-version: 24 registry-url: 'https://registry.npmjs.org' + package-manager-cache: false - name: Install Dependencies run: sfw pnpm install --frozen-lockfile diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 89ce648..ef69dce 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -29,7 +29,7 @@ Profile: npm library · public - [x] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` — PR #70 - [x] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR — PR #71 - [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — verified 2026-09-09 -- [ ] `persist-credentials: false` on checkouts that don't push (PR #72 pending) +- [x] `persist-credentials: false` on checkouts that don't push — PR #72 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-09-09 - [ ] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning - [ ] No npm tokens (or other registry credentials) in Actions secrets diff --git a/SECURITY.md b/SECURITY.md index 3f595e2..2d6be0d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,7 +26,7 @@ hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_D - pnpm is pinned via `packageManager` (`pnpm@12.3.0`). - Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked. - The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs. -- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR. +- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR; checkouts that do not push set `persist-credentials: false`. - Workflows do not use `pull_request_target`. - The published package sets `repository.url` to this repo so provenance can map back. - `.github/CODEOWNERS` names `@jaredwray` for `/.github/`, `/.vscode/`, `/.cursor/`, `/.devcontainer/`, and `/scripts/`. From c921abb76eca0965dd7f3c0e734bf138014ae790 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 9 Sep 2026 21:35:33 +0000 Subject: [PATCH 2/2] docs: mark setup-node cache disable as PR #73 pending Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index ef69dce..a580bd4 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -31,7 +31,7 @@ Profile: npm library · public - [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — verified 2026-09-09 - [x] `persist-credentials: false` on checkouts that don't push — PR #72 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-09-09 -- [ ] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning +- [ ] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning (PR #73 pending) - [ ] No npm tokens (or other registry credentials) in Actions secrets ## 5. npm publishing — npm libraries only