Enable dependabot and dependency-submission workflow#323
Conversation
- Add .github/dependabot.yml for npm ecosystem (src/ directory) - Add .github/workflows/dependency-submission.yml - Plugin: actions/dependency-review-action@v4 - Captures full transitive dependency set via npm ci - Triggers: push and pull_request on master Generated by Dependabot Sub-Agent
- Checkout submodules recursively so src/libs is populated before npm ci runs its preinstall script - Add npm sbom generation step; spdx-dependency-submission-action requires a pre-generated SPDX file, it does not scan on its own - Replace dependency-review-action (PR security gate, wrong tool) with spdx-dependency-submission-action for actual graph submission - Drop invalid token input not accepted by the submission action Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
spdx-json is not a valid value; npm sbom only accepts cyclonedx or spdx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughTwo new configuration files are introduced to GitHub Actions: a Dependabot configuration enabling automated weekly npm package updates in the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/dependency-submission.yml:
- Around line 9-10: The workflow currently grants a global write-scoped token
via the permissions block ("contents: write") which exposes that token to steps
that run "npm ci" (and therefore any package "preinstall" scripts); change the
workflow to split SBOM generation and SBOM submission into separate jobs so the
job that runs "npm ci" and generates the SBOM uses least privilege (e.g.,
"contents: read" or minimal scopes) and runs "npm ci --ignore-scripts" to avoid
lifecycle script execution, and grant "contents: write" only to the separate
SBOM-submission job; locate and update the permissions block and the job(s) that
run "npm ci" and the SBOM submission step to apply these permission boundaries
and the --ignore-scripts flag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4834879c-e46e-4db1-815f-5bee2a0364df
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/dependency-submission.yml
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Workflow permission + npm install context =="
rg -n -C2 'permissions:|contents:\s*write|npm ci|npm install' .github/workflows/dependency-submission.yml
echo
echo "== Lifecycle scripts that can run during npm ci =="
rg -n -C2 '"preinstall"|"install"|"postinstall"' src/package.jsonRepository: Sunbird-Knowlg/knowledge-mw-service
Length of output: 1065
🏁 Script executed:
cat -n .github/workflows/dependency-submission.ymlRepository: Sunbird-Knowlg/knowledge-mw-service
Length of output: 1112
Reduce token exposure during dependency install (security hardening).
The workflow grants contents: write globally at line 10, which makes the write-scoped token available to all steps, including the npm ci command at line 27. Since src/package.json contains a preinstall script that runs multiple npm install commands, untrusted package code executes with write access. Split SBOM generation and submission into separate jobs with appropriate permission boundaries, and use npm ci --ignore-scripts since SBOM generation does not require lifecycle scripts.
🔒 Suggested workflow hardening
name: Dependency Submission (npm)
on:
push:
branches: ["master"]
pull_request:
branches: ["master"]
permissions:
- contents: write
+ contents: read
jobs:
- dependency-submission:
+ generate-sbom:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
- name: Install dependencies
working-directory: src
- run: npm ci
+ run: npm ci --ignore-scripts
- name: Generate SPDX SBOM
working-directory: src
run: npm sbom --sbom-format spdx > sbom.spdx.json
+
+ - name: Upload SBOM artifact
+ uses: actions/upload-artifact@v4
+ with:
+ name: npm-sbom
+ path: src/sbom.spdx.json
+ submit-dependency-snapshot:
+ needs: generate-sbom
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Download SBOM artifact
+ uses: actions/download-artifact@v4
+ with:
+ name: npm-sbom
+ path: src
+
- name: Submit npm Dependencies
uses: advanced-security/spdx-dependency-submission-action@v0.2.0
with:
filePath: src/sbom.spdx.json🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/dependency-submission.yml around lines 9 - 10, The
workflow currently grants a global write-scoped token via the permissions block
("contents: write") which exposes that token to steps that run "npm ci" (and
therefore any package "preinstall" scripts); change the workflow to split SBOM
generation and SBOM submission into separate jobs so the job that runs "npm ci"
and generates the SBOM uses least privilege (e.g., "contents: read" or minimal
scopes) and runs "npm ci --ignore-scripts" to avoid lifecycle script execution,
and grant "contents: write" only to the separate SBOM-submission job; locate and
update the permissions block and the job(s) that run "npm ci" and the SBOM
submission step to apply these permission boundaries and the --ignore-scripts
flag.
1 participant
Summary by CodeRabbit