security: harden CI supply chain and patch transitive CVEs - #43
Merged
Merged
Conversation
Node 20 is removed from GitHub Actions runners on 2026-09-16. checkout v4, setup-node v4 and pnpm/action-setup v4 all run on it. -> v6 across the board. Deleted .github/workflows/notify-profile.yml, for the opposite reason to the identical change in EzWeb. This copy is green - but only because it was made unable to fail. It reads secrets.PROFILE_DISPATCH_TOKEN, finds nothing (this repository has no secrets at all), prints "::notice::PROFILE_DISPATCH_TOKEN not set - skipping LOC ping" and exits 0. It has reported success on every run since 2026-05-16 while doing nothing whatsoever. That is worse than the EzWeb version, which at least failed honestly. A job that cannot do its work and reports success is a green check that means nothing. The work does not need doing anyway: JadenRazo/JadenRazo's loc-counter.yml runs daily on its own schedule with its own working PAT, and its last six runs all succeeded. The dispatch was only ever a latency optimisation on a cosmetic counter.
JadenRazo
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins checkout, setup-node, pnpm setup, Postgres, and Redis to immutable commits or digests. Adds explicit read-only permissions, concurrency cancellation, timeouts, and a gated workflow policy with negative tests. Removes the inert profile-dispatch workflow. Patches the newly disclosed high-severity deepmerge-ts and nanoid advisories with narrowly scoped pnpm overrides.\n\nVerified locally: frozen install; Prisma generate; API build; dashboard production build; API and dashboard lint (warnings only); 27 API tests; live pnpm audit with no known vulnerabilities; workflow YAML and policy negative tests.