Patch production dependency advisories (#856)

jb/paseo

* Patch production dependency advisories

* ci: harden dependency installs with npm ci --ignore-scripts

- Replace npm install with npm ci --ignore-scripts across all workflows
  to enforce lockfile parity and block dependency postinstall scripts.
- Run npm run postinstall explicitly after install so our root patch
  script still applies (the only legitimate postinstall use in this
  repo); dep lifecycle scripts stay blocked.
- Add lockfile-lint and npm audit signatures to the lint job to catch
  registry-host tampering and verify cryptographic signatures.
- Regenerate package-lock.json to match bumped package.json versions.

* ci: drop --ignore-scripts; rely on npm ci + lockfile-lint + audit signatures

Lavamoat allow-scripts only traverses root deps; it can't see workspace
deps like electron, esbuild, sharp. Without proper monorepo support, an
allowlist would be incomplete and electron's binary download breaks.

Keep the rest of the security stack:
- npm ci (strict lockfile parity)
- lockfile-lint (resolved-host check)
- npm audit signatures (cryptographic verification)

Real script-blocking would need pnpm 10+ migration. Tracking separately.

* ci(nix-build): use PR head SHA so fork checkouts work

The previous `ref: ${{ github.head_ref || github.ref }}` made
actions/checkout fetch a branch name that only exists on the fork,
not origin. Use the PR head SHA instead — origin mirrors PR commits
via refs/pull/N/head, so this works for fork PRs without changing
the push-to-main auto-commit behavior.

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

This commit is contained in:

João Sousa Andrade

2026-05-10 11:45:24 +08:00

committed by

GitHub

co-authored by

Mohamed Boudra

parent 407c4ca554

commit 9dd5c6e5f3

10 changed files with 592 additions and 331 deletions

									
										.github/workflows/server-ci.yml
									
		+1
		-1
	
												View File
												
				@@ -34,7 +34,7 @@ jobs:

				        run: git fetch --no-tags origin main:refs/remotes/origin/main

				      - name: Install server dependencies

				        run: npm install --workspace=@getpaseo/server --include-workspace-root

				        run: npm ci --workspace=@getpaseo/server --include-workspace-root

				      - name: Install Claude Code CLI for provider tests

				        run: npm install -g @anthropic-ai/claude-code