actions/setup-uv
2
0
Fork 0
mirror of https://github.com/astral-sh/setup-uv.git synced 2026-11-05 01:35:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Verify npm dependency signatures before builds (#1027)

Browse Source 
CI installs the locked npm dependency tree without running lifecycle
scripts, but it does not verify registry signatures or available
provenance attestations. Run `npm audit signatures` after installation
in both the test and checksum-update workflows, before `npm run all`
executes dependency tooling. The check follows npm's registry-signature
support and verifies attestations when present; it does not require
every dependency to publish provenance.

Related: astral-sh/ruff-action#402 adds the same signature and
provenance verification. astral-sh/setup-uv#1026 separately hardens
`npm` install defaults.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
This commit is contained in:
zaniebot
2026-10-14 10:52:00 +02:00
committed by GitHub
co-authored by zaniebot
parent f64d32b1cd
commit f8c88970fc
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/test.yml
+2
View File
@@ -34,6 +34,8 @@ jobs:
cache: npm cache: npm
- run: | - run: |
npm ci --ignore-scripts npm ci --ignore-scripts
- name: Verify npm package signatures
run: npm audit signatures
- run: | - run: |
npm run all npm run all
- name: Check all jobs are in all-tests-passed.needs - name: Check all jobs are in all-tests-passed.needs
.github/workflows/update-known-checksums.yml
+4 -1
View File
@@ -38,7 +38,10 @@ jobs:
fi fi
- name: Compile changes - name: Compile changes
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }} if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
run: npm ci --ignore-scripts && npm run all run: |
npm ci --ignore-scripts
npm audit signatures
npm run all
- name: Create Pull Request - name: Create Pull Request
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }} if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1