Repository navigation
root - chore: defense - block dependency build scripts - #164
Conversation
strictDepBuilds fails the install when a build is not approved. dangerouslyAllowAllBuilds stays false. esbuild is false because the platform package supplies the binary. Co-authored-by: Jared Wray <me@jaredwray.com>
The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures strict dependency builds in pnpm-workspace.yaml by enabling strictDepBuilds and disabling dangerouslyAllowAllBuilds, while also restricting allowed builds. It updates the security checklist in DEFENSE_IN_DEPTH.md accordingly. The reviewer suggests marking the lifecycle scripts checklist item as completed in DEFENSE_IN_DEPTH.md since this PR implements that change, avoiding the need for a follow-up PR.
| - [ ] `trustPolicy: no-downgrade`; no first-party `trustPolicyExclude` (PR #163 pending) | ||
| - [ ] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline | ||
| - [x] `trustPolicy: no-downgrade`; no first-party `trustPolicyExclude` — PR #163 | ||
| - [ ] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline (PR #164 pending) |
There was a problem hiding this comment.
Since this pull request implements the blocking of lifecycle scripts, you can mark this checklist item as completed ([x]) and remove the (PR pending) suffix to avoid needing a follow-up pull request just to update this document.
There was a problem hiding this comment.
The item stays open until the change is on main. DEFENSE_IN_DEPTH.md line 22 records (PR #164 pending) for that reason. The next defense pull request marks the item done after merge. This pull request does not need a follow-up only for the checkbox.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #164 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 9 9
Lines 639 639
Branches 151 146 -5
=========================================
Hits 639 639 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
This pull request blocks unapproved dependency build scripts in section 3.
Status
DEFENSE_IN_DEPTH.md: lifecycle scripts → (PR #164 pending). Trust policy → PR #163.Verification
pnpm install --frozen-lockfilepasses withstrictDepBuilds: trueanddangerouslyAllowAllBuilds: false.allowBuilds: {}fails onesbuild@0.27.7.esbuild: falsepasses install. The platform package supplies the binary.pnpm buildpasses.@swc/coreorunrs-resolver. Those packages are not in the lockfile.b31f00c.Notes
esbuildis the only dependency with an install script. The entry isfalse, so the script does not run.Reference
defense-in-depth-nodejs § 3