harden(prebuild): keep caller token off disk + ignore-scripts on untrusted install#12
Merged
Merged
Conversation
…usted install Closes the supply-chain exposure flagged in the #10 security review: the prebuild jobs check out the caller repo (default persist-credentials: true) and then run `npm install` on the untrusted third-party target module, whose lifecycle scripts could read the caller's GITHUB_TOKEN from $GITHUB_WORKSPACE/.git/config — write-capable in the sibling repos' release runs, which publish the artifacts shipped in the CoMapeo apps. - persist-credentials: false on the caller checkout in prebuild.yml and prebuild-all.yml (it only exists to resolve patches_dir; needs no token). Belt: no token on disk to steal. - npm install --ignore-scripts for the target module. bare-make drives the native build from CMakeLists, so no install-time script is needed (the better-sqlite3 workflow already builds this way). Suspenders. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the security review on #10. Closes the one real supply-chain exposure that review surfaced (pre-existing, not introduced by #10).
The exposure
The prebuild jobs (
prebuild.yml,prebuild-all.yml) check out the caller repo withactions/checkout's defaultpersist-credentials: true, which writes the caller'sGITHUB_TOKENinto$GITHUB_WORKSPACE/.git/config. The composite action then runsnpm installon the untrusted third-party target module (sodium-native,better-sqlite3, …) with lifecycle scripts enabled — so a malicious or compromised version of that module, or any transitive dep, gets arbitrary code execution in a job where that token is readable off disk.In the sibling repos' release runs that token is write-capable, and those jobs publish the release artifacts that get downloaded and shipped inside the CoMapeo apps. This is the tj-actions/ultralytics pattern: untrusted build-time code reaching a privileged token.
The fix (belt and suspenders)
persist-credentials: falseon the caller checkout in both prebuild workflows. That checkout exists only sopatches_dirresolves against the workspace — it needs no token. No token on disk ⇒ nothing for an install script to steal.npm install --ignore-scriptsfor the target module.bare-makedrives the native build fromCMakeListsafterwards, so no install-time lifecycle script is required — thebetter-sqlite3-nodejs-mobileworkflow already builds this exact way, so this is proven, not speculative.Validation
ci.ymlruns the real prebuild → emulator-test pipeline on this PR (quickbit-native), so a green check confirms--ignore-scriptsstill produces a working, loadable.node.Out of scope
The test workflows'
assemble-test-projectalsonpm installs the module (to fetch its test runner), but those jobs carry no release-write token — lower priority, can follow separately.🤖 Generated with Claude Code