From e7def88717023d81b1bce74a62733f8854e5848d Mon Sep 17 00:00:00 2001
From: Gregor MacLennan <gmaclennan@awana.digital>
Date: Thu, 11 Jun 2026 09:05:35 +0100
Subject: [PATCH] harden(prebuild): keep caller token off disk + ignore-scripts
 on untrusted install
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the supply-chain exposure flagged in the #10 security review: the
prebuild jobs check out the caller repo (default persist-credentials:
true) and then run `npm install` on the untrusted third-party target
module, whose lifecycle scripts could read the caller's GITHUB_TOKEN
from $GITHUB_WORKSPACE/.git/config — write-capable in the sibling repos'
release runs, which publish the artifacts shipped in the CoMapeo apps.

- persist-credentials: false on the caller checkout in prebuild.yml and
  prebuild-all.yml (it only exists to resolve patches_dir; needs no
  token). Belt: no token on disk to steal.
- npm install --ignore-scripts for the target module. bare-make drives
  the native build from CMakeLists, so no install-time script is needed
  (the better-sqlite3 workflow already builds this way). Suspenders.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/actions/prebuild/action.yml | 7 ++++++-
 .github/workflows/prebuild-all.yml  | 6 +++++-
 .github/workflows/prebuild.yml      | 7 ++++++-
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/actions/prebuild/action.yml b/.github/actions/prebuild/action.yml
index 75c808d..49b6f1b 100644
--- a/.github/actions/prebuild/action.yml
+++ b/.github/actions/prebuild/action.yml
@@ -144,7 +144,12 @@ runs:
     - name: Install deps for package
       shell: bash
       working-directory: ./package
-      run: npm install
+      # `--ignore-scripts`: the target module is untrusted third-party
+      # code. bare-make drives the native build from CMakeLists afterwards,
+      # so no install-time lifecycle script is needed (same as the
+      # better-sqlite3 workflow). Defence-in-depth alongside the caller
+      # checkout's `persist-credentials: false`.
+      run: npm install --ignore-scripts
 
     - name: Install patched cmake-napi
       shell: bash
diff --git a/.github/workflows/prebuild-all.yml b/.github/workflows/prebuild-all.yml
index ccda34d..f15c2fb 100644
--- a/.github/workflows/prebuild-all.yml
+++ b/.github/workflows/prebuild-all.yml
@@ -140,8 +140,12 @@ jobs:
     name: ${{ inputs.module_name }} (${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.simulator && '-simulator' || '' }})
     steps:
       # Caller's repo — needed so `patches_dir` (a caller-relative path)
-      # resolves against the workspace root.
+      # resolves against the workspace root. `persist-credentials: false`
+      # keeps the caller's GITHUB_TOKEN off disk — see the comment in
+      # prebuild.yml.
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       # Same-ref harness checkout — see the comment in prebuild.yml.
       - name: Checkout prebuild harness
diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index f57bcf3..1fa71be 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -93,8 +93,13 @@ jobs:
       module_version: ${{ steps.prebuild.outputs.module_version }}
     steps:
       # Caller's repo — needed so `patches_dir` (a caller-relative path)
-      # resolves against the workspace root.
+      # resolves against the workspace root. `persist-credentials: false`
+      # keeps the caller's GITHUB_TOKEN out of $GITHUB_WORKSPACE/.git/config
+      # so the untrusted `npm install` of the target module (with lifecycle
+      # scripts) below can't read a (release-write-capable) token off disk.
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       # Check out this repo at the SAME ref this reusable workflow is
       # running from (`job.workflow_sha` resolves the caller's @v2/@main/