ci: harden workflows against cache-poisoning publish chain#1265
Merged
Conversation
Closes the actions/cache -> OIDC chain demonstrated by the TanStack
npm supply-chain compromise (May 2026):
- publish.yml: gate publish + publish-experimental behind the release
environment, and drop the unused ~/.npm cache step (workflow installs
with yarn, so the cache was both dead weight and a poisoning surface
in the job that holds id-token: write).
- release.yml: re-key the build cache with a release- prefix so CI's
${runner.os}-modules- scope can no longer be restored into the
release runner (which holds the GitHub App signing token).
- main.yml: declare top-level permissions: contents: read as a
least-privilege default for the GITHUB_TOKEN; the gen job's existing
per-job override still grants pull-requests: write where needed.
- codeql-analysis.yml: remove the dead commented-out push/pull_request
triggers. Intent is nightly-only; Sonar covers per-PR analysis.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move publish.yml off the shared release environment and onto its own publish environment. release.yml uses release (signs master commit/tag, holds the App private key); publish.yml uses publish (mints OIDC token, ships to npm). Names now match what each environment is actually protecting, and npm Trusted Publishing can pin to the publish env cleanly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the actions/cache -> OIDC chain demonstrated by the TanStack npm supply-chain compromise (May 2026):
Description
Type of change
Affected packages
dockview-coredockview(vanilla JS)dockview-reactdockview-vuedockview-angulardocsHow to test
Checklist
yarn lint:fixpassesyarn formatpassesnpm run genhas been run and generated files are up to dateyarn testpasses