5cfbb7b6cf
Point the existing audit + install + content-sanity workflows at the two lockfiles PR #5604 introduced (studio/package-lock.json and studio/backend/core/data_recipe/oxc-validator/package-lock.json) so the Studio Tauri CLI holder and the oxc-validator runtime benefit from the same per-PR coverage the frontend already has. release-desktop.yml: - Tauri CLI install: `npm install --save-dev --prefix studio` -> `npm ci --prefix studio --no-fund --no-audit`. - Frontend install: `npm install --no-fund --no-audit` -> `npm ci --no-fund --no-audit`. - New "Lockfile supply-chain audit" step inserted BEFORE the Tauri CLI install so the structural audit fires before any tarball-side lifecycle script. studio-tauri-smoke.yml: - Tauri CLI install: `npm install --save-dev --prefix studio` -> `npm ci --prefix studio --no-fund --no-audit`. - Existing audit step relocated to run BEFORE the Tauri CLI install (same ordering rationale). wheel-smoke.yml: - One-line content-sanity assertion ensuring the oxc-validator package-lock.json is shipped in the wheel. security-audit.yml: - `paths` trigger gains the 4 new entries (oxc + Tauri CLI holder package.json + package-lock.json). - `Scanned:` summary string updated to list the two new lockfiles. - OSV-scanner picks up `--lockfile=` for both. - Two new `npm audit` steps: oxc-validator runtime + Studio Tauri CLI holder. - `npm audit signatures` block split into three (frontend / oxc / Tauri CLI), each preceded by `npm ci --ignore-scripts` in its own directory. - `check_new_install_scripts.py` invocation extended to diff both new lockfiles base->head, with `git show ... 2>/dev/null || echo '{}'` fallback for PRs whose base predates #5604. - `upload-artifact` paths extended for the new log files. Deliberately NOT included: removing `continue-on-error` from the existing `scan_npm_packages` job. That is a policy flip from advisory to blocking and is orthogonal to install-path hardening. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| CODEOWNERS | ||
| dependabot.yml | ||
| FUNDING.yml | ||