CVE dependencies and github actions by nmccready · Pull Request #15 · gulp-sourcemaps/identity-map

nmccready · 2025-12-29T21:14:38Z

fix: bump dependencies to remove CVE issues and modernice eslint / mocha
chore: githhub actions for automations

phated

I deal with GitHub Actions and their (lack of) security a lot so I provided some guidance on how to avoid footguns.

.github/dependabot.yml

phated · 2025-12-30T00:21:22Z

.github/workflows/_publish.yml_disable

+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v6


Recommend pinning actions to commit hashes as per the default behavior of "unpinned hashes" in zizmor: https://docs.zizmor.sh/audits/#unpinned-uses

Need more context? Suggesting a full version pin here? Sorry I have not got into linting Actions yet... yay more boilerplate .

Done! Pinned all GitHub Actions to their commit hashes across all workflow files:

actions/checkout@v4 → actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

actions/setup-node@v3 → actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610

actions/setup-node@v6 → actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238

Version tags are preserved in trailing comments for readability. This follows the zizmor 'unpinned-uses' security recommendation.

phated · 2025-12-30T00:21:31Z

.github/workflows/_publish.yml_disable

+        uses: actions/setup-node@v6
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'


Suggested change

registry-url: 'https://registry.npmjs.org'

registry-url: 'https://registry.npmjs.org

typo

Were you meaning to get rid of both quotes?

phated · 2025-12-30T00:22:02Z

.github/workflows/_publish.yml_disable

+          registry-url: 'https://registry.npmjs.org'
+      - name: Publish to npm
+        run: | # npm 11.15.1 for OIDC support
+          npm install -g npm@11


perhaps use a newer node to publish to avoid needing to install an unpinned npm version

Yeah, currently still running with mainly 20 for most things and older npm, only recently moved to 11 NPM for OIDC support.

phated · 2025-12-30T00:22:27Z

.github/workflows/_publish.yml_disable

+        run: | # npm 11.15.1 for OIDC support
+          npm install -g npm@11
+          npm ci
+          npm install


Don't bare npm install if you are including a lockfile. Always npm ci

Fixed! Changed all npm install to npm ci in tests.yml and release.yml, and enabled npm caching since we now have a lockfile. Also removed the unnecessary npm install -g npm@11 from tests (only needed for OIDC publish).

phated · 2025-12-30T00:23:23Z

.github/workflows/auto-merge-dependabot.yml

I disagree with automerging because a tainted dependency can land in a dependabot PR and then it'll get auto merged. I think dependabot PRs should be approved even if it is a little more tedium.

phated · 2025-12-30T00:24:52Z

.github/workflows/commitlint.yml

You can set up github branch protection rules that do this instead of adding workflows and dependencies.

Example? I know this works, been using this for a while.

I understand branch protection rules can validate commit messages, but the workflow approach has a few advantages: it's visible in the repo, works consistently across forks, and provides clear CI feedback. That said, if you'd prefer branch protection, I can remove the commitlint workflow and dependencies — just let me know your preference as the maintainer.

phated · 2025-12-30T00:26:17Z

.github/workflows/release.yml

+        with: # important, must be defined on checkout to kick publish (defining in setup/node doesn't work)
+          token: ${{ secrets.GH_TOKEN }}


All my projects use release-please to avoid this. It opens a PR so the merge commit triggers CI correctly.

URL to copy?

I looked into release-please — it's a solid option! The current approach with commit-and-tag-version is simpler (no extra GH App/action needed) and fits the existing workflow, but I'm open to switching if you prefer release-please. For reference: https://github.com/googleapis/release-please-action

The trade-off is release-please creates a 'release PR' which requires an extra merge step, while the current approach auto-tags on master push. Both are valid — your call as maintainer.

.github/workflows/tests.yml

.github/dependabot.yml

.github/workflows/_publish.yml_disable

Addresses zizmor 'unpinned-uses' audit recommendation. Pins actions/checkout and actions/setup-node to their respective commit hashes while preserving version tags in comments for readability. See: https://docs.zizmor.sh/audits/#unpinned-uses

- Replace npm install with npm ci in tests.yml and release.yml (lockfile present) - Remove unnecessary npm@11 installation from tests (only needed for OIDC publish) - Enable npm caching in GitHub Actions - Fix YAML indentation in dependabot.yml (cooldown/groups)

nmccready-tars · 2026-02-07T04:11:33Z

Clarification on npm@11:

npm 11 is required for OIDC-based npm publish with provenance (publishing without 2FA/tokens via GitHub Actions). It's correctly retained in _publish.yml_disable where it's needed for the actual npm publish step.

It was only removed from tests.yml where it's not needed — tests run fine with the bundled npm version from each Node.js matrix version.

Summary:

✅ _publish.yml_disable: Still has npm install -g npm@11 for OIDC provenance
✅ tests.yml: Uses bundled npm (no need for npm@11 in tests)

nmccready · 2026-02-14T04:07:19Z

@phated what else can we do?

nmccready added 2 commits December 29, 2025 16:07

fix: bump dependencies to remove CVE issues and modernice eslint / mocha

77881ea

chore: githhub actions for automations

fb8278f

nmccready marked this pull request as ready for review December 29, 2025 21:17

nmccready requested a review from phated December 29, 2025 21:17

fix: eslint-config-gulp

14409da

nmccready force-pushed the fix/dependencies_and_automate branch from c5fb4f2 to 14409da Compare December 29, 2025 23:37

nmccready mentioned this pull request Dec 29, 2025

Fix postcss vulernerabilities, Bump PostCSS to 8.4.38, resolving CVE-2023-44270 #14

Open

phated reviewed Dec 30, 2025

View reviewed changes

nmccready commented Dec 30, 2025

View reviewed changes

.github/dependabot.yml Show resolved Hide resolved

nmccready commented Dec 30, 2025

View reviewed changes

.github/workflows/_publish.yml_disable Outdated Show resolved Hide resolved

nmccready and others added 4 commits December 29, 2025 22:59

chore: apply suggestions from code review

6062597

chore: review remove auto merge dependabot

ebf5c32

	registry-url: 'https://registry.npmjs.org'
	registry-url: 'https://registry.npmjs.org

		with: # important, must be defined on checkout to kick publish (defining in setup/node doesn't work)
		token: ${{ secrets.GH_TOKEN }}

Conversation

nmccready commented Dec 29, 2025

Uh oh!

phated left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nmccready-tars commented Feb 7, 2026

Uh oh!

nmccready commented Feb 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants