Record why the npm-audit checkout is not hardened, and what CodeQL actually scans - #247
Open
nursoda wants to merge 2 commits into
Open
Record why the npm-audit checkout is not hardened, and what CodeQL actually scans#247nursoda wants to merge 2 commits into
nursoda wants to merge 2 commits into
Conversation
CodeQL alert 4 flags the `npm i -g` step in `npm-audit.yml` as poisonable because the job checks out a ref other than the default branch. The alert is dismissed, and REVIEW.md already said why. What it did not say is why the obvious hardening was not applied, so the question comes back at every scan. A `sparse-checkout` does not help here. `package.json` has to remain in the checkout for the version step, and its `engines.npm` is the value that reaches `npm i -g`; the only path a sparse checkout could remove is a root-level `.npmrc`, and even that needs cone mode turned off, because cone mode always materialises the repository root. The conditions that would make the hardening worth doing are recorded with it: a secret in the job, a cache, or a fork trigger. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Olav Seyfarth <olav@seyfarth.de>
nursoda
added
documentation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The developer notes described the default setup as frontend SAST for JavaScript. It also runs the GitHub Actions queries, which is where the cache poisoning alert on `npm-audit.yml` came from. Someone reading the old line would not expect a workflow finding at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Olav Seyfarth <olav@seyfarth.de>
nursoda
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL's
actions/cache-poisoning/poisonable-stepflags thenpm i -gstep innpm-audit.yml, because the job runs in the context of the default branch whilechecking out a ref from the matrix.
REVIEW.mdalready recorded why the alert isdismissed. It did not record why the obvious hardening — a
sparse-checkoutnarrowedto the two files the job reads — was not applied, so the suggestion comes back at
every scan.
It comes back for a reason that turns out to be stronger than expected: a sparse
checkout does not close the path at all.
package.jsonhas to stay, because theversion step reads it, and its
engines.npmis the value that reachesnpm i -g.The only thing a sparse checkout could remove is a root-level
.npmrc, and even thatneeds
sparse-checkout-cone-mode: false, since cone mode always materialises therepository root.
The same alert exposed a second inaccuracy:
doc/developers.mdcalled the defaultsetup frontend SAST for JavaScript, when it also runs the GitHub Actions queries — the
very ones that produced this finding. The second commit corrects that line.
Documentation only; no workflow or runtime file changes. The conditions that would
make the hardening worth revisiting are recorded next to the decision: a secret in
the job, an Actions cache, or a fork trigger.
🤖 Generated with Claude Code, verified, tweaked and approved by @nursoda.