From ce0f6873169bf25e5526a7cadfe517808f308132 Mon Sep 17 00:00:00 2001 From: Tyler Carson Date: Wed, 17 Jun 2026 10:40:32 -0700 Subject: [PATCH] Supply-chain security: use npm ci in CI workflows and add min-release-age to keeperapi Switch all CI workflows from npm install/npm i to npm ci for reproducible, lock-file-enforced installs. Add min-release-age=3 to keeperapi/.npmrc to prevent installing packages published less than 3 days ago. --- .github/workflows/main.yml | 2 +- .github/workflows/publish.keeper-sdk.yml | 2 +- .github/workflows/publish.npm.yml | 2 +- keeperapi/.npmrc | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 81326afc..7f914038 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -17,7 +17,7 @@ jobs: node-version: '24' - name: Lib - Install - run: npm i + run: npm ci working-directory: ./keeperapi env: NPM_TOKEN: "" diff --git a/.github/workflows/publish.keeper-sdk.yml b/.github/workflows/publish.keeper-sdk.yml index 37b06b83..bb4ccba6 100644 --- a/.github/workflows/publish.keeper-sdk.yml +++ b/.github/workflows/publish.keeper-sdk.yml @@ -26,7 +26,7 @@ jobs: registry-url: 'https://registry.npmjs.org' - name: Install dependencies - run: npm install + run: npm ci - name: Publish package run: npm publish diff --git a/.github/workflows/publish.npm.yml b/.github/workflows/publish.npm.yml index 9fc66b2b..77ae7a09 100644 --- a/.github/workflows/publish.npm.yml +++ b/.github/workflows/publish.npm.yml @@ -26,7 +26,7 @@ jobs: registry-url: 'https://registry.npmjs.org' - name: Install dependencies - run: npm install + run: npm ci - name: Publish package run: npm publish diff --git a/keeperapi/.npmrc b/keeperapi/.npmrc index ae643592..5e7ecfcf 100644 --- a/keeperapi/.npmrc +++ b/keeperapi/.npmrc @@ -1 +1,2 @@ //registry.npmjs.org/:_authToken=${NPM_TOKEN} +min-release-age=3