Skip to content

feat(tcfeed): say that the workflow verifies the hash, not just the pin #135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralyodio merged 1 commit into from
Aug 14, 2026
Merged

feat(tcfeed): say that the workflow verifies the hash, not just the pin #135

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions bin/tcfeed.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1063,12 +1063,20 @@ const prBody = (spec: string, issue: string, ran: string): string =>
'so contributor code never executes with your secrets in scope. The SARIF upload',
'is `continue-on-error` and degrades quietly where code scanning is unavailable.',
'',
`The CLI is pinned to \`${spec}\` and installed with`,
'`--ignore-scripts`, and checkout runs with `persist-credentials: false`. A',
"scanner that installs a floating version, runs its dependencies' lifecycle",
'scripts and leaves a token in `.git/config` is asking you to trust more than it',
'is worth, and none of that is needed to read a diff. Bump the pin whenever you',
'like — nothing here updates itself.',
`The CLI is pinned to \`${spec}\`, and the workflow does not install it on the`,
"registry's word. It downloads that tarball, hashes it, checks the SHA-512",
'against a value committed in the workflow file, and refuses to install on a',
'mismatch. A pinned version says which release to fetch; it does not say the',
'bytes are the ones that release was published with, and the party answering the',
'first question is the party serving the bytes. You can check the pinned hash',
`against the registry yourself with \`npm view ${spec} dist.integrity\`.`,
'',
'It installs with `--ignore-scripts`, and checkout runs with',
"`persist-credentials: false`. A scanner that installs a floating version, runs",
"its dependencies' lifecycle scripts and leaves a token in `.git/config` is",
'asking you to trust more than it is worth, and none of that is needed to read a',
'diff. Bump the pin and its hash together whenever you like — nothing here',
'updates itself.',
'',
'Disclosure: I maintain [ThreatCrush](https://github.com/profullstack/threatcrush).',
'It is free and MIT, and the workflow installs it from npm — nothing here phones',
Expand Down
Loading