From c033032e260bbb7b11ea913296c10651451a99f6 Mon Sep 17 00:00:00 2001 From: dc Date: Sat, 31 Oct 2026 09:55:31 +0000 Subject: [PATCH] chore(ci): cover every .npmrc in the hook, and clean up the registry config Follow-ups from the review of #414. The credential guard now checks each staged .npmrc rather than only the client one: the root and sas/ files are tracked policy as well, so a token pasted into either was equally one `git add -A` away. Verified by staging a token in sas/.npmrc - the hook exits 1. $RUNNER_TEMP/npmrc is removed at the end of each job that writes it, with `if: always()` so a failed job cleans up too. The root `install` script is gone: the root .npmrc sets ignore-scripts, so npm never ran it. CONTRIBUTING already spells out the per-project commands, and is now the single source. The release workflows build the published client from the same tree, so they run `check:archiver` like build.yaml does. --- .git-hooks/pre-commit | 15 +++++++-------- .gitea/workflows/build.yaml | 10 ++++++++++ .gitea/workflows/docs.yaml | 5 +++++ .gitea/workflows/lighthouse.yaml | 5 +++++ .gitea/workflows/release-assets.yaml | 5 +++++ .gitea/workflows/release.yaml | 16 ++++++++++++++++ .gitea/workflows/sites.yaml | 5 +++++ package.json | 1 - 8 files changed, 53 insertions(+), 9 deletions(-) diff --git a/.git-hooks/pre-commit b/.git-hooks/pre-commit index f7cabe4..be1716a 100755 --- a/.git-hooks/pre-commit +++ b/.git-hooks/pre-commit @@ -20,16 +20,15 @@ if ! "$gitleaks_bin" protect --staged --redact; then exit 1 fi -# client/.npmrc is a tracked policy file. A registry credential belongs in the -# user config (~/.npmrc or NPM_CONFIG_USERCONFIG), because one `git add -A` -# would otherwise commit it - and the CI pattern that used to write the token -# into this path is exactly the habit that makes it likely. -if git diff --cached --name-only --diff-filter=ACMR | grep -qx 'client/.npmrc'; then - if git show :client/.npmrc | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then - echo "ERROR: client/.npmrc holds a registry credential - keep it in ~/.npmrc instead" +# Every tracked .npmrc is a policy file - root, sas/ and client/ - so a registry +# credential pasted into any of them is one `git add -A` from being committed. +# Each staged one is checked, not just the client. +for npmrc in $(git diff --cached --name-only --diff-filter=ACMR | grep -E '(^|/)\.npmrc$'); do + if git show ":$npmrc" | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then + echo "ERROR: $npmrc holds a registry credential - keep it in ~/.npmrc instead" exit 1 fi -fi +done ## Avoid large commits # https://www.backblaze.com/blog/how-many-bytes-are-in-a-megabyte-really/ diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index 61f42fd..eb288e6 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -121,6 +121,11 @@ jobs: # limits how far sharding helps. The specs it runs come from # .gitea/scripts/cypress-specs.sh. + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" + Build-and-test-development: runs-on: ubuntu-latest needs: Build-and-ng-test @@ -291,3 +296,8 @@ jobs: with: name: cypress-videos.zip path: cypress-videos.zip + + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" diff --git a/.gitea/workflows/docs.yaml b/.gitea/workflows/docs.yaml index f5ee56e..f5a2cea 100644 --- a/.gitea/workflows/docs.yaml +++ b/.gitea/workflows/docs.yaml @@ -80,6 +80,11 @@ jobs: --password "$SURFER_PASSWORD" \ --message "Typedoc from ${REF_NAME} @ ${COMMIT_SHA:0:8}" + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" + sas-docs: runs-on: ubuntu-latest concurrency: diff --git a/.gitea/workflows/lighthouse.yaml b/.gitea/workflows/lighthouse.yaml index d2f0c27..35eba28 100644 --- a/.gitea/workflows/lighthouse.yaml +++ b/.gitea/workflows/lighthouse.yaml @@ -127,3 +127,8 @@ jobs: name: Lighthouse results path: client/lighthouse-reports include-hidden-files: true + + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" diff --git a/.gitea/workflows/release-assets.yaml b/.gitea/workflows/release-assets.yaml index b70d53f..0667221 100644 --- a/.gitea/workflows/release-assets.yaml +++ b/.gitea/workflows/release-assets.yaml @@ -211,3 +211,8 @@ jobs: done echo "Uploading SHA256SUMS ..." curl --fail-with-body -sS -H "$AUTH_HEADER" "$URL" -F "attachment=@SHA256SUMS" + + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml index 4a42a68..05310dc 100644 --- a/.gitea/workflows/release.yaml +++ b/.gitea/workflows/release.yaml @@ -72,8 +72,14 @@ jobs: run: | cd client npm run postinstall + npm run check:archiver npm run build + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" + Build-and-test-development: runs-on: ubuntu-latest needs: Build-production-and-ng-test @@ -226,6 +232,11 @@ jobs: name: cypress-videos.zip path: cypress-videos.zip + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" + release: runs-on: ubuntu-latest needs: [Build-production-and-ng-test, Build-and-test-development] @@ -493,3 +504,8 @@ jobs: -H 'Content-Type: application/json' \ --data "$(jq -n --arg ref "refs/tags/$TAG" '{ref: $ref}')" \ "$BASE/actions/workflows/sites.yaml/dispatches" + + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" diff --git a/.gitea/workflows/sites.yaml b/.gitea/workflows/sites.yaml index 712d507..5b9c956 100644 --- a/.gitea/workflows/sites.yaml +++ b/.gitea/workflows/sites.yaml @@ -201,3 +201,8 @@ jobs: --message "$MESSAGE" \ "${SITE_ARGS[@]}" \ sas/mocks/sasjsbuild/mock + + - name: Remove registry config + # written earlier in this job; nothing deletes it on the way out + if: always() + run: rm -f "$RUNNER_TEMP/npmrc" diff --git a/package.json b/package.json index 116ab7d..b0e146a 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,6 @@ "got": "11.8.6" }, "scripts": { - "install": "cd client && npm i && npm run postinstall && cd ../sas && npm i", "build-frontend": "cd client && npm run build", "lint": "cd client && npm run lint", "lint:fix": "cd client && npm run lint:fix",