fix: pin npm commands by hash in build scripts for supply chain security #7081
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
OttoAllmendinger
previously approved these changes
Sep 25, 2025
lcovar
previously approved these changes
Sep 25, 2025
mukeshsp
reviewed
Sep 26, 2025
Contributor
mukeshsp
left a comment
mukeshsp
left a comment
There was a problem hiding this comment.
Please fix the conflicts and failing tests
louib
reviewed
Sep 27, 2025
Contributor
louib
left a comment
louib
left a comment
There was a problem hiding this comment.
Are you sure those scripts are still used? I think those three modules are published with lerna just like all the other BitGoJS modules
modules/bitgo/scripts/publish.sh
Outdated
| # install | ||
| npm install | ||
| # install - generate package-lock.json first, then use npm ci for reproducible builds | ||
| npm install --package-lock-only |
Contributor
There was a problem hiding this comment.
Doesn't regenerating a package-lock.json file first defeat the purpose of running npm ci? Why would the package-lock.json file be incomplete at the time of publishing?
koralkulacoglu
force-pushed
the
DX-1510-Pin-npm-Commands-by-Hash-in-Build-Scripts
branch
from
12256c3 to
3f2c274
Compare
TICKET: DX-1510
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
TICKET: DX-1510
Replace unpinned
npm installwithnpm ciacross publish scripts to prevent supply chain attacks and ensure reproducible builds.