chore: harden supply chain config (#34)

decofe · web-flow · commit a020237034d2 · 2026-06-25T08:04:53.000-07:00
## Summary - Fix the esbuild advisory by upgrading the direct dev dependency and forcing transitive esbuild resolution to 0.28.1. - Move pnpm build allowlisting into pnpm-workspace.yaml and add minimum release age hardening. - Add grouped Dependabot updates for npm and GitHub Actions with cooldowns to avoid high PR volume. - Harden workflows by removing the release PAT fallback, replacing pull_request_target, disabling setup-node package-manager cache for release artifacts, refreshing pinned Actions, and removing zizmor findings. ## Validation - `pnpm audit --json` reports 0 advisories. - `osv-scanner scan source -r .` reports no issues. - `zizmor .github/workflows/` reports no findings. - `pinact run --diff --check --update --min-age 7` exits cleanly. - `pnpm check` fails in this sandbox because `sqlite3` is not installed (`spawn sqlite3 ENOENT`); 100 tests passed before the sqlite3-dependent failures. Prompted by: @grandizzy
diff --git a/.changelog/supply-chain-hardening.md b/.changelog/supply-chain-hardening.md
@@ -0,0 +1,5 @@
+---
+wallet-cli: patch
+---
+
+Harden supply chain configuration, dependency updates, and release workflows.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,41 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:00"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    groups:
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - patch
+          - minor
+      development-dependencies:
+        dependency-type: development
+        update-types:
+          - patch
+          - minor
+      major-dependencies:
+        update-types:
+          - major
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "10:30"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 2
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -91,14 +91,15 @@ jobs:
       TEMPO_WALLET_PACKAGE_DIR: artifacts
       TEMPO_WALLET_PACKAGE_OUTPUT: artifacts/${{ matrix.package }}-${{ matrix.build.suffix }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
+          package-manager-cache: false
 
       - name: Setup pnpm
         run: |
@@ -198,7 +199,7 @@ jobs:
       VERSION: ${{ needs.parse-tag.outputs.version }}
       RELEASE_TAG: ${{ needs.parse-tag.outputs.release_tag }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -230,14 +231,14 @@ jobs:
         run: gh release upload "$RELEASE_TAG" artifacts/* --clobber
 
       - name: Checkout release signing tool
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: tempoxyz/wallet
           path: wallet-release-tools
           persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        run: rustup default stable
 
       - name: Build release signer
         run: cargo build --release -p tempo-sign
diff --git a/.github/workflows/changelog-generate.yml b/.github/workflows/changelog-generate.yml
@@ -1,10 +1,7 @@
 name: Changelog Generate
 
-# pull_request_target runs in the context of the base branch, giving access
-# to secrets even for fork PRs. This workflow only writes to same-repo branches
-# and never executes code from forked PRs.
 on:
-  pull_request_target:
+  pull_request:
     types: [labeled]
 
 concurrency: ${{ github.workflow }}-${{ github.event.number }}
@@ -13,7 +10,7 @@ permissions: {}
 
 jobs:
   generate:
-    if: startsWith(github.event.label.name, 'changelog:')
+    if: startsWith(github.event.label.name, 'changelog:') && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     environment: release
     permissions: {}
@@ -57,7 +54,7 @@ jobs:
           permission-pull-requests: write
           permission-metadata: read
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: steps.source.outputs.same_repo == 'true'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
@@ -13,7 +13,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -42,8 +42,10 @@ jobs:
 
       - name: Check changelog entry exists
         if: steps.changes.outputs.requires_changelog == 'true'
+        env:
+          HAS_CHANGELOG: ${{ steps.changes.outputs.has_changelog }}
         run: |
-          if [ "${{ steps.changes.outputs.has_changelog }}" != "true" ]; then
+          if [ "$HAS_CHANGELOG" != "true" ]; then
             echo "::error::A changelog entry is required for this PR. Add a .changelog/*.md file."
             exit 1
           fi
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -31,12 +31,12 @@ jobs:
     name: Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -54,12 +54,12 @@ jobs:
     name: Types
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -80,12 +80,12 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -51,7 +51,6 @@ jobs:
         if: steps.diff.outputs.changed == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
-          PUSH_TOKEN: ${{ secrets.GH_PAT || github.token }}
         run: |
           set -euo pipefail
           VERSION=$(node -p "require('./package.json').version")
@@ -61,7 +60,7 @@ jobs:
           git checkout -B "$BRANCH"
           git add package.json CHANGELOG.md .changelog
           git commit -m "chore: release ${VERSION}"
-          git push --force "https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:"$BRANCH"
+          git push --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:"$BRANCH"
 
           PR_NUMBER=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number // empty')
           if [ -n "$PR_NUMBER" ]; then
@@ -78,7 +77,7 @@ jobs:
       actions: write
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/package.json b/package.json
@@ -46,16 +46,11 @@
   "devDependencies": {
     "@types/node": "25.9.2",
     "@yao-pkg/pkg": "6.20.0",
-    "esbuild": "0.28.0",
+    "esbuild": "0.28.1",
     "tsx": "4.22.4",
     "typescript": "6.0.3",
     "vitest": "4.1.8",
     "vp": "npm:vite-plus@0.1.24"
   },
-  "packageManager": "pnpm@11.0.8",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
-  }
+  "packageManager": "pnpm@11.0.8"
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +wallet-cli: patch
 +---
++
 +Harden supply chain configuration, dependency updates, and release workflows.