Merge pull request #1 from dream-horizon-org/chore/package-rename #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, master ] | |
| pull_request: | |
| branches: [ main, master ] | |
| # Security: Minimal permissions following principle of least privilege | |
| permissions: | |
| contents: read # Only read repository contents | |
| checks: write # Write status checks (for PR status) | |
| pull-requests: read # Read PR information | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: [18.x, 20.x, 22.x] | |
| steps: | |
| # Security: Using version tags (update to commit SHAs for production) | |
| # To get latest SHA: https://api.github.com/repos/actions/checkout/commits/main | |
| # Best practice: Pin to specific commit SHA to prevent supply chain attacks | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| # Security: Fetch only the commit being tested, not full history | |
| fetch-depth: 1 | |
| # Security: Using version tags (update to commit SHAs for production) | |
| # To get latest SHA: https://api.github.com/repos/actions/setup-node/commits/main | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| # Security: No cache needed - this repo has zero dependencies | |
| # No npm/yarn/pnpm install happens, so no cache required | |
| # Security: Self-scan - Verify the workflow file itself hasn't been compromised | |
| - name: Self-Scan Workflow Files | |
| run: | | |
| # Scan the workflow file for any suspicious package references | |
| # This ensures no malicious packages are referenced in CI | |
| echo "🔍 Scanning workflow files for security..." | |
| # Check for actual install commands, excluding: | |
| # - Comment lines (containing # before the pattern) | |
| # - Documentation strings (in echo/heredoc) | |
| # - The grep command itself | |
| # - Lines that are clearly documentation | |
| if grep -rE "(npm install|npm ci|yarn install|pnpm install|bun install)" .github/workflows/ 2>/dev/null | \ | |
| grep -vE "#.*install|echo.*install|grep.*install|ERROR:|documentation|release notes|npm install -g|No.*install"; then | |
| echo "❌ ERROR: Package installation detected in workflow files!" | |
| echo "This repository uses zero dependencies - no installs should be needed" | |
| exit 1 | |
| else | |
| echo "✅ No package installations found in workflows" | |
| fi | |
| # Security: Verify package.json has zero dependencies | |
| - name: Verify Zero Dependencies | |
| run: | | |
| echo "🔍 Verifying package.json has zero dependencies..." | |
| if node -e "const pkg = require('./package.json'); if (pkg.dependencies || pkg.devDependencies) { console.error('ERROR: Dependencies found!'); process.exit(1); } else { console.log('✅ Zero dependencies confirmed'); }"; then | |
| echo "✅ Package has zero dependencies - safe from supply chain attacks" | |
| else | |
| echo "❌ ERROR: Dependencies detected in package.json" | |
| exit 1 | |
| fi | |
| - name: Verify CLI Commands | |
| run: | | |
| # Test version (must succeed) | |
| node bin/cli.mjs --version | |
| # Test help (must succeed) | |
| node bin/cli.mjs --help | |
| # Test status (must succeed) | |
| node bin/cli.mjs status | |
| - name: Test Safe Package Scan | |
| run: | | |
| # Scan safe package (should pass, exit 0) | |
| # Security: All network providers disabled to prevent external API calls | |
| node bin/cli.mjs scan lodash@4.17.21 --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet | |
| - name: Test Compromised Package Detection | |
| run: | | |
| # Scan compromised package (should fail, exit 1) | |
| # Security: All network providers disabled - uses only local blacklist | |
| if node bin/cli.mjs scan get-them-args@1.3.3 --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet 2>&1; then | |
| echo "ERROR: Compromised package was NOT blocked!" | |
| exit 1 | |
| else | |
| echo "SUCCESS: Compromised package was correctly blocked" | |
| fi | |
| - name: Test List Command | |
| run: | | |
| # List compromised packages (must succeed) | |
| node bin/cli.mjs list --logMode=quiet | |
| - name: Test Repository Scan | |
| run: | | |
| # Create test package.json with safe dependencies | |
| mkdir -p test-repo | |
| echo '{"name":"test","version":"1.0.0","dependencies":{"lodash":"4.17.21"}}' > test-repo/package.json | |
| # Scan test repository (should pass) | |
| # Security: All network providers disabled | |
| node bin/cli.mjs scan test-repo --skipNpmAudit=true --enableOsv=false --enableGitHub=false --logMode=quiet | |
| # Cleanup | |
| rm -rf test-repo | |
| - name: Run Smoke Tests | |
| run: npm run test:smoke | |