From a24100aceb76b917b87b84fccefddba09c35fa8e Mon Sep 17 00:00:00 2001
From: davd-gzl <60177543+davd-gzl@users.noreply.github.com>
Date: Sat, 15 Aug 2026 14:52:26 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(ci)=20harden=20the=20rema?=
 =?UTF-8?q?ining=20fetches=20in=20the=20workflow?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gitlint-core keeps the linter at 0.19.1, which the wheels-only pin was
resolving down to 0.18.0 through an sdist-only sh. --ignore-scripts
stops three npm ci, one yarn install and one npm install -g running
the scripts of what they fetch, and yarn is pinned to 1.22.22. curl
holds the dockerize download and its redirects to https.
---
 .github/workflows/meet.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/meet.yml b/.github/workflows/meet.yml
index 06d22836..ebc6f5c8 100644
--- a/.github/workflows/meet.yml
+++ b/.github/workflows/meet.yml
@@ -33,7 +33,7 @@ jobs:
           ! git log | grep 'fixup!'
       - name: Install gitlint
         if: always()
-        run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint==0.18.0"
+        run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint-core==0.19.1"
       - name: Lint commit messages added to main
         if: always()
         run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
@@ -93,11 +93,11 @@ jobs:
 
       - name: Install yarn
         if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g yarn
+        run: npm install -g --ignore-scripts yarn@1.22.22
 
       - name: Install node dependencies
         if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile
+        run: yarn install --frozen-lockfile --ignore-scripts
 
       - name: Build mails
         if: steps.mail-templates.outputs.cache-hit != 'true'
@@ -262,7 +262,9 @@ jobs:
       # Tool to wait for a service to be ready
       - name: Install Dockerize
         run: |
-          curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv
+          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
+            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
+            sudo tar -C /usr/local/bin -xzv
 
       - name: Wait for MinIO to be ready
         run: |
@@ -348,7 +350,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install dependencies
-        run: cd src/frontend/ && npm ci
+        run: cd src/frontend/ && npm ci --ignore-scripts
 
       - name: Check linting
         run: cd src/frontend/ && npm run lint
@@ -368,7 +370,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Check linting
         run: npm run lint
@@ -389,7 +391,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Build SDK
         run: npm run build