mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 07:20:39 +00:00
Jamie Tanna
34c7bcb7a5
When running the Release job, we restore our `node_modules` cache via `setup-node`. This leads to `semantic-release` executing - with `contents: write`, `packages: write`, `id-token: write` and Docker Hub credentials - the release process. If we were to have a poisoned cache, this could lead to backdoored npm packages and Docker images. Although not currently exploitable, we should further harden this by: - never using the cache for `release` jobs - requiring a full `pnpm install --frozen-lockfile` on release jobs - increasing the build time slightly on release jobs This ensures that we don't leave ourselves vulnerable to cache poisoning in the future. It appears that zizmor's `cache-poisoning` audit covers this pattern, but doesn't recognise a branch-push `semantic-release` job as a release workflow, so won't flag regressions here. Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>