Skip to content

ci: block compromised npm packages with Socket Firewall Free #2889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
serhalp merged 3 commits into from
Jun 14, 2026
Merged

ci: block compromised npm packages with Socket Firewall Free #2889

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02afefa
ci: block compromised npm packages with Socket Firewall Free
serhalp Jun 11, 2026
fe080d6
ci: don't install pnpm globally for chromatic
serhalp Jun 11, 2026
f49fe8b
ci: use sfw to install vercel + pin vercel
serhalp Jun 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/autofix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🎨 Check for non-RTL/non-a11y CSS classes
run: vp run lint:css
Expand Down
9 changes: 5 additions & 4 deletions .github/workflows/chromatic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,16 +27,17 @@ jobs:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true

- name: 🟧 Install pnpm globally
run: vp install -g pnpm
Comment on lines -35 to -36

@serhalp serhalp Jun 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a workaround for chromatic needing access to the package manager that it detects we use (pnpm), but that's just needed so it can detect our command to build storybook, so we can just specify that command instead!

sfw: true

- name: 🧪 Run Chromatic Visual and Accessibility Tests
uses: chromaui/action@8a2b82547aef5a3efc8ec3c7905f4ab09a76ed0b # v16.1.0
with:
buildCommand: vp run build-storybook
outputDir: storybook-static

@serhalp serhalp Jun 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

required when you pass buildCommand. this value is the default.

@trueberryless trueberryless Jun 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't the default a temporary directory?
In docs, I can only see that "storybook-static" is default for TurboSnap, but it says temporary dir for CLI and therefore GitHub action: https://www.chromatic.com/docs/configure/#outputdir

But I guess we have to set it to something since it is indeed required, and since our .gitignore already has this entry, I approve ✅

@serhalp serhalp Jun 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, heh, it's an example provided, not the default 🤦🏼.

env:
CHROMATIC_BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
CHROMATIC_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
Expand Down
38 changes: 22 additions & 16 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
run-install: false

- name: 📦 Install dependencies (root only, no scripts)
run: vp install --filter . --ignore-scripts
sfw: true
# root only, no scripts
run-install: |
- args: ['--filter', '.', '--ignore-scripts']
Comment thread
trueberryless marked this conversation as resolved.

- name: 🔠 Lint project
run: vp run lint
Expand All @@ -50,10 +50,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 💪 Type check
run: vp run test:types
Expand All @@ -67,10 +68,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🧪 Unit tests
run: vp test --project unit --coverage --reporter=default --reporter=junit --outputFile=test-report.junit.xml
Expand Down Expand Up @@ -105,10 +107,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🌐 Install browser
run: vp exec playwright install chromium-headless-shell
Expand Down Expand Up @@ -151,10 +154,11 @@ jobs:
- name: 👑 Fix Git ownership
run: git config --global --add safe.directory /__w/npmx.dev/npmx.dev

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🏗️ Build project
run: vp run build:test
Expand Down Expand Up @@ -188,10 +192,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🏗️ Build project
run: vp run build:test
Expand All @@ -211,10 +216,11 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: 🧹 Check for unused code
run: vp run knip
Expand All @@ -228,13 +234,13 @@ jobs:
with:
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
run-install: false

- name: 📦 Install dependencies (root only, no scripts)
run: vp install --filter . --ignore-scripts
sfw: true
# root only, no scripts
run-install: |
- args: ['--filter', '.', '--ignore-scripts']

- name: 🌐 Check for missing or dynamic i18n keys
run: vp run i18n:report
Expand Down
9 changes: 7 additions & 2 deletions .github/workflows/deploy-canary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,17 @@ jobs:
persist-credentials: false
fetch-depth: 2

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
run-install: false

- run: vp install -g vercel
- uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
with:
mode: firewall-free
firewall-version: v1.12.0
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- run: sfw vp i -g vercel@54.12.2
- run: vercel deploy --target=canary
env:
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/lunaria.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,11 @@ jobs:
fetch-depth: 0
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
cache: true
sfw: true

- name: Generate Lunaria Overview
uses: lunariajs/action@4911ad0736d1e3b20af4cb70f5079aea2327ed8e # astro-docs
2 changes: 1 addition & 1 deletion .github/workflows/release-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
fetch-depth: 0
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
run-install: false
Expand Down
16 changes: 12 additions & 4 deletions .github/workflows/release-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
fetch-depth: 0
persist-credentials: true

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
run-install: false
Expand Down Expand Up @@ -66,7 +66,11 @@ jobs:

- name: 📦 Install dependencies
if: steps.check.outputs.skip == 'false'
run: vp install --filter . --ignore-scripts
uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
sfw: true
run-install: |
- args: ['--filter', '.', '--ignore-scripts']

- name: 📝 Generate release notes
if: steps.check.outputs.skip == 'false'
Expand Down Expand Up @@ -101,14 +105,18 @@ jobs:
ref: release
persist-credentials: false

- uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
- uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
node-version: lts/*
registry-url: https://registry.npmjs.org
run-install: false

- name: 📦 Install dependencies
run: vp install --filter npmx-connector...
uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
with:
sfw: true
run-install: |
- args: ['--filter', 'npmx-connector...']

- name: 🔢 Set connector version
env:
Expand Down
2 changes: 1 addition & 1 deletion .github/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ rules:
stale-action-refs:
ignore:
# lunariajs/action has no tag refs; keep the branch commit hash-pinned.
- lunaria.yml:38
- lunaria.yml:39
dangerous-triggers:
ignore:
- enforce-release-source.yml
Expand Down
Loading