ci: pin all npm dependencies in update-quarkus and update-springboot workflows#3565
Conversation
…workflows xml2js, yaml, and semver were installed without version constraints, pulling the latest release on every run. This breaks reproducibility and creates a dependency confusion vector. Pin to known-good versions. Closes knative#3562
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Ankitsinghsisodya The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
knative-prow
bot
added
size/XS
|
Hi @Ankitsinghsisodya. Thanks for your PR. I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
There was a problem hiding this comment.
Pull request overview
Pins previously unversioned npm dependencies used by the scheduled “update platform” GitHub Actions workflows, improving reproducibility and reducing supply-chain risk when running the embedded template update automation.
Changes:
- Pin
xml2jsto0.6.2in both platform update workflows. - Pin
yamlto2.4.5andsemverto7.6.3in the Spring Boot platform update workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/update-springboot-platform.yaml |
Pins xml2js, yaml, and semver to exact versions in the workflow’s npm install step. |
.github/workflows/update-quarkus-platform.yaml |
Pins xml2js to an exact version in the workflow’s npm install step. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3565 +/- ##
==========================================
+ Coverage 53.76% 56.23% +2.46%
==========================================
Files 180 180
Lines 20465 20465
==========================================
+ Hits 11004 11508 +504
+ Misses 8355 7757 -598
- Partials 1106 1200 +94
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Problem
xml2js,yaml, andsemverwere installed without version constraints in the update-quarkus and update-springboot workflows. An unpinnednpm installpulls the latest version on every run, breaking reproducibility and creating a dependency confusion vector.update-quarkus-platform.yaml:xml2jsunpinnedupdate-springboot-platform.yaml:xml2js,yaml,semverunpinnedFix
Pin all packages to exact versions:
xml2js@0.6.2yaml@2.4.5semver@7.6.3Closes #3562