Repository navigation
docs(feature-map): keep the page's sources in the repo; npm run docs:feature-map #1124
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deps Backdoor Scan | |
| # Scans installed node_modules for supply-chain backdoors and unexpected | |
| # open-port / createServer usage. Installs with --ignore-scripts so malicious | |
| # lifecycle hooks never run during CI. | |
| # | |
| # Local: | |
| # npm ci --ignore-scripts | |
| # npm run scan:deps-security | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Weekly Saturday 02:30 UTC — catch delayed compromised publishes | |
| - cron: '30 2 * * 6' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan-node-modules: | |
| # A version-bump commit changes four package.json version fields and | |
| # nothing else, so there is nothing here for it to check. It used to carry | |
| # `[skip ci]` for this, but that marker also suppresses the *tag* push that | |
| # rides on the same commit, which silently disabled every release — see | |
| # version-bump.yml. Skipping by message keeps the saving without that cost. | |
| # Guarded on event_name so pull_request runs are never skipped. | |
| if: "${{ github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') }}" | |
| name: Scan node_modules (ports / backdoors) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| # npm 10 (what Node 22 ships) cannot resolve this workspace graph | |
| # without a lockfile — arborist dies in #loadPeerSet on vitest with | |
| # "Cannot read properties of null (reading 'edgesOut')". npm 11 does | |
| # it fine. Verified on a clean clone at Node 22.23.1. | |
| - run: npm i -g npm@11 | |
| # Never run dependency lifecycle scripts in this job. | |
| - name: Install dependencies (ignore-scripts) | |
| run: npm ci --ignore-scripts | |
| - name: Scan node_modules for backdoors / unexpected listeners | |
| run: | | |
| node scripts/security/scan-node-modules.mjs \ | |
| --fail-on high \ | |
| --report deps-backdoor-report.json | |
| - name: Upload scan report | |
| if: always() | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: deps-backdoor-report | |
| path: deps-backdoor-report.json | |
| retention-days: 30 |