Repository navigation
Harden the supply chain - #11
Merged
Merged
Conversation
npm 11 skips install scripts that are not explicitly allowed and warns about them on every install. Recording the decision for fsevents, the only dependency that still ships one, silences the warning so that a new package with an install script stands out. The image build now also verifies registry signatures and provenance attestations of every installed package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
V1ncNet
force-pushed
the
harden-supply-chain
branch
from
October 25, 2026 13:45
3516ea5 to
326a6fa
Compare
Malicious package versions are usually spotted and pulled within a few days of publication. Waiting a week before proposing an update avoids most of them and matches what zizmor expects. Security updates are not affected by the cooldown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only tag runs enter the docker-hub environment, so pull request runs can no longer reach the Docker Hub secrets once they move there. The image carries an SBOM and full provenance. Pull requests are checked by zizmor for unsafe workflow patterns and by dependency review for new dependencies with high severity vulnerabilities. The checkout no longer keeps the token in the Git config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All pages now load scripts, styles and images from the own origin only, so a strict policy no longer breaks anything. Scripts are limited to files from the own origin, which blocks injected inline code. Inline styles stay allowed because Font Awesome inserts a style element at runtime and Astro inlines small stylesheets, and hashes for both would change with every build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CV page gets a new look with dark mode and the start page changes how the email address appears, so it ships as a new minor version together with the hardened pipeline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
V1ncNet
force-pushed
the
harden-supply-chain
branch
from
October 25, 2026 13:45
326a6fa to
8cb9572
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the way from this repository to the image on Docker Hub.
docker-hubenvironment, pull request runs no longer see the Docker Hub secrets once they move thereAfter the merge these settings follow outside the code:
mainagainst force pushes and deletiondocker-hublimited to tagsv*, with the Docker Hub secrets moved into itv1.6.0, then a ruleset that protectsv*tagsCloses #5
🤖 Generated with Claude Code