feat: pnpm バージョン固定と supply chain attack 対策 #530
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # pnpm security settings | ||
| # Strict peer dependency resolution - fail on conflicts | ||
| strict-peer-dependencies=true | ||
|
|
||
| # Auto-install missing peer dependencies | ||
| auto-install-peers=true | ||
|
|
||
| # Run security audit on install | ||
| audit=true | ||
| audit-level=moderate | ||
|
|
||
| # Prevent phantom dependencies (packages hoisting to root node_modules) | ||
| shamefully-hoist=false | ||
|
|
||
| # Use content-addressable storage (pnpm default - integrity verification) | ||
| verify-store-integrity=true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # pnpm workspace configuration | ||
| # https://pnpm.io/pnpm-workspace_yaml | ||
|
|
||
| # supply chain attack 対策: 公開から 2 日未満のパッケージをインストール禁止 | ||
| # pnpm v10.16.0+ でサポート | ||
| # 単位: 分（2880 = 2 days） | ||
| minimumReleaseAge: 2880 | ||
|
Comment on lines
+5
to
+7
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# First, understand the repository structure
echo "=== Repository root files ==="
ls -la | head -20
echo
echo "=== Root package.json check ==="
if [ -f package.json ]; then
cat package.json | head -30
else
echo "No root package.json found"
fi
echo
echo "=== pnpm-workspace.yaml content ==="
if [ -f pnpm-workspace.yaml ]; then
cat pnpm-workspace.yaml
else
echo "No pnpm-workspace.yaml found"
fiRepository: keito4/config Length of output: 2727 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== packageManager field in root package.json ==="
if [ -f package.json ]; then
jq -r '.packageManager // "NOT SET"' package.json
else
echo "Root package.json not found"
fi
echo
echo "=== CI/workflow files referencing pnpm ==="
fd -HI '\.(ya?ml|json)$' -path '*/.github/*' -o -path '*/\.gitlab-ci\.yml' | while read f; do
if rg -l 'pnpm|corepack|packageManager' "$f" 2>/dev/null; then
echo "Found in: $f"
fi
done
echo
echo "=== .npmrc or .pnpmrc files ==="
fd -HI '^\.(npmrc|pnpmrc)$'
echo
echo "=== All package.json files with packageManager field ==="
fd -HI '^package\.json$' -x sh -c '
pkg_mgr=$(jq -r ".packageManager // \"<missing>\"" "{}" 2>/dev/null || echo "error")
if [ "$pkg_mgr" != "<missing>" ] && [ "$pkg_mgr" != "error" ]; then
echo "{}": $pkg_mgr
fi
'Repository: keito4/config Length of output: 344 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== CI workflow files ==="
find .github/workflows -type f -name '*.yml' -o -name '*.yaml' 2>/dev/null | head -10
echo
echo "=== Content of CI workflows (checking for pnpm setup) ==="
find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -exec sh -c '
echo "--- File: {} ---"
grep -n -i "pnpm\|corepack\|packageManager\|setup-node" "{}" || echo "No pnpm/corepack references found"
' \;
echo
echo "=== .npmrc and .pnpmrc files ==="
find . -maxdepth 3 -type f \( -name '.npmrc' -o -name '.pnpmrc' \) 2>/dev/null || echo "None found"
echo
echo "=== Checking devcontainer configuration ==="
if [ -d .devcontainer ]; then
find .devcontainer -type f \( -name '*.json' -o -name 'Dockerfile' -o -name 'devcontainer.json' \) -exec sh -c '
echo "--- File: {} ---"
head -50 "{}"
' \;
fiRepository: keito4/config Length of output: 14236 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== All package.json files in the repo ==="
find . -name package.json -type f | head -20
echo
echo "=== Check which ones have packageManager field ==="
find . -name package.json -type f -exec sh -c '
result=$(jq -r ".packageManager // \"<missing>\"" "{}" 2>/dev/null || echo "parse_error")
if [ "$result" != "<missing>" ] && [ "$result" != "parse_error" ]; then
echo "{}: $result"
fi
' \;Repository: keito4/config Length of output: 166 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Content of .npmrc ==="
cat -n .npmrc
echo
echo "=== Check for setup-node configuration in CI workflows ==="
grep -A5 "setup-node" .github/workflows/ci.yml | head -30
echo
echo "=== DevContainer node feature configuration ==="
echo "Local DevContainer:"
jq '.features | keys[] as $key | select($key | contains("node")) | {($key): .[$key]}' .devcontainer/devcontainer.json
echo
echo "Codespaces DevContainer:"
jq '.features | keys[] as $key | select($key | contains("node")) | {($key): .[$key]}' .devcontainer/codespaces/devcontainer.jsonRepository: keito4/config Length of output: 1351 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check for .node-version file ==="
if [ -f .node-version ]; then
cat -n .node-version
else
echo "No .node-version file found"
fi
echo
echo "=== Check pnpm-lock.yaml to understand pnpm version used ==="
if [ -f pnpm-lock.yaml ]; then
head -5 pnpm-lock.yaml | grep -i "lockfile\|pnpm"
echo "..."
else
echo "No pnpm-lock.yaml found"
fi
echo
echo "=== Check for pnpm version in CI install steps ==="
grep -B5 -A5 "pnpm install\|npm install" .github/workflows/ci.yml | head -40
echo
echo "=== Check Dockerfile for pnpm installation ==="
grep -n -i "pnpm" .devcontainer/DockerfileRepository: keito4/config Length of output: 246 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Search for pnpm installation in entire repo ==="
grep -r "pnpm" .devcontainer/Dockerfile .github/workflows/ --include="*.yml" --include="*.yaml" --include="*.json" | grep -v "pnpmVersion\|pnpm-workspace" | head -20
echo
echo "=== Check if npm scripts reference pnpm ==="
jq '.scripts' package.json
echo
echo "=== Verify current node setup in ci.yml - full install section ==="
sed -n '/Install dependencies/,/^ - /p' .github/workflows/ci.yml | head -20
echo
echo "=== Check root .npmrc comments for pnpm reference ==="
head -20 .npmrcRepository: keito4/config Length of output: 2018 Switch CI from The To enforce the 2-day release age gate:
Additionally, generate a pnpm-lock.yaml file by running pnpm install locally and committing it. 🤖 Prompt for AI Agents |
||
|
|
||
| # 除外パッケージ（公式・信頼できるリリースサイクルが速いもの） | ||
| minimumReleaseAgeExclude: [] | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
.npmrcThe new project-level
.npmrcadds pnpm-specific options (for examplestrict-peer-dependencies,auto-install-peers,shamefully-hoist, andverify-store-integrity) that npm does not support, so everynpminvocation now emitsUnknown project config ...warnings; this affects this repo immediately because CI/workflows runnpmcommands, and npm already warns these unknown keys may stop working in a future major release. Keeping pnpm-only settings in the shared config introduces noisy logs now and a forward-compatibility risk for the npm-based pipeline.Useful? React with 👍 / 👎.