From 3b98f8cfaa67bb6c510eb138c2cfddefaef83e07 Mon Sep 17 00:00:00 2001 From: Sourav Nandy Date: Mon, 24 Aug 2026 04:13:29 +0530 Subject: [PATCH] Security audit fixes: SHA-pin CodeQL actions, sync server.json version - Pin codeql.yml's actions/checkout and github/codeql-action/* to immutable commit SHAs (previously mutable @v3/@v4 tags), matching the pinning convention already used in ci.yml and the publish workflows. - Bump python/server.json's version fields from 0.1.3 to 0.1.4 to match the actual current PyPI release of computeledger-cli. Investigated the previously reported TS "run" subcommand smoke tests hanging on Windows: reproduced locally and confirmed it is not a defect in run.ts. Every cli.smoke.test.ts test that shells out to the built CLI via execFileSync (not just the run subcommand tests) exceeds vitest's default 5000ms per-test timeout on this Windows machine purely from per-process node.exe spawn overhead; with a generous timeout override all 11 smoke tests (including all three run tests) pass cleanly. CI only targets ubuntu-latest, so this never surfaces there. No source change made for this finding, per instructions not to force a fix for a confirmed environment-only quirk. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01QyJoCc6YtjnErv6HKa6NPu --- .github/workflows/codeql.yml | 8 ++++---- python/server.json | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0b5ddcb..53c4f89 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,17 +24,17 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 with: category: "/language:${{ matrix.language }}" diff --git a/python/server.json b/python/server.json index ffd3601..e4acdd3 100644 --- a/python/server.json +++ b/python/server.json @@ -6,12 +6,12 @@ "url": "https://github.com/RudrenduPaul/ComputeLedger", "source": "github" }, - "version": "0.1.3", + "version": "0.1.4", "packages": [ { "registryType": "pypi", "identifier": "computeledger-cli", - "version": "0.1.3", + "version": "0.1.4", "runtimeHint": "uvx", "runtimeArguments": [ {