fix(deps): patch dev toolchain vulnerabilities #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nix | |
| # nix/package.nix records `npmDepsHash`, a hash of the npm dependency set that | |
| # package-lock.json resolves to. The two have to agree or `nix build` fails | |
| # outright, and nothing here ever checked that they did. | |
| # | |
| # The only thing that refreshed the hash was bump-nix-package.yml, which fires | |
| # on stable releases. `src` is this repo's own tree, not a fetched tarball, so | |
| # every lockfile change landing between two releases left main's hash pointing | |
| # at dependencies that no longer existed. It last matched on 2026-07-05 (v1.6.0) | |
| # while package-lock.json moved ten more times, so `nix run github:…` was broken | |
| # for four weeks with nothing reporting it. | |
| # | |
| # Release-time bumps can't fix that — the drift starts the moment a lockfile PR | |
| # merges. This runs on the PR that causes it and prints the hash to paste. | |
| on: | |
| pull_request: | |
| paths: | |
| - package-lock.json | |
| - nix/** | |
| - .github/workflows/nix-check.yml | |
| # Same branch list as ci.yml, and for the reason its own comment gives: a | |
| # release branch is the last place to skip a check. PRs need no filter here — | |
| # the trigger above has none, so they are covered wherever they land — but a | |
| # direct push or a rebase force-push onto a long-lived branch is not a PR and | |
| # would otherwise go unchecked. | |
| push: | |
| branches: [main, feat/ai-edition, "release/**"] | |
| paths: | |
| - package-lock.json | |
| - nix/** | |
| - .github/workflows/nix-check.yml | |
| # Read-only, and stated rather than inherited: the repo default happens to be | |
| # `read` today, which is exactly the kind of repo-level setting that silently | |
| # changed this workflow's sibling out from under it. | |
| permissions: | |
| contents: read | |
| jobs: | |
| npm-deps-hash: | |
| name: npmDepsHash matches package-lock.json | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: cachix/install-nix-action@v27 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| - name: Compare recorded hash against the lockfile | |
| run: | | |
| set -euo pipefail | |
| EXPECTED=$(nix run nixpkgs#prefetch-npm-deps -- package-lock.json) | |
| RECORDED=$(sed -nE 's|^[[:space:]]*npmDepsHash[[:space:]]*=[[:space:]]*"([^"]*)";|\1|p' nix/package.nix) | |
| echo "recorded in nix/package.nix: ${RECORDED:-<none>}" | |
| echo "expected from package-lock.json: $EXPECTED" | |
| if [[ -z "$EXPECTED" ]]; then | |
| echo "::error::prefetch-npm-deps returned an empty hash" | |
| exit 1 | |
| fi | |
| if [[ "$EXPECTED" != "$RECORDED" ]]; then | |
| echo "::error file=nix/package.nix::npmDepsHash is stale — set it to $EXPECTED" | |
| exit 1 | |
| fi | |
| echo "In sync." |