External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

Browse Source 
Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).

archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.

The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.

Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.
This commit is contained in:
SnapOtter
2026-07-29 19:05:30 +08:00
committed by GitHub
parent 4ae03b441b
commit 5c75a93484
7 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/infra/release-supply-chain.test.ts
+5 -1
View File
@@ -119,7 +119,11 @@ describe("release supply-chain closure", () => {
expect(archiveSecurity).toContain("Verify immutable release tag binding");
expect(archiveSecurity).toContain("sha256sum --check --strict");
expect(archiveSecurity).toContain('filter="data"');
expect(archiveSecurity).toContain("node_modules/.bin/tsx --version");
// tsx is asserted at apps/api/node_modules/.bin, where pnpm's workspace layout
// actually places a workspace-package dependency and where the Docker CMD runs
// it. The root path never existed and failed the first real release run.
expect(archiveSecurity).toContain("apps/api/node_modules/.bin/tsx");
expect(archiveSecurity).not.toContain("snapotter/node_modules/.bin/tsx");
expect(archiveSecurity).toContain(
"cyclonedx-json=snapotter-v${VERSION}-archive-linux-${ARCH}-sbom.cdx.json",
);