From f2f46687acfa491a72b335230a7cb2f71f235725 Mon Sep 17 00:00:00 2001
From: Kevin Stillhammer <kevin.stillhammer@gmail.com>
Date: Wed, 14 Oct 2026 11:05:12 +0200
Subject: [PATCH] Verify npm dependency signatures before builds (#426)

## Summary

Supersedes #402 with its changes rebased onto current `main` and the
merge conflict resolved. The original PR is left unchanged.

- Run `npm audit signatures` after installation and before `npm run all`
in the test and checksum-update workflows.
- Preserve the current JSON checksum manifest path
(`src/download/checksum/known-checksums.json`).
- Verify registry signatures and available provenance attestations
without requiring every dependency to publish provenance.

Related: astral-sh/setup-uv#1027 adds the same verification; #401
separately hardens npm installation defaults.

## Validation

Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0:
- `npm ci --ignore-scripts` passed (reports existing dependency
vulnerabilities; dependency files are unchanged).
- `npm audit signatures` passed: 547 registry signatures and 97
attestations verified.
- `npm run all` passed: 7 suites, 99 tests; no generated or formatting
changes.
- `actionlint` passed.
- `zizmor` reports the same 26 low-severity findings on this branch and
`main`, with no new findings.
- `git diff --check` passed.

Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
---
 .github/workflows/test.yml                   | 2 ++
 .github/workflows/update-known-checksums.yml | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 60f9fe5..756747d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,6 +31,8 @@ jobs:
           cache: npm
       - run: |
           npm ci --ignore-scripts
+      - name: Verify npm package signatures
+        run: npm audit signatures
       - run: |
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
diff --git a/.github/workflows/update-known-checksums.yml b/.github/workflows/update-known-checksums.yml
index 8d6c260..6bdfff4 100644
--- a/.github/workflows/update-known-checksums.yml
+++ b/.github/workflows/update-known-checksums.yml
@@ -23,7 +23,10 @@ jobs:
         run:
           node dist/update-known-checksums/index.cjs
           src/download/checksum/known-checksums.json ${{ secrets.GITHUB_TOKEN }}
-      - run: npm ci --ignore-scripts && npm run all
+      - run: |
+          npm ci --ignore-scripts
+          npm audit signatures
+          npm run all
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with: