mirror of
https://github.com/astral-sh/ruff-action.git
synced 2026-11-10 00:30:30 +00:00
f2f46687ac
## Summary Supersedes #402 with its changes rebased onto current `main` and the merge conflict resolved. The original PR is left unchanged. - Run `npm audit signatures` after installation and before `npm run all` in the test and checksum-update workflows. - Preserve the current JSON checksum manifest path (`src/download/checksum/known-checksums.json`). - Verify registry signatures and available provenance attestations without requiring every dependency to publish provenance. Related: astral-sh/setup-uv#1027 adds the same verification; #401 separately hardens npm installation defaults. ## Validation Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0: - `npm ci --ignore-scripts` passed (reports existing dependency vulnerabilities; dependency files are unchanged). - `npm audit signatures` passed: 547 registry signatures and 97 attestations verified. - `npm run all` passed: 7 suites, 99 tests; no generated or formatting changes. - `actionlint` passed. - `zizmor` reports the same 26 low-severity findings on this branch and `main`, with no new findings. - `git diff --check` passed. Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>