Repository navigation
ci: supply-chain guardrails for hidden payloads and build scripts (#914, #915, #921, #920) - #924
Merged
dadadave80 merged 5 commits intoOct 22, 2026
Conversation
…eliobond#914) Adds scripts/check-hidden-content.mjs, run as its own CI job, to catch the mechanical signatures of the Heliobond/backend#969 payload: lines over 400 characters in source, runs of 8+ tabs or 40+ spaces before code, bidi and zero-width characters, eval/Function/atob/fromCharCode and escape-run obfuscation in non-test source, and new root-level scripts not on an allowlist. Reviewed exceptions are listed explicitly and covered by tests. Closes Heliobond#914
Adds a review gate for PRs that change package.json scripts or dependencies, lockfiles, hooks, workflows, or tool configs. The gate prints the exact changes as plain text (package.json key diffs and the raw diff) to the job summary and fails until a maintainer applies the supply-chain-reviewed label. It runs on the pull_request event with no secrets, and reads its checker from the base branch so a PR cannot change the check that runs on it. Closes Heliobond#915
…st (Heliobond#921) SECURITY.md gets a Supply chain section (bun-only with a frozen lockfile, review rules for scripts, hooks, workflows and tool configs, the new CI gates, dependency and Action rules) and an Incident response section. The PR template gets contributor items for root files, scripts and dependencies and a reviewer checklist. CONTRIBUTING.md gets a step-by-step guide for reviewing fork PRs safely, linked from both. Closes Heliobond#921
…Heliobond#920) The Vercel build receives every project variable, so a malicious build script on main could read server secrets. The repo cannot change Vercel settings, so these items are checklist entries a maintainer verifies in the dashboard: only NEXT_PUBLIC_* in the build step, production deploys gated on CI, and secret rotation after a reverted merge. Refs Heliobond#920
|
@dev-susa is attempting to deploy a commit to the David Dada's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Thanks for the PR! A maintainer will take a look shortly. ✨ |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…/dependabot/actions, scan e2e and workflows, fix check names in docs
|
Thanks for the PR! A maintainer will take a look shortly. ✨ |
1 task done
7 tasks done
3 tasks
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four Stellar Wave issues share one root cause: the Heliobond/backend#969 payload (an obfuscated
api.jshidden behind tab padding and wired intodev/build/start) passed review, and nothing in this repo would have caught it or limited the damage. This PR adds mechanical checks and the policy that goes with them.scripts/check-hidden-content.mjsruns as its ownhidden-contentCI job. It fails on lines over 400 characters in source, runs of 8+ tabs or 40+ spaces before code, zero-width and bidi characters,eval/Function/atob/fromCharCodeand 4+ escape runs in non-test source, and new root-level scripts not on an allowlist.scripts/check-supply-chain-changes.mjsand.github/workflows/supply-chain.ymllist every change topackage.jsonscripts and dependencies, lockfiles, hooks, workflows and tool configs as plain text in the job summary. The check fails until a maintainer applies thesupply-chain-reviewedlabel. It runs onpull_requestwith no secrets and reads its checker from the base branch.SECURITY.mdgets a Supply chain section and an Incident response section. The PR template gets contributor items and a reviewer checklist.CONTRIBUTING.mdgets a "Reviewing a fork PR safely" guide, linked from both.package.jsonscripts with every Vercel secret in the environment #920 (partial). The repo cannot change Vercel settings, sodocs/MAINNET_CHECKLIST.mdgets three items for a maintainer to verify in the dashboard: onlyNEXT_PUBLIC_*in the build step, production deploys gated on CI, and secret rotation after a reverted merge. Scoping Vercel build secrets is still to do.Closes #914
Closes #915
Closes #921
Refs #920
Linked issue
Closes #914, Closes #915, Closes #921. Refs #920.
Type of change
Test evidence
bun run typecheck: passesbun run lint: 0 errors. Two warnings, both in files this PR does not touch (scripts/check-bundle-size.js,src/lib/format.ts).bun run format:check: passesbun run test: 130 files, 1463 passed, 3 expected failures (pre-existingexpected failcases), exit 0bun run build: not run locally. The change does not touch app code or the bundle, so CI'sbuildjob is the check to watch.scripts/check-hidden-content.test.ts(19 cases: each rule, BOM handling, reviewed exceptions, and a check that the current tree passes) andscripts/check-supply-chain-changes.test.ts(19 cases: watched paths, label gate, package.json key diff, report rendering, truncation, and end-to-end runs against a temporary git repo, including exit codes and the job summary).node scripts/check-hidden-content.mjson the branch: 0 findings across 381 tracked files.Notes for reviewers
scripts/and.github/workflows/, soSupply-chain changeswill fail until a maintainer reviews the job summary and appliessupply-chain-reviewed. The label has to exist in the repo first.hidden-contentandSupply-chain changesas required checks onmain. The repo cannot enforce this from a file.main— require reviews, code-owner approval and the CI jobs as required status checks #912 is leading tabs. The check flags any run of 8+ tabs or 40+ spaces before code, since Prettier never emits those in source.LINE_ALLOWLISTin the checker covers existing legitimate lines: base64 decoding withatob/fromCharCodein four files, one control-character class, and one SVG path. Each entry matches a file, rule and substring, so editing those lines is checked again. A UTF-8 BOM is allowed only at the start of a file.pull_requeston fork PRs would need write permissions. Registry checks need network access and are left for a follow-up.package.jsonscripts with every Vercel secret in the environment #920 is partial. Vercel environment scoping, deployment gating and secret rotation are maintainer actions tracked in the mainnet checklist.