Repository navigation
サプライチェーン対策の穴を埋める - #12
Merged
Merged
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Cloudflare Pages Preview |
next 16.2.12 は Image Optimization API の RCE 2 件に該当する。静的エクスポート では当該 API を使わないが、postcss / nanoid / js-yaml / undici / sharp も合わせて 修正版へ上げる。 Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
変更点
ワークフロー
permissions: {}にし、必要なスコープをジョブ側だけで宣言する。deployments: writeを外す。gitHubTokenを渡していないため wrangler-action は GitHub Deployments を作らない。github.head_refを wrangler のコマンド文字列へ直接展開するのをやめ、環境変数経由で受けて[A-Za-z0-9._/-]以外を置換する。fork の PR はブランチ名にシェルのメタ文字を含められる。steps.deploy.outputs.deployment-urlも同様にenv経由へ移す。actions/dependency-review-actionを追加し、既知の脆弱性を持つ依存の追加を moderate 以上で落とす。リポジトリ設定
GITHUB_TOKENを read-only にし、PR 承認を禁止。mainに ruleset を追加。削除と force push を禁止し、PR とdeployの成功を必須にする。Made with Cursor