Harden the pinned npm release CLI

[endalk200]

Summary

• upgrade the release-only npm CLI pin to 11.19.0 and replace its four vulnerable bundled packages with integrity-pinned patched releases
• require the derived staging CLI to pass a clean production audit and checksum the exact hardened artifact used for publishing
• add a path-scoped, non-publishing CI workflow that exercises the same preparation pipeline on release-tooling changes

Closes #41.

Testing

• bun run format:write
• bun run check-types
• bun run lint (passes with four pre-existing CSS specificity warnings)
• bun run test
• actionlint .github/workflows/ci.yml .github/workflows/publish-npm.yml .github/workflows/verify-pinned-npm.yml
• exact npm 11.19.0 prepare, harden, clean-audit, checksum, re-extract, and npm stage --help verification
• unmodified npm 11.19.0 rejection regression
• bun run release:audit --workspace apps/cli --include @biomejs/biome --include esbuild --include turbo
• bun --filter artiflow build
• npm package verification and smoke test

Greptile Summary

The PR replaces temporary npm audit exceptions with an integrity-pinned hardening pipeline for npm 11.19.0 and uses the resulting audited artifact during release staging.

• Replaces four vulnerable bundled dependencies with pinned patched releases.
• Audits and checksums the hardened npm archive before artifact upload.
• Adds path-scoped CI verification for release-tooling changes.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The hardening, audit, checksum, artifact transfer, extraction, and staging paths are internally consistent, and the investigation found no reachable blocking or non-blocking defect.

Important Files Changed

Filename	Overview
scripts/harden-pinned-npm.ts	Replaces four bundled npm dependencies with integrity-pinned patched packages after validating package identity and dependency contracts.
scripts/prepare-pinned-npm.ts	Orchestrates packing, extraction, hardening, shrinkwrap generation, auditing, archive creation, and checksumming.
apps/cli/src/release/pinned-npm-audit.ts	Updates the pinned npm policy and requires a clean moderate-or-higher production audit.
.github/workflows/publish-npm.yml	Integrates the hardened archive into the release artifact and npm staging flow with checksum verification.
.github/workflows/verify-pinned-npm.yml	Adds non-publishing CI coverage for preparation, checksum verification, extraction, version validation, command loading, and auditing.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pack official npm 11.19.0] --> B[Extract npm archive]
  B --> C[Replace four bundled dependencies]
  C --> D[Validate versions, integrity, and dependency contracts]
  D --> E[Generate shrinkwrap]
  E --> F[Run production audit]
  F --> G[Create hardened archive]
  G --> H[Checksum official and hardened archives]
  H --> I[Upload release artifacts]
  I --> J[Verify checksums in staging job]
  J --> K[Extract hardened npm]
  K --> L[Run npm stage publish]

Loading

_{Reviews (1): Last reviewed commit: "fix(release): harden pinned npm CLI" | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
artiflow	Ready	Preview	Aug 11, 2026 9:09am