[danielvm-git]

User description

Resolves two pending CI/CD problems, one commit each.

1. CI/CD Pipeline Audit — supply-chain / secrets exposure (critical)

pr-review.yaml referenced the third-party review bot by a mutable tag
(docker://pragent/pr-agent:0.36.0-github_action) while handing it
DEEPSEEK_API_KEY and GITHUB_TOKEN. If that tag were repointed, a
compromised image could run with those secrets. This was the only unpinned
action in the repo — every other action is already SHA-pinned.

Fix: pin the image to its immutable digest
(@sha256:0e0ab10b…, tagged 0.36.0-github_action). Clears audit finding 8a
and the "secrets exposed" critical. Validated with actionlint (clean).

2. Dependabot Updates workflow — security_update_not_possible (error)

The security job failed because the minimatch advisory requires >= 11.0.1,
but @ctxo/lang-typescript pins it to ^10.0.1 via @ts-morph/common@0.29.0,
so Dependabot could not bump it automatically
(run).

Fix: add the npm overrides entry Dependabot's own error recommends,
forcing minimatch to ^11.0.1 (resolves to 11.0.5, 0 vulnerabilities).
minimatch is pulled only by the dev-only @ts-morph/common tooling; v11's
major bump dropped Node < 20 (CI and the VPS run Node 24) and keeps the same
API, verified against its usage.

Verification

• actionlint on all workflows — clean (pre-existing SC2012 notes untouched)
• root npm ci --ignore-scripts — clean, found 0 vulnerabilities
• lockfile sync guard (npm ci --dry-run) — in sync
• go build ./... — success (no Go source touched)

🤖 Generated with Claude Code

---

PR Type

Bug fix

---

Description

• Pin pr-agent GitHub Action by immutable digest

• Add npm override to force minimatch ^11.0.1

• Mitigate secrets exposure and resolve Dependabot advisory

---

Diagram Walkthrough

flowchart LR
  A["Pin pr-agent action"] -- "updates workflow" --> B["Immutable digest"]
  C["Add npm overrides"] -- "updates package.json" --> D["Force minimatch ^11.0.1"]

Loading

File Walkthrough

	Relevant files
Configuration changes	pr-review.yaml Pin pr-agent action to immutable digest                                    .github/workflows/pr-review.yaml Replace mutable pr-agent image tag with immutable digest. Add explanatory comment for pinning and re-pin guidance. +4/-1
Dependencies	package.json Override minimatch to resolve advisory                                      package.json Add npm overrides entry for minimatch to ^11.0.1. Force transitive dev dependency to secure version. +3/-0

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Possible CI Failure This change adds an npm overrides entry that forces minimatch to ^11.0.1, but the diff does not show a corresponding package-lock.json update. If the lockfile is not updated in this PR, npm ci will fail because the package.json and lockfile are out of sync. "overrides": { "minimatch": "^11.0.1" },

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.