From 5f0c3c9600cf1b657870edef8c04cf03fe9bb116 Mon Sep 17 00:00:00 2001 From: BigBase Admin Date: Sun, 8 Nov 2026 08:30:55 -0300 Subject: [PATCH 1/2] ci: pin pr-agent action to its image digest The pr-review workflow referenced docker://pragent/pr-agent by a mutable tag (0.36.0-github_action) while passing DEEPSEEK_API_KEY and GITHUB_TOKEN to it. A repointed tag could run an image that exfiltrates those secrets. Pin to the immutable 0.36.0-github_action digest, matching the SHA-pinning every other action in this repo already uses. Resolves the CI/CD Pipeline Audit supply-chain/secrets-exposure finding (8a). --- .github/workflows/pr-review.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-review.yaml b/.github/workflows/pr-review.yaml index 5e31ea3f3..b6a0b65b9 100644 --- a/.github/workflows/pr-review.yaml +++ b/.github/workflows/pr-review.yaml @@ -31,7 +31,10 @@ jobs: contents: read steps: - name: PR Agent - uses: docker://pragent/pr-agent:0.36.0-github_action + # Pinned to the 0.36.0-github_action image digest (supply-chain hygiene: + # a mutable tag receiving DEEPSEEK_API_KEY + GITHUB_TOKEN could be + # repointed to an exfiltrating image). Re-pin when bumping the version. + uses: docker://pragent/pr-agent@sha256:0e0ab10b296d0d04df2049c51a27c3fc29b1a791f939a532a14f2b775316f6c5 # 0.36.0-github_action env: # OpenAI-compatible endpoint pointing to DeepSeek OPENAI_KEY: ${{ secrets.DEEPSEEK_API_KEY }} From 635fe95afc7be5c7552b949cafb20d1751659243 Mon Sep 17 00:00:00 2001 From: BigBase Admin Date: Sun, 8 Nov 2026 08:35:22 -0300 Subject: [PATCH 2/2] chore(deps): override minimatch to ^11.0.1 to close advisory The Dependabot Updates security job failed with security_update_not_possible: the minimatch advisory requires >= 11.0.1, but @ctxo/lang-typescript pins it to ^10.0.1 via @ts-morph/common@0.29.0, so Dependabot could not bump it automatically. Add the npm override its own error message recommends, forcing minimatch to ^11.0.1 (resolves to 11.0.5, 0 vulnerabilities). minimatch is pulled only by the dev-only @ts-morph/common tooling; v11's major bump just dropped Node < 20 (CI and the VPS run Node 24) and keeps the same API, verified against its usage. --- package-lock.json | 18 +++++++++++++----- package.json | 3 +++ 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index e1682b565..3e255a4be 100644 --- a/package-lock.json +++ b/package-lock.json @@ -147,6 +147,13 @@ "node": ">=20" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz", + "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==", + "dev": true, + "license": "BlueOak-1.0.0" + }, "node_modules/@jridgewell/gen-mapping": { "version": "0.3.13", "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz", @@ -1527,16 +1534,17 @@ } }, "node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "11.0.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz", + "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "@isaacs/nonrecursive-glob-match": "^1.1.0", + "brace-expansion": "^5.0.12" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" diff --git a/package.json b/package.json index 06ee8bf8f..e8304b4b9 100644 --- a/package.json +++ b/package.json @@ -24,6 +24,9 @@ "dependencies": { "@ctxo/lang-csharp": "^0.8.0" }, + "overrides": { + "minimatch": "^11.0.1" + }, "allowScripts": { "tree-sitter@0.22.4": true, "esbuild@0.21.5": true,