mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-16 06:51:21 +03:00
davida-ps
4a4b547b92
* ci(skills): pin clawhub CLI by hash via committed lockfile Scorecard flags the skill-release workflow's npm install of the clawhub CLI (code-scanning alerts #25/#26): version pinning alone carries no integrity guarantee. Install it with npm ci from a committed package-lock.json instead, so every package (clawhub + 35 transitive deps) is verified against its sha512 hash at install time. The publish-payload patch step now resolves the module from the local node_modules instead of npm root -g. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skill-release): authenticate pinned clawhub install --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
33 lines
1.0 KiB
Bash
33 lines
1.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CLI_PREFIX="${CLAWHUB_CLI_PREFIX:-.github/clawhub-cli}"
|
|
CODEARTIFACT_DOMAIN="${CODEARTIFACT_DOMAIN:-prompt-security}"
|
|
CODEARTIFACT_DOMAIN_OWNER="${CODEARTIFACT_DOMAIN_OWNER:-443370709039}"
|
|
CODEARTIFACT_REPOSITORY="${CODEARTIFACT_REPOSITORY:-npm-proxy}"
|
|
AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-eu-north-1}}"
|
|
|
|
if ! command -v aws >/dev/null 2>&1; then
|
|
echo "::error::aws CLI is required to authenticate npm against CodeArtifact"
|
|
exit 1
|
|
fi
|
|
|
|
if ! aws sts get-caller-identity >/dev/null 2>&1; then
|
|
echo "::error::AWS credentials are required before installing the CodeArtifact-pinned clawhub CLI"
|
|
exit 1
|
|
fi
|
|
|
|
aws codeartifact login \
|
|
--tool npm \
|
|
--domain "$CODEARTIFACT_DOMAIN" \
|
|
--domain-owner "$CODEARTIFACT_DOMAIN_OWNER" \
|
|
--repository "$CODEARTIFACT_REPOSITORY" \
|
|
--region "$AWS_REGION"
|
|
|
|
npm ci --prefix "$CLI_PREFIX"
|
|
|
|
if [ -n "${GITHUB_PATH:-}" ]; then
|
|
workspace="${GITHUB_WORKSPACE:-$(pwd)}"
|
|
echo "${workspace}/${CLI_PREFIX}/node_modules/.bin" >> "$GITHUB_PATH"
|
|
fi
|