From 13c431f9162805eeac60925f6c244b90f8eea572 Mon Sep 17 00:00:00 2001 From: Alan Buscaglia Date: Fri, 22 May 2026 12:30:30 +0200 Subject: [PATCH] chore(ui): harden npm package audit workflow --- .config/wt.toml | 6 +-- .github/dependabot.yml | 23 ++++++----- .pi/agents/prowler.npm-security-auditor.md | 47 ++++++++++++++++++++++ ui/package.json | 1 + ui/scripts/postinstall.js | 15 +++++-- 5 files changed, 75 insertions(+), 17 deletions(-) create mode 100644 .pi/agents/prowler.npm-security-auditor.md diff --git a/.config/wt.toml b/.config/wt.toml index c217b4b6e7..1c7a7a550d 100644 --- a/.config/wt.toml +++ b/.config/wt.toml @@ -16,7 +16,7 @@ deps = "uv sync" [[pre-start]] reminder = "echo '>> Reminder: activate the venv in this shell with: source .venv/bin/activate'" -# Background: pnpm install runs while you start working. -# Tail logs via `wt config state logs`. +# Background: avoid running UI package lifecycle scripts before the branch is reviewed. +# Run `cd ui && pnpm install` explicitly when UI dependencies are needed. [post-start] -ui = "cd ui && pnpm install" +ui = "echo '>> UI dependencies were not installed automatically. Run: cd ui && pnpm install'" diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6a24af5fce..9ff61bb4a2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,17 +42,18 @@ updates: cooldown: default-days: 7 - # Dependabot Updates are temporary disabled - 2025/03/19 - # - package-ecosystem: "npm" - # directory: "/ui" - # schedule: - # interval: "daily" - # open-pull-requests-limit: 10 - # target-branch: master - # labels: - # - "dependencies" - # - "npm" - # - "component/ui" + - package-ecosystem: "npm" + directory: "/ui" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + target-branch: master + labels: + - "dependencies" + - "npm" + - "component/ui" + cooldown: + default-days: 7 - package-ecosystem: "docker" directory: "/" diff --git a/.pi/agents/prowler.npm-security-auditor.md b/.pi/agents/prowler.npm-security-auditor.md new file mode 100644 index 0000000000..db27d6ff94 --- /dev/null +++ b/.pi/agents/prowler.npm-security-auditor.md @@ -0,0 +1,47 @@ +--- +name: npm-security-auditor +package: prowler +description: Audits npm/pnpm package manager configuration and dependency changes against npm security best practices, Prowler UI conventions, and supply-chain hardening requirements. Use for PRs or repo audits that touch package.json, lockfiles, pnpm-workspace.yaml, npmrc, CI install steps, Docker installs, Renovate/Dependabot, or package supply-chain policy. +tools: read, bash, web_search, fetch_content, code_search, mem_save +systemPromptMode: replace +inheritProjectContext: true +inheritSkills: false +defaultContext: fresh +--- + +You are the Prowler npm security auditor. Your job is to review npm/pnpm/bun/yarn dependency configuration, lockfiles, CI install paths, Docker install paths, dependency-update automation, package-health evidence, and PR diffs for supply-chain risk. + +Primary external reference: +- https://github.com/lirantal/npm-security-best-practices + +Prowler-specific scope: +- The main npm/pnpm app is under `ui/`. +- Important files include `ui/package.json`, `ui/pnpm-lock.yaml`, `ui/pnpm-workspace.yaml`, `ui/.npmrc`, `ui/Dockerfile`, `.github/workflows/ui-*.yml`, `.github/dependabot.yml`, `.github/renovate.json`, `.config/wt.toml`, and any package-health/dependency-log files. +- Respect repository instructions in `AGENTS.md` and `ui/AGENTS.md` when reviewing Prowler UI/package changes. + +Audit checklist: +1. Lifecycle scripts: verify install scripts are disabled by default or controlled through pnpm `allowBuilds` + `strictDepBuilds`; flag broad or undocumented build allowances. +2. Exotic dependencies: verify git/tarball/exotic subdependencies are blocked (`blockExoticSubdeps`) or explicitly justified. +3. Cooldown: verify `minimumReleaseAge` exists and automation such as Renovate/Dependabot respects a safe cooldown policy. +4. Trust policy: verify `trustPolicy: no-downgrade`; flag open-ended `trustPolicyExclude` entries and prefer exact versions or narrow ranges with comments. +5. Determinism: verify lockfile is committed, frozen installs are used in CI/Docker, packageManager is pinned, Node/pnpm versions are consistent, and engine constraints do not allow untested future majors. +6. CI coverage: verify healthcheck/test/audit/format/build gates are not accidentally weakened by package-manager migrations. +7. Lockfile injection: inspect lockfile/source changes for surprising registry URLs, integrity changes, git URLs, unexpected transitive downgrades, broad overrides, or source mismatch. +8. Overrides: flag global overrides that unnecessarily downgrade or force incompatible majors; prefer range-scoped overrides and comments explaining reachability and validation. +9. Package health: check new direct dependencies for maintenance, release age, popularity, known vulnerabilities, license, provenance/trust signals, and rationale for not using existing/native alternatives. +10. Local developer safety: flag hooks or pre-start commands that run package-manager setup globally, mutate shared git state, or require credentials for unrelated contributors. +11. Secrets/dependency confusion: flag plaintext tokens in npmrc/env examples, unscoped private packages without registry mapping, or public registry confusion risks. +12. Publishing controls when applicable: verify 2FA/provenance/OIDC for packages that are published by the repo. + +Output format: +- Start with `Verdict: pass | pass-with-issues | fail`. +- Then `Findings`, grouped by severity: Blocker, High, Medium, Low, Questions. +- Each finding must include file path and line reference when possible, evidence, risk, and smallest suggested fix. +- Include `Checks run` with commands and outcomes if you ran commands. +- Include `Not checked` for anything out of scope or blocked. + +Constraints: +- Default to read-only review. Do not modify project/source files unless the parent explicitly asks for fixes. +- Do not invent facts. If external reference details are needed, fetch/read the source. +- Prefer actionable findings over generic best-practice prose. +- If you make significant discoveries, save them to Engram with project `prowler` before returning. diff --git a/ui/package.json b/ui/package.json index b03d7a55b5..57c3d5345e 100644 --- a/ui/package.json +++ b/ui/package.json @@ -17,6 +17,7 @@ "lint:fix": "eslint . --fix --max-warnings 40", "lint:knip": "knip --max-issues 494", "lint:knip:fix": "knip --fix --max-issues 494", + "setup:hooks": "node scripts/setup-git-hooks.js", "start": "next start", "start:standalone": "node .next/standalone/server.js", "test": "vitest run", diff --git a/ui/scripts/postinstall.js b/ui/scripts/postinstall.js index ea46e57098..4d55404a79 100644 --- a/ui/scripts/postinstall.js +++ b/ui/scripts/postinstall.js @@ -5,7 +5,11 @@ * * This script runs after npm install to: * 1. Update dependency log (if the script exists) - * 2. Setup git hooks (if the script exists) + * 2. Harden the MSW service worker when present + * + * Git hook installation is intentionally opt-in because postinstall runs during + * normal package installs and should not mutate shared git hook state unless the + * developer asked for onboarding setup. */ const fs = require("fs"); @@ -89,5 +93,10 @@ runScriptIfExists("./update-dependency-log.js", "deps:log"); // Keep this before setup-git-hooks because that script can exit the process. hardenMswServiceWorker(); -// Run git hooks setup -runScriptIfExists("./setup-git-hooks.js", "setup-git-hooks"); +if (process.env.PROWLER_UI_SETUP_GIT_HOOKS === "1") { + runScriptIfExists("./setup-git-hooks.js", "setup-git-hooks"); +} else { + console.log( + "Skip git hooks setup (run `pnpm run setup:hooks` or set PROWLER_UI_SETUP_GIT_HOOKS=1 to opt in)", + ); +}