You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Refactors the GitHub Actions workflow to follow the principle of least privilege and improve security isolation:
Permission scoping: Changes from permissions: write-all to permissions: {} at the workflow level, with each job explicitly declaring only the permissions it needs (contents: read for build, contents: write + pull-requests: write for publish).
Job separation: Splits the build and publish jobs so that the token with write access to the repository never runs on the same runner as third-party build tooling. Build output is passed via artifact upload/download.
Build hardening:
Adds persist-credentials: false to checkout to prevent build scripts from accessing push credentials
Installs dependencies with npm ci --ignore-scripts to block lifecycle hooks from untrusted packages
Explicitly runs the injected workspace's postinstall script (copy-sjcl) after install
Updates cache key to reflect the --ignore-scripts behavior
Artifact handling: Packages build output as a tarball to ensure consistent layout and efficient transfer between jobs.
Branch filtering: Adds dependabot/** branches to the trigger list with a comment explaining the security rationale (dependency bumps are where third-party code enters the repo).
Cleanup job: Adds explicit permissions: contents: write to the cleanup job.
These changes reduce the attack surface by ensuring that if build tooling is compromised, it cannot push code or modify the repository.
Testing Steps
CI workflow runs successfully on push to main, releases, and dependabot branches
Build job completes and uploads artifact
Publish job downloads artifact and creates/pushes build branch as before
Cleanup job runs on branch deletion
Checklist
This change was covered by a tech design (security hardening)
I have tested this change locally (workflow changes require CI validation)
Medium Risk
Changes CI security boundaries and artifact handoff for pr-releases publishing; behavior should match prior flows but misconfiguration could break PR build branches or leave publish credentials on build runners.
Overview Hardens build-branch.yml by replacing workflow-wide write-all with per-job permissions, splitting build and publish onto separate runners, and tightening how dependencies and artifacts are handled.
The build job now checks out with persist-credentials: false, installs via npm ci --ignore-scripts (with an explicit copy-sjcl step for injected), bumps the cache key for that install mode, and uploads a single build-output.tar.gz artifact (short retention) instead of pushing from the same job.
A new publish job downloads that tarball, unpacks it, and runs the existing push-to-pr-releases/<branch> and PR annotation logic with only contents: write and pull-requests: write. Dependabot branches are added to branches-ignore so third-party dependency bumps do not run alongside a write-capable publish path. clean_up explicitly requests contents: write.
CONTRIBUTING.md renames the workflow to build-branch.yml, documents the dependabot exclusion, and notes testing Dependabot bumps via normal CI or local builds instead.
Reviewed by Cursor Bugbot for commit 7900d59. Bugbot is set up for automated code reviews on this repo. Configure here.
The Build Release Branch workflow declared `permissions: write-all` and ran
`npm ci` on every push to a non-main branch. Dependabot pushes trigger it
(534 runs to date), so third-party install scripts executed on a runner
holding a repo-write GITHUB_TOKEN — the default read-only boundary for
Dependabot-triggered runs was explicitly overridden.
Three layers, each independently sufficient for the Dependabot path:
- Exclude `dependabot/**` from the push trigger. Dependency bumps do not
need a build preview branch, and this removes untrusted code from the
privileged workflow outright.
- Replace `write-all` with per-job least privilege: `contents: read` to
build, `contents: write` + `pull-requests: write` to publish and clean up.
Checkout in the build job no longer persists credentials.
- Split build from publish. The build job produces a tarball; the publish
job downloads it and pushes without ever invoking npm, so the writable
token and the build tooling never share a runner.
Install is now `npm ci --ignore-scripts`. Only three packages in the tree
declare an install script: `injected` (ours — its `copy-sjcl` postinstall
now runs as an explicit step), `esbuild` (resolves its platform binary at
runtime) and `fsevents` (macOS-only, optional; the runner is ubuntu).
The node_modules cache key gains a `noscripts` segment so this tree is not
restored by workflows that do run install scripts.
Note this bounds token abuse, not artifact tampering: the build job can
still influence its own output. Excluding Dependabot is what addresses the
reported path.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Y5t5ARFHhq3V9kG7GHs7xM
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Scope: This PR modifies only .github/workflows/build-branch.yml (CI/CD supply-chain hardening). No files under injected/, messaging/, or special-pages/ runtime paths are changed.
Web Compatibility Assessment
No findings.
This workflow change does not alter injected script bundles, feature initialization, API overrides, DOM interaction, or platform entry points. There is zero user-facing web compatibility surface in this diff.
Security Assessment
No injected-runtime findings.
The diff does not touch captured-globals.js, messaging transports, the message bridge, wrapper-utils.js, DDGProxy, feature code, or remote config. None of the injected-script threat models apply.
CI supply-chain observations (informational, not injected-runtime risks):
File
Lines
Severity
Note
.github/workflows/build-branch.yml
15–16, 23–24, 91–93, 298–299
info
Least-privilege permissions: {} default with per-job opt-in (contents: read for build, contents: write + pull-requests: write for publish/clean_up) is a solid hardening pattern.
.github/workflows/build-branch.yml
29–32
info
persist-credentials: false on the build job correctly prevents a write-capable token from persisting while third-party tooling runs.
.github/workflows/build-branch.yml
51–63
info
npm ci --ignore-scripts with an explicit copy-sjcl step blocks arbitrary dependency postinstall hooks. The three hasInstallScript packages (injected, esbuild, fsevents) are accounted for; esbuild resolves its platform binary at runtime on Linux.
.github/workflows/build-branch.yml
86–107
info
Splitting build and publish jobs so contents: write never shares a runner with npm ci/build tooling is the core security win of this PR. The publish job only unpacks a workflow artifact and runs git/gh-script — no dependency install.
.github/workflows/build-branch.yml
9–12
info
Ignoring dependabot/** prevents dependency-bump branches from triggering a job that eventually holds write credentials. Trade-off: Dependabot PRs will not receive pr-releases/ build branches until merged/rebased onto a non-ignored branch.
.github/workflows/build-branch.yml
49, 59–63
info
Cache key bump (noscripts) correctly invalidates stale node_modules caches from the pre---ignore-scripts era. On cache hit, copy-sjcl is skipped but the committed injected/lib/sjcl.js satisfies the build — same behavior as the prior workflow on cache hit.
Risk Level
Low Risk — CI workflow hardening only; no injected runtime code, API overrides, messaging, or security-sensitive browser-facing changes.
Recommendations
No injected-runtime action required. Safe to merge from a C-S-S web-compat/security perspective.
(info) Consider documenting in CONTRIBUTING.md that Dependabot PRs intentionally skip pr-releases/ build branches due to the supply-chain separation, so reviewers know to test Dependabot bumps via the main CI workflow or local builds.
(info) If injected/scripts/generateSJCL.js changes without a lockfile bump, cache-hit builds will use the committed lib/sjcl.js rather than regenerating — pre-existing behavior, but worth keeping in mind when reviewing SJCL-related changes.
The workflow change made the CONTRIBUTING.md exclusion list inaccurate.
Add `dependabot/*` and explain why those branches are skipped.
Also corrects two references to `build-pr.yml`, which does not exist —
the workflow is `build-branch.yml`.
Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01Y5t5ARFHhq3V9kG7GHs7xM
The reason will be displayed to describe this comment to others. Learn more.
Injected PR Evaluation: Web Compatibility & Security
Assessed at:7900d591 (synchronize) — delta since prior review is CONTRIBUTING.md documentation only.
Web Compatibility Assessment
No findings.
This PR touches only .github/workflows/build-branch.yml and CONTRIBUTING.md. There are no changes under injected/, messaging/, special-pages/, or platform entry points. None of the web-compatibility evaluation categories (API surface fidelity, prototype chain integrity, DOM interaction, timing, platform-specific breakage, third-party script compatibility) apply.
Security Assessment
No injected-runtime security findings.
The changed files are CI/CD infrastructure and contributor documentation — outside the page-injection threat model. The workflow changes are supply-chain hardening (positive security posture), not regressions:
File
Lines
Severity
Notes
.github/workflows/build-branch.yml
15–16, 23–24, 29–32
info
Workflow-level permissions: {} with per-job least-privilege (contents: read for build, contents: write + pull-requests: write for publish/clean_up).
.github/workflows/build-branch.yml
86–107
info
Build/publish job split via artifact handoff — publish runner never executes third-party npm ci tooling, isolating the contents: write token.
.github/workflows/build-branch.yml
29–32, 57
info
persist-credentials: false on build checkout + npm ci --ignore-scripts blocks lifecycle-hook execution during dependency install.
.github/workflows/build-branch.yml
59–63
info
Explicit npm run copy-sjcl -w injected re-runs the one required postinstall script after --ignore-scripts.
.github/workflows/build-branch.yml
9–12
info
dependabot/** excluded from push trigger — prevents auto-publishing build branches from dependency-bump PRs that introduce third-party code.
CONTRIBUTING.md
116, 139, 149
info
Documents the Dependabot exclusion and corrects workflow filename reference (build-branch.yml). No runtime impact.
Info — cache key bump (noscripts): Line 49 invalidates cached node_modules from pre---ignore-scripts installs. Correct hygiene; no security concern.
Info — SJCL on cache hit:Generate SJCL bundle (lines 59–63) is gated on cache miss. A warm cache from a prior successful run already contains the generated bundle; no gap identified.
Risk Level
Low Risk — CI/CD workflow hardening and contributor documentation only; zero injected-runtime, messaging, or special-pages code changes.
Recommendations
No blocking items. Optional follow-ups (CI hygiene, not injected-security):
Verify end-to-end — Confirm a non-Dependabot feature-branch push still produces a pr-releases/<branch> artifact and PR comment after the build/publish split.
Monitor first cache miss — After merge, watch one cold-cache run to confirm copy-sjcl + npm run build succeed under --ignore-scripts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
semver-patchBug fix / internal — no release needed
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Description
Refactors the GitHub Actions workflow to follow the principle of least privilege and improve security isolation:
Permission scoping: Changes from
permissions: write-alltopermissions: {}at the workflow level, with each job explicitly declaring only the permissions it needs (contents: readfor build,contents: write+pull-requests: writefor publish).Job separation: Splits the
buildandpublishjobs so that the token with write access to the repository never runs on the same runner as third-party build tooling. Build output is passed via artifact upload/download.Build hardening:
persist-credentials: falseto checkout to prevent build scripts from accessing push credentialsnpm ci --ignore-scriptsto block lifecycle hooks from untrusted packagesinjectedworkspace's postinstall script (copy-sjcl) after install--ignore-scriptsbehaviorArtifact handling: Packages build output as a tarball to ensure consistent layout and efficient transfer between jobs.
Branch filtering: Adds
dependabot/**branches to the trigger list with a comment explaining the security rationale (dependency bumps are where third-party code enters the repo).Cleanup job: Adds explicit
permissions: contents: writeto the cleanup job.These changes reduce the attack surface by ensuring that if build tooling is compromised, it cannot push code or modify the repository.
Testing Steps
Checklist
https://claude.ai/code/session_01Y5t5ARFHhq3V9kG7GHs7xM
Note
Medium Risk
Changes CI security boundaries and artifact handoff for
pr-releasespublishing; behavior should match prior flows but misconfiguration could break PR build branches or leave publish credentials on build runners.Overview
Hardens
build-branch.ymlby replacing workflow-widewrite-allwith per-job permissions, splitting build and publish onto separate runners, and tightening how dependencies and artifacts are handled.The build job now checks out with
persist-credentials: false, installs vianpm ci --ignore-scripts(with an explicitcopy-sjclstep forinjected), bumps the cache key for that install mode, and uploads a singlebuild-output.tar.gzartifact (short retention) instead of pushing from the same job.A new publish job downloads that tarball, unpacks it, and runs the existing push-to-
pr-releases/<branch>and PR annotation logic with onlycontents: writeandpull-requests: write. Dependabot branches are added tobranches-ignoreso third-party dependency bumps do not run alongside a write-capable publish path. clean_up explicitly requestscontents: write.CONTRIBUTING.md renames the workflow to
build-branch.yml, documents the dependabot exclusion, and notes testing Dependabot bumps via normal CI or local builds instead.Reviewed by Cursor Bugbot for commit 7900d59. Bugbot is set up for automated code reviews on this repo. Configure here.