From 0ad180b85f4b1540b16f6c8bc37844d6f0df3029 Mon Sep 17 00:00:00 2001 From: Dotta <34892728+cryppadotta@users.noreply.github.com> Date: Thu, 3 Sep 2026 19:47:46 -0500 Subject: [PATCH] ci(runner): skip bootstrap registry telemetry (#12797) ## Thinking Path Every trusted PR and paid-workflow job invokes the pinned pnpm setup action. Its internal npm install is currently waiting four to seven minutes on npm audit telemetry before any Paperclip or provider code runs. Audit, funding, and update notifications are not integrity controls for this action; its committed lockfile still verifies installed package bytes. ## What Changed - disable npm audit, funding, and update-notifier telemetry narrowly on all seven pinned setup steps in each of the trusted PR and full-stack workflows - add a workflow security contract proving every setup invocation remains covered and the overrides do not leak elsewhere ## Verification - focused workflow security tests: 6/6 passed - Prettier and git diff checks passed - observed unhealthy setup: 4-7+ minutes; historical healthy setup: about four seconds ## Risks This skips npm vulnerability-report telemetry for the setup action bootstrap only. Repository dependency checks, lockfile integrity, provider-secret authorization, and target-lock verification remain unchanged. ## Model Used Codex (GPT-5) --- .github/workflows/pr-trusted.yml | 28 +++++++++++++++++ .github/workflows/runner-full-stack-e2e.yml | 28 +++++++++++++++++ tests/runner-e2e/workflow-security.test.ts | 34 +++++++++++++++++++++ 3 files changed, 90 insertions(+) diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml index 7bd403aa57..a55c7f597e 100644 --- a/.github/workflows/pr-trusted.yml +++ b/.github/workflows/pr-trusted.yml @@ -282,6 +282,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 run_install: false @@ -371,6 +375,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -458,6 +466,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -536,6 +548,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -601,6 +617,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -638,6 +658,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -716,6 +740,10 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml index a4125829d0..b3f9a7cadb 100644 --- a/.github/workflows/runner-full-stack-e2e.yml +++ b/.github/workflows/runner-full-stack-e2e.yml @@ -157,6 +157,10 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -231,6 +235,10 @@ jobs: test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)" = "$EXPECTED_LOCK_SHA256" - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -481,6 +489,10 @@ jobs: test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)" = "$EXPECTED_LOCK_SHA256" - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -601,6 +613,10 @@ jobs: - if: needs.catalog.outputs.needs_remote_provider_pack == 'true' uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -748,6 +764,10 @@ jobs: test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)" = "$EXPECTED_LOCK_SHA256" - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -904,6 +924,10 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 @@ -1008,6 +1032,10 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" with: version: 9.15.4 diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts index e1b7ba02f3..d902142926 100644 --- a/tests/runner-e2e/workflow-security.test.ts +++ b/tests/runner-e2e/workflow-security.test.ts @@ -11,6 +11,40 @@ const buildRemoteProviderPackNeeds = /needs:\s*\[\s*authorize,\s*target_lock,\s*catalog,\s*daytona_image,\s*build_runner_artifacts,?\s*\]/u; describe("public repository paid workflow security", () => { + it("keeps pnpm bootstrap registry telemetry out of trusted workflow setup", async () => { + for (const workflowName of [ + "runner-full-stack-e2e.yml", + "pr-trusted.yml", + ]) { + const workflow = await readFile( + path.join(repositoryRoot, ".github/workflows", workflowName), + "utf8", + ); + const pnpmSetupSteps = workflow + .split(/\n(?= {6}- )/u) + .filter((step) => step.includes("uses: pnpm/action-setup@")); + + expect(pnpmSetupSteps, workflowName).toHaveLength(7); + for (const step of pnpmSetupSteps) { + expect(step, workflowName).toContain('NPM_CONFIG_AUDIT: "false"'); + expect(step, workflowName).toContain('NPM_CONFIG_FUND: "false"'); + expect(step, workflowName).toContain( + 'NPM_CONFIG_UPDATE_NOTIFIER: "false"', + ); + } + for (const variable of [ + "NPM_CONFIG_AUDIT", + "NPM_CONFIG_FUND", + "NPM_CONFIG_UPDATE_NOTIFIER", + ]) { + expect( + workflow.match(new RegExp(`${variable}:`, "gu")), + workflowName, + ).toHaveLength(pnpmSetupSteps.length); + } + } + }); + it("gates every provider-secret job with stable actor IDs", async () => { const workflows = await Promise.all( ["runner-full-stack-e2e.yml", "runner-live-evals.yml", "e2e.yml"].map(