SonarCloud security issues in release workflows
- Dominant language
- No language data
- Stars
- 36
- Forks
- 91
- PR merge metrics
- No merged PRs in 30d
Description
SonarCloud reports multiple security issues in the release workflows related to package installation and execution.
Files:
`.github/workflows/if-nodejs-release.yml`
`.github/workflows/release-announcements.yml`
Proposed Changes:
- Add --ignore-scripts to the npm install command.
- Replace the npx command with a safer package execution method.
- Define the exact package version in `.github/workflows/release-announcements.yml` to avoid installing unverified releases.
References these [issues](https://sonarcloud.io/project/issues?s=IMPACT_RANK&severities=BLOCKER%2CCRITICAL%2CMAJOR%2CMINOR&sinceLeakPeriod=true&issueStatuses=OPEN%2CCONFIRMED&types=VULNERABILITY&id=asyncapi_asyncapi-react)
Tagging @AceTheCreator for review
Contributor guide
Research direction
Start by reviewing .github/workflows/if-nodejs-release.yml and .github/workflows/release-announcements.yml, then inspect the linked SonarCloud findings for the affected install and execution commands. Apply the requested workflow hardening, including the exact package version, and verify that both release workflows remain valid and that the reported security issues are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- ci-cd, release, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 75/100