o1-labs / o1-labs/Archive-Node-API
P1: Supply chain — container image scan + tighten audit gate (Dependabot/audit/SBOM landed in #192)
Open
Nobody has claimed this yet.
enhancement
P1
production-readiness
- Dominant language
- TypeScript
- Stars
- 19
- Forks
- 9
- Avg merge
- 14h 20m
- Merged PRs (30d)
- 8
Description
Problem
No supply-chain controls: there is no dependabot.yml, no npm audit gate in CI, no container image scanning (Trivy/Grype), and no SBOM.
Proposal
- Add Dependabot for npm + GitHub Actions.
- Add an
npm audit(or equivalent SCA) gate to CI. - Scan the built image (Trivy/Grype) in CI.
- Generate and publish an SBOM with releases.
Acceptance
- Dependency and image vulnerabilities are surfaced in CI; SBOM ships with releases.
Part of #163.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the repository's CI workflows, dependency configuration, container-image build, and release process. Determine where dependency and image scanning can run and how release artifacts are published. Done means CI surfaces dependency and image vulnerabilities and an SBOM ships with releases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- ci-cd, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100