ci: integrate SafeDep PMG malicious-package protection - #484
Open
vanshika-verma-rzp wants to merge 3 commits into
Open
vanshika-verma-rzp wants to merge 3 commits into
vanshika-verma-rzp wants to merge 3 commits into
Conversation
Add SafeDep PMG (safedep/pmg@v1) to every job across all GitHub Actions workflows to block malicious npm/composer/bundler/pip packages before they install on CI runners. Per SafeDep's GitHub Action doc, PMG is placed after each setup-* toolchain step and before install/run steps, with a trailing 'pmg cloud sync' step (if: always()) to flush audit events, and a minimal 'contents: read' permissions block per job. Secrets used: PMG_PUBLIC_REPOS_TOKEN (api-key), PMG_TENANT_ID (tenant-id). Workflows updated (9 jobs, 0 skipped): - NPM_Publish.yml (release) - Ruby_Gem_Publish.yml (release; existing write-all perms left untouched) - scraper.yml (scraper, php, release-notes) - tests.yml (node, php, ruby, go) New: - pmg-test.yml: smoke test asserting PMG blocks the safedep-test-pkg malicious test package on the runner.
Brings this repo onto the same integration used in ai-playbook and i18nify, with the enforcement fix from blade. - Setup step renamed to "Setup PMG proxy" and given `id: pmg-setup`, so the enforce step can tell whether setup actually ran. - Enforce step runs `--fail-on-violation` only when setup succeeded. With a bare `if: always()`, any failure before the PMG step makes GitHub skip setup while still running enforce, which then dies with `pmg: command not found` (exit 127) and buries the real error. - Removed additions that are not part of the reference integration: `permissions:` blocks, workflow comments, pinned action SHAs and non-standard step names. - Added pmg-test.yml, byte-identical to the copy in ai-playbook and i18nify, which demonstrates the proxy blocking a known-malicious package and syncing the event to SafeDep Cloud. The workflow files are now the master versions plus the two PMG steps and nothing else: 135 lines added, none removed or modified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pmg-test.yml was added alongside the PMG integration purely to prove the proxy behaves correctly inside this repository's own CI environment. It ran two jobs: one installing a known-clean package to confirm PMG does not block legitimate traffic, and one installing the deliberately-flagged safedep-test-pkg@0.1.3 to confirm the block is caught and `pmg proxy stop --fail-on-violation` fails the job as intended. That validation is now complete across every repository in this rollout, so the workflow has served its purpose. Leaving it in place would mean a permanent CI job that installs a deliberately-flagged package on every push and pull request - burning runner time and producing a red check that is expected-to-fail, which is exactly the kind of noise that trains people to ignore CI signal. The PMG integration itself is untouched. The safedep/pmg setup steps and the `pmg proxy stop --fail-on-violation` enforcement steps in this repository's real build and test workflows remain exactly as they were. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates SafeDep PMG (
safedep/pmg@v1) into every job across all GitHub Actions workflows to block malicious npm/composer/bundler/pip packages before they install on CI runners.Follows SafeDep's GitHub Action doc step lifecycle, with two intentional deltas:
api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}(instead of the doc'sSAFEDEP_API_KEY)tenant-id: ${{ secrets.PMG_TENANT_ID }}(instead ofSAFEDEP_TENANT_ID)PMG step lifecycle applied per job
uses: safedep/pmg@v1placed after thesetup-*toolchain step, before install/run steps (per doc: shims must land in front of the real toolchains).HTTP_PROXYautomatically).pmg cloud sync --timeout 60swithif: always()to flush audit events.permissions: contents: readblock per job.Coverage — 9/9 jobs, 0 skipped
NPM_Publish.ymlRuby_Gem_Publish.ymlscraper.ymltests.ymlNo reusable-workflow (job-level
uses:) jobs exist, and every runner isubuntu-latest— PMG's only supported platform.New: verification workflow
.github/workflows/pmg-test.yml— a standalone smoke test that asserts PMG blocks thesafedep-test-pkg@0.1.3package (a benign package flagged as malicious in SafeDep's DB for testing). Job fails if the malicious install is not blocked.Notes / caveats
Ruby_Gem_Publish.yml: already hadpermissions: write-all, left untouched (it satisfies PMG'scontents: readneed); this is the one job without a new permissions block, intentionally.bundler-cache: true: setup-ruby runs its cachedbundle installbefore PMG loads (inherent to the doc's placement rule). PMG still covers the explicitbundle install/gem build/gem pushsteps that follow.goandrelease-notesjobs don't install packages on the runner, so PMG is effectively a no-op there — added anyway for uniform coverage. Harmless.Action required before merge
Add repo secrets under Settings → Secrets → Actions:
PMG_PUBLIC_REPOS_TOKENPMG_TENANT_ID(Without them PMG still blocks malware + applies cooldown; only cloud audit sync becomes a no-op.)
Verification
actionlint: no warnings on any PMG line (pre-existing warnings on old action pins are untouched)Discussion thread: Slack