From 44b5c9e88dd3152de71cf89a70ab7b1fabbe0214 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Fri, 31 Jul 2026 02:32:27 -0700 Subject: [PATCH] docs(ci): record why the escalation job's setup-node scan finding was dismissed A scanner flagged actions/setup-node in the escalate-persistent-failure job (#10146) as a filesystem-read risk, citing __tests__/authutil.test.ts. That is a test fixture inside setup-node's own repository, not runtime behaviour, and the feature it exercises -- writing an auth token into .npmrc -- only engages when `registry-url` is supplied. It is supplied in the five publish-*.yml workflows and deliberately not here, so the path is inert in this job. The pin is also the same SHA as all 32 other setup-node uses in the repo, including build-boot in this same file, so the job introduced no dependency that was not already present. No behaviour change -- the finding was reviewed and dismissed, and the reason is recorded here so the next scan does not cost another investigation. The note names the condition that would invalidate it (this step gaining registry-url) rather than dismissing the rule outright. --- .github/workflows/selfhost.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/selfhost.yml b/.github/workflows/selfhost.yml index 0299c45b5..763f7ba8f 100644 --- a/.github/workflows/selfhost.yml +++ b/.github/workflows/selfhost.yml @@ -195,6 +195,15 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false + # Needed only for `node --experimental-strip-types` below (the escalation is a .ts script), and pinned to + # the same SHA as the other 32 setup-node uses in this repo -- including build-boot above -- so this job + # adds no dependency that was not already here. + # + # A scanner flagged this as a filesystem-read risk, citing `__tests__/authutil.test.ts` in setup-node's + # own repository. That is a test fixture, not runtime behaviour, and the feature it covers -- writing an + # auth token into .npmrc -- only engages when `registry-url` is supplied. It is supplied in the five + # publish-*.yml workflows and deliberately not here, so that path is inert in this job. Reviewed and + # dismissed rather than silenced; re-check if this step ever gains `registry-url`. - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version-file: .nvmrc