chore: define install-script policy#252
Conversation
|
@codex review Please review exact head f6abf1034cf7d87aba1b6fe8bb9f60e5ea8d0d32. Focus on npm 12 allowScripts semantics, the script-free Sharp 0.35.3 update, explicit Puppeteer denial, negative mutations, and Node 20 compatibility. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f6abf10f1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
npm v12 の install-script policy に合わせて、依存関係の install script 承認/拒否を package.json#allowScripts と契約テストで明示し、Book QA / test:light に組み込むPRです。あわせて Sharp を script-free なバージョンへ更新し、audit 脆弱性の解消を狙っています。
Changes:
allowScripts（Puppeteer install script の明示 deny）と install-script policy 契約チェック（self-test/negative mutation 付き）を追加test:lightと Book QA workflow に install-script policy 契約チェックを組み込み- Sharp を
0.35.3に更新し、lockfile/overrides を再解決（audit high を解消）
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| scripts/check-install-script-policy.js | install-script policy の契約チェック + self-test を新規追加 |
| package.json | allowScripts 追加、Sharp 更新、契約チェックを test:light に組み込み、overrides 更新 |
| package-lock.json | Sharp/依存の解決更新（install script 状態の反映含む） |
| .github/workflows/book-qa.yml | ルート lock のキャッシュ対象化 + install-script policy 契約チェックを追加 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@codex review 再レビュー対象 head: 既存5スレッドは全件確認し、4件は修正、allowScriptsに関する1件は npm 12.0.1 の実測と npm 公式仕様に基づき変更不要理由を返信して解決しました。特に install script package 集合の完全一致、Node.js engine 契約、negative fixture を再確認してください。 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ad0ea37a53
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review 再レビュー対象 head: 最新P1に対応し、npm 12.0.1のpackageManager固定、Node実要件、Book QAでのnpm固定・assert、契約self-testを追加しました。既存threadはすべて解決済みです。install-script policyが実行時にも固定されることと、CI/toolchain整合を再確認してください。 |
|
CI failure対応:
admin bypassは使用していません。 |
|
@codex review Re-review exact head |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
概要
before / after
npm公式方針: https://docs.npmjs.com/cli/commands/npm-install-scripts/
検証
managed Faraday warning
actions/jekyll-build-pages:v1.0.13は固定Gemfileでgithub-pages=232を使用し、repository Gemfileはbundle check --dry-runにだけ使います。build本体のOctokit/Faraday bundleはrepositoryから変更できないため、本PRではwarning filterや効果のないfaraday-retry追記を行いません。
Rollback
本PRのsquash commitをrevertし、package / lock / policy contractを一体で戻します。
Closes #235