chore(ci): supply-chain minimum-release-age gate + Renovate onboarding - #421
Merged
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
abbaseya
force-pushed
the
chore/supply-chain-age-gate
branch
from
July 22, 2026 23:45
5dec0b3 to
f83b52d
Compare
abbaseya
marked this pull request as draft
July 22, 2026 23:57
…e qa install Supply-chain hardening (Asana 1216667157595351): - .yarnrc.yml: npmMinimalAgeGate 4320 (3 days) + npmPreapprovedPackages @convertcom/* — Yarn refuses to install a dependency version younger than 3 days (the smash-and-grab filter), exempting our internal scope. - qa.yml: freeze the dependency install (yarn -> yarn install --immutable) so CI installs strictly from the committed lockfile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
abbaseya
force-pushed
the
chore/supply-chain-age-gate
branch
from
July 24, 2026 15:26
f83b52d to
26f295e
Compare
abbaseya
marked this pull request as ready for review
July 24, 2026 15:28
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
JosephSamirL
approved these changes
Jul 27, 2026
|
|
nice!!!! |
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Onboards
javascript-sdkto the shared supply-chain controls inconvertcom/supply-chain— thereference PR for the pattern being rolled out to the tracking script, the
Shopify app, and all six FullStack SDKs.
Two files:
renovate.json— extends the shared Renovate preset (minimumReleaseAge: 3 days,@convertcom/*exempt, GitHub Action SHA-pinning + maintenance)..github/workflows/dep-age-check.yml— runs the shared composite age gate on every PR.Why
Enforce a minimum release age wherever we install dependencies, to blunt
smash-and-grab supply-chain attacks (Claudiu's
#developersask · Asana1216667157595351). Two complementary layers:dep-age-checkfails any PR that adds a lockfile dependency younger than 72h (the per-PR side), so a fresh dep can't be merged regardless of who added it. It reads the committed lockfile at PR time, so it always reflects currentmain.Rollout
mode: warn) — reports but does not block, for a short bake.main, flips tomode: block+dep-age-checkbecomes a required status check.convertcom/supply-chain@1e6559c), per our own pinning policy; Renovate keeps it current.Notes
@convertcom/*is exempt everywhere, so our internal release chain never stalls on its own freshly-published packages.🤖 Generated with Claude Code