From 26f295e81786e0d433d3e88c3b2e31b1dfd4374b Mon Sep 17 00:00:00 2001 From: Ahmed Abbas Date: Fri, 24 Jul 2026 18:26:32 +0300 Subject: [PATCH] chore(ci): enforce minimum release age via Yarn's native gate + freeze qa install MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supply-chain hardening (Asana 1216667157595351): - .yarnrc.yml: npmMinimalAgeGate 4320 (3 days) + npmPreapprovedPackages @convertcom/* — Yarn refuses to install a dependency version younger than 3 days (the smash-and-grab filter), exempting our internal scope. - qa.yml: freeze the dependency install (yarn -> yarn install --immutable) so CI installs strictly from the committed lockfile. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/qa.yml | 2 +- .yarnrc.yml | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index e87d5d2e..beab9bb8 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -35,7 +35,7 @@ jobs: corepack prepare yarn@stable --activate - name: Install dependencies - run: yarn + run: yarn install --immutable - name: Install Playwright browsers run: | diff --git a/.yarnrc.yml b/.yarnrc.yml index 3186f3f0..b85605df 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -1 +1,9 @@ nodeLinker: node-modules + +# Supply-chain minimum release age: refuse to install any dependency version +# published less than 3 days ago (smash-and-grab malware is usually yanked +# within hours). Internal @convertcom/* packages are exempt so our own release +# chain never stalls on a freshly-published package. +npmMinimalAgeGate: 4320 +npmPreapprovedPackages: + - "@convertcom/*"