chore: prepare v3.0.0-rc.1 - #157
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Review — no high-confidence vulnerabilities found
This PR is a net security improvement to the release pipeline. All changes reviewed against the threat model (injection, authz bypass, secrets handling, supply chain, SSRF/XSS).
Positive changes
| Change | Benefit |
|---|---|
contents: write → contents: read |
Least-privilege; the workflow cannot push/force-push to the repo even if the job is compromised. |
pnpm install --frozen-lockfile |
Prevents lockfile drift; a tampered or floating dep can no longer silently land in a release build. |
actions/upload-artifact pinned to commit SHA (ea165f8d…) |
Tag-mutable supply chain attack eliminated; the exact code is fixed at pin time. |
${{ github.event.release.tag_name }} moved from direct shell interpolation to env: block |
Eliminates the command-injection vector present in the old run: step where a tag containing shell metacharacters (e.g. a tag named v1.0.0`curl evil`) could execute arbitrary commands in the runner. The new pattern safely passes the value as an environment variable. |
set -euo pipefail added throughout |
Prevents silent failures from masking errors mid-script; reduces the risk of a partially-failed publish going undetected. |
Low-risk observations (no remediation required)
-
GITHUB_PRERELEASEenv var name — TheGITHUB_prefix is reserved by GitHub for system-provided variables. Renaming toIS_PRERELEASEorRELEASE_IS_PRERELEASEavoids any risk of shadowing a future GitHub-added variable. Not a current security issue. -
@btst/codegenversion not validated against the release tag — Only@btst/stackis checked against the git tag version. An accidental mismatch in the codegen package version would still publish. This is a correctness gap, not a security vulnerability. -
Integrity check is non-empty only —
STACK_INTEGRITYandCODEGEN_INTEGRITYare checked for non-empty but not cross-referenced against a known-good digest. This is inherent to the publish-then-verify pattern and cannot be meaningfully tightened without a separate SLSA attestation step; the existing--provenanceflag already addresses this at the npm level.
Verdict
No vulnerabilities. The command-injection risk from the previous version of this workflow is fully addressed. The permission reduction and lockfile enforcement are meaningful supply-chain hardening. The remaining observations are cosmetic or out of scope for this PR.
Sent by Cursor Automation: Find vulnerabilities
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f2266e64e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { | ||
| "name": "@btst/codegen", | ||
| "version": "0.1.3", | ||
| "version": "0.2.0-rc.1", |
There was a problem hiding this comment.
When someone runs npx @btst/codegen@next init in a fresh project while latest still points to v2, this RC's installInitDependencies installs the bare spec @btst/stack (packages/cli/src/utils/package-installer.ts:37-45). npm's bundled npm-install documentation states that a bare <name> uses the latest tag, so the v3-generated templates are paired with the stable v2 stack rather than 3.0.0-rc.1 and can fail against the breaking v3 API changes. Make the prerelease CLI install @btst/stack@next or otherwise propagate its release channel.
Useful? React with 👍 / 👎.
|
✅ Shadcn registry validated — no registry changes detected. |
1 participant
Prepares the first v3 release candidate for issue #153.\n\n- makes the release workflow prerelease-aware and publishes both packages under the same npm dist-tag\n- makes publish retries idempotent and verifies versions, integrity metadata, and stable latest\n- sets @btst/stack to 3.0.0-rc.1 and @btst/codegen to 0.2.0-rc.1\n- validated build, typecheck, lint, knip, unit, registry, init smoke, and all three framework E2E suites\n\nThe workflow commit will also be proposed separately to main because GitHub evaluates release-event workflows from the default branch.
Note
Medium Risk
Touches the production npm publish path (dist-tags, skip-if-published, post-publish verification). A tagging or verification bug could publish to the wrong channel or fail a release, but it does not change product runtime code.
Overview
Bumps
@btst/stackto 3.0.0-rc.1 and@btst/codegento 0.2.0-rc.1, and makes the GitHub release workflow safe for prereleases.The workflow now chooses a shared npm dist-tag (
latestvsnext) from hyphenated versions or GitHub prerelease flags, publishes both packages with that tag, and skips already-published versions. After publish it waits for registry consistency, checks integrity metadata, and fails if a prerelease would move@btst/stack@latestoff a stable version. Permissions drop tocontents: read, install uses--frozen-lockfile, and the artifact action is pinned.Reviewed by Cursor Bugbot for commit 5f2266e. Bugbot is set up for automated code reviews on this repo. Configure here.