From 64d0a0e9d01b552967a920dd9dfe22f2f4f033a7 Mon Sep 17 00:00:00 2001 From: Vanshika Verma Date: Mon, 24 Aug 2026 18:11:11 +0530 Subject: [PATCH 1/3] ci: integrate SafeDep PMG into GitHub Actions workflows Route package installs through PMG's persistent proxy to block malicious packages in CI. Added to both jobs in ci.yml (test, publish): - permissions: contents: read - safedep/pmg@v1 in server-mode after checkout - pmg proxy stop --fail-on-violation (if: always()) as final step Uses secrets PMG_PUBLIC_REPOS_TOKEN (api-key) and PMG_TENANT_ID (tenant-id). --- .github/workflows/ci.yml | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 23d629f3..75a78bab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,10 +13,19 @@ jobs: test: name: Run tests and publish test coverage runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@v2 + # Start PMG in server mode + - uses: safedep/pmg@v1 + with: + server-mode: true + api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} + tenant-id: ${{ secrets.PMG_TENANT_ID }} + - name: Set up Java JDK uses: actions/setup-java@v2 with: @@ -34,13 +43,28 @@ jobs: with: fail_ci_if_error: false verbose: true - + + # Enforce the result and flush events + - name: Stop proxy + if: always() + run: pmg proxy stop --fail-on-violation + publish: if: startsWith(github.ref, 'refs/tags/v') needs: test runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v2 + + # Start PMG in server mode + - uses: safedep/pmg@v1 + with: + server-mode: true + api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} + tenant-id: ${{ secrets.PMG_TENANT_ID }} + - name: Set up Maven Central Repository uses: actions/setup-java@v2 with: @@ -60,3 +84,8 @@ jobs: env: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }} + + # Enforce the result and flush events + - name: Stop proxy + if: always() + run: pmg proxy stop --fail-on-violation From 3e6b17881de66ca10f413c9e01c601e6f1776031 Mon Sep 17 00:00:00 2001 From: Vanshika Verma Date: Wed, 26 Aug 2026 01:49:31 +0530 Subject: [PATCH 2/3] Align PMG integration with the agreed standard Brings this repo onto the same integration used in ai-playbook and i18nify, with the enforcement fix from blade. - Setup step renamed to "Setup PMG proxy" and given `id: pmg-setup`, so the enforce step can tell whether setup actually ran. - Enforce step runs `--fail-on-violation` only when setup succeeded. With a bare `if: always()`, any failure before the PMG step makes GitHub skip setup while still running enforce, which then dies with `pmg: command not found` (exit 127) and buries the real error. - Removed additions that are not part of the reference integration: `permissions:` blocks, workflow comments, pinned action SHAs and non-standard step names. - Added pmg-test.yml, byte-identical to the copy in ai-playbook and i18nify, which demonstrates the proxy blocking a known-malicious package and syncing the event to SafeDep Cloud. The workflow files are now the master versions plus the two PMG steps and nothing else: 34 lines added, none removed or modified. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 37 ++++++++++++--------- .github/workflows/pmg-test.yml | 60 ++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/pmg-test.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75a78bab..8bc2370c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,14 +13,13 @@ jobs: test: name: Run tests and publish test coverage runs-on: ubuntu-latest - permissions: - contents: read steps: - name: Checkout code uses: actions/checkout@v2 - # Start PMG in server mode - - uses: safedep/pmg@v1 + - name: Setup PMG proxy + id: pmg-setup + uses: safedep/pmg@v1 with: server-mode: true api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} @@ -44,27 +43,29 @@ jobs: fail_ci_if_error: false verbose: true - # Enforce the result and flush events - - name: Stop proxy + - name: Enforce PMG policy if: always() - run: pmg proxy stop --fail-on-violation - + run: | + if [ "${{ steps.pmg-setup.outcome }}" = "success" ]; then + pmg proxy stop --fail-on-violation + else + pmg proxy stop || true + fi + publish: if: startsWith(github.ref, 'refs/tags/v') needs: test runs-on: ubuntu-latest - permissions: - contents: read steps: - uses: actions/checkout@v2 - # Start PMG in server mode - - uses: safedep/pmg@v1 + - name: Setup PMG proxy + id: pmg-setup + uses: safedep/pmg@v1 with: server-mode: true api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} tenant-id: ${{ secrets.PMG_TENANT_ID }} - - name: Set up Maven Central Repository uses: actions/setup-java@v2 with: @@ -85,7 +86,11 @@ jobs: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }} - # Enforce the result and flush events - - name: Stop proxy + - name: Enforce PMG policy if: always() - run: pmg proxy stop --fail-on-violation + run: | + if [ "${{ steps.pmg-setup.outcome }}" = "success" ]; then + pmg proxy stop --fail-on-violation + else + pmg proxy stop || true + fi diff --git a/.github/workflows/pmg-test.yml b/.github/workflows/pmg-test.yml new file mode 100644 index 00000000..664eebfe --- /dev/null +++ b/.github/workflows/pmg-test.yml @@ -0,0 +1,60 @@ +name: PMG Proxy Test + +on: + workflow_dispatch: + pull_request: + push: + +jobs: + test-pmg-allows-clean-install: + name: PMG - Clean package should not be blocked + runs-on: ubuntu-latest + steps: + - name: Setup PMG proxy + uses: safedep/pmg@v1 + with: + server-mode: true + api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} + tenant-id: ${{ secrets.PMG_TENANT_ID }} + + - name: Install npm via nvm + run: | + curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash + export NVM_DIR="$HOME/.nvm" + [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" + nvm install 20 + echo "$NVM_DIR/versions/node/$(nvm version 20)/bin" >> $GITHUB_PATH + + - name: Install clean package (should succeed) + run: npm install lodash + + - name: Enforce PMG policy + if: always() + run: pmg proxy stop --fail-on-violation + + test-pmg-blocks-malicious-package: + name: PMG - Malicious package should be blocked + runs-on: ubuntu-latest + steps: + - name: Setup PMG proxy + uses: safedep/pmg@v1 + with: + server-mode: true + api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} + tenant-id: ${{ secrets.PMG_TENANT_ID }} + + - name: Install npm via nvm + run: | + curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash + export NVM_DIR="$HOME/.nvm" + [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" + nvm install 20 + echo "$NVM_DIR/versions/node/$(nvm version 20)/bin" >> $GITHUB_PATH + + - name: Install flagged test package (PMG should block this) + continue-on-error: true + run: npm install --no-cache --prefer-online safedep-test-pkg@0.1.3 + + - name: Enforce PMG policy (expect failure — violation recorded) + if: always() + run: pmg proxy stop --fail-on-violation From 821dded1870f5224507ebcbb6e8964753435cabb Mon Sep 17 00:00:00 2001 From: Vanshika Verma Date: Fri, 28 Aug 2026 14:53:02 +0530 Subject: [PATCH 3/3] Remove pmg-test.yml PMG validation workflow pmg-test.yml was added alongside the PMG integration purely to prove the proxy behaves correctly inside this repository's own CI environment. It ran two jobs: one installing a known-clean package to confirm PMG does not block legitimate traffic, and one installing the deliberately-flagged safedep-test-pkg@0.1.3 to confirm the block is caught and `pmg proxy stop --fail-on-violation` fails the job as intended. That validation is now complete across every repository in this rollout, so the workflow has served its purpose. Leaving it in place would mean a permanent CI job that installs a deliberately-flagged package on every push and pull request - burning runner time and producing a red check that is expected-to-fail, which is exactly the kind of noise that trains people to ignore CI signal. The PMG integration itself is untouched. The safedep/pmg setup steps and the `pmg proxy stop --fail-on-violation` enforcement steps in this repository's real build and test workflows remain exactly as they were. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/pmg-test.yml | 60 ---------------------------------- 1 file changed, 60 deletions(-) delete mode 100644 .github/workflows/pmg-test.yml diff --git a/.github/workflows/pmg-test.yml b/.github/workflows/pmg-test.yml deleted file mode 100644 index 664eebfe..00000000 --- a/.github/workflows/pmg-test.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: PMG Proxy Test - -on: - workflow_dispatch: - pull_request: - push: - -jobs: - test-pmg-allows-clean-install: - name: PMG - Clean package should not be blocked - runs-on: ubuntu-latest - steps: - - name: Setup PMG proxy - uses: safedep/pmg@v1 - with: - server-mode: true - api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} - tenant-id: ${{ secrets.PMG_TENANT_ID }} - - - name: Install npm via nvm - run: | - curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash - export NVM_DIR="$HOME/.nvm" - [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" - nvm install 20 - echo "$NVM_DIR/versions/node/$(nvm version 20)/bin" >> $GITHUB_PATH - - - name: Install clean package (should succeed) - run: npm install lodash - - - name: Enforce PMG policy - if: always() - run: pmg proxy stop --fail-on-violation - - test-pmg-blocks-malicious-package: - name: PMG - Malicious package should be blocked - runs-on: ubuntu-latest - steps: - - name: Setup PMG proxy - uses: safedep/pmg@v1 - with: - server-mode: true - api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }} - tenant-id: ${{ secrets.PMG_TENANT_ID }} - - - name: Install npm via nvm - run: | - curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash - export NVM_DIR="$HOME/.nvm" - [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" - nvm install 20 - echo "$NVM_DIR/versions/node/$(nvm version 20)/bin" >> $GITHUB_PATH - - - name: Install flagged test package (PMG should block this) - continue-on-error: true - run: npm install --no-cache --prefer-online safedep-test-pkg@0.1.3 - - - name: Enforce PMG policy (expect failure — violation recorded) - if: always() - run: pmg proxy stop --fail-on-violation