deps: name autoblog by its tarball, so Dependabot cannot resolve it over SSH - #183
Merged
Conversation
…ver SSH
Every Dependabot pull request on this repo failed, and none of them failed for
anything they changed. `pnpm install` died before a test ran, which is why Lint
& Type Check, Run Tests and Security Audit all went red together:
git clone git@github.com:profullstack/autoblog.git
fatal: Could not read from remote repository. (exit 128)
The dependency was written as `github:profullstack/autoblog#75e54af`, a
shorthand pnpm may resolve either way. On master it had resolved to
codeload.github.com over anonymous HTTPS, which a runner can fetch; when
Dependabot regenerated the lockfile it re-resolved the same shorthand as a git
clone over SSH, which a runner cannot do — there is no key for git@github.com on
a GitHub Actions box, and there is no reason for one, because the repository is
public.
So the shorthand goes. Naming the tarball leaves nothing to re-resolve: the
specifier is now the URL that was working, and any future lockfile regeneration
produces the same thing rather than a coin flip. The resolved commit is
unchanged at 75e54af, and there is no longer a single git@github.com anywhere in
pnpm-lock.yaml.
Verified: the tarball answers 200 to an unauthenticated request, and
`pnpm install --frozen-lockfile` completes with @profullstack/autoblog installed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan106 finding(s) HIGH/CRITICAL: 13 | MEDIUM: 32 | LOW: 61
…and 56 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every Dependabot PR on this repo is failing, and none of them fail for anything they changed.
pnpm installdies before a test runs, which is why Lint & Type Check, Run Tests and Security Audit all go red together on #181 and #182:Why master is green and the Dependabot branches are not
package.jsonsaid"@profullstack/autoblog": "github:profullstack/autoblog#75e54af"on every branch. That shorthand is the problem — pnpm may resolve it either way, and it resolved differently once the lockfile was regenerated:masterhttps://codeload.github.com/.../tar.gz/75e54afgit+https://git@github.com:profullstack/autoblog.gitA GitHub Actions runner has no key for
git@github.com, and no reason to have one — the repository is public. So the SSH resolution can never work in CI, and it will come back on every future Dependabot PR as long as the shorthand is there.The fix
Name the tarball. There is then nothing left to re-resolve: the specifier is the URL that was already working, and any future lockfile regeneration produces the same thing instead of a coin flip.
75e54afgit@github.comleft anywhere inpnpm-lock.yamlVerified
pnpm install --frozen-lockfilecompletes, with@profullstack/autobloginstalledtsc --noEmitpasses and the full suite is green — 189 files, 2,609 tests passed, 7 skippedThis unblocks #181 and #182 once they pick up master. Note #182 is the major group (14 packages), so it may still have real failures of its own once install works — this only removes the failure that was masking everything.
🤖 Generated with Claude Code