Skip to content

fix(drift-sync): mechanical model-family sync (2026-08-07) #856

fix(drift-sync): mechanical model-family sync (2026-08-07)

fix(drift-sync): mechanical model-family sync (2026-08-07) #856

Workflow file for this run

name: Publish Preview
on:
pull_request:
branches: [main]
permissions:
contents: read
jobs:
preview:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: { persist-credentials: false }
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: { node-version: 24, cache: pnpm }
- run: pnpm install --frozen-lockfile
- run: pnpm build
# `pnpm exec`, NOT `npx`. This step used to be `npx pkg-pr-new publish`,
# and `pkg-pr-new` was in neither package.json nor pnpm-lock.yaml — so npx
# resolved the `latest` dist-tag at run time and executed whatever bytes
# the registry served, with no integrity check of any kind. That is a
# live arbitrary-code-execution seam on every PR: a malicious publish or a
# registry/account compromise lands attacker code inside this job. It is
# also the ONLY `npx` target in this repo that is not already a
# devDependency (`tsx` and `vitest`, the others, resolve from the tree).
#
# `pkg-pr-new` is now an EXACT-pinned devDependency, so the
# `pnpm install --frozen-lockfile` above has already verified its tarball
# against the reviewed sha512 in pnpm-lock.yaml — substituted bytes fail
# the install with ERR_PNPM_TARBALL_INTEGRITY and this step never runs.
# `pnpm exec` then runs THOSE verified bytes out of node_modules and
# fetches nothing. Do not reintroduce `npx` here.
#
# WHEN THIS FAILS: pkg-pr-new cut a new release and you want it. Bump the
# exact version in package.json's devDependencies and regenerate the
# lockfile (`pnpm install`) so a reviewed integrity hash lands in the
# diff. Do not widen the specifier to a range to avoid that review.
- run: pnpm exec pkg-pr-new publish