PhotoStructure leans on a lot of open source, and publishes a fair amount too — exiftool-vendored, batch-cluster, @photostructure/sqlite, mkver, and others. Over the last month I rebuilt how they take in dependencies and ship.
Dependencies age before use. Nothing resolves a release less than 14 days old. Most npm compromises are caught and pulled within days — a cooldown means my builds aren’t the ones that find them. Actions are pinned to commit SHAs, not tags, because tags can be moved.
Dependencies don’t run code at install time. Lifecycle scripts are off in CI.
Publishing is bound to one commit. No npm token exists in CI at all. The release workflow verifies a signed tag against the already-tested commit, and every published version carries provenance you can check with npm view.
All of our repositories require signed commits and accounts that have 2FA.
Nothing goes public without me. CI can only stage a package. I read the file listing and it can only be approved by me touching a YubiKey on my desk.
OIDC publishing with package attestation is enabled everywhere. This lets you validate that the contents of the package match what was built by github.
Security is always a work in progress: if you can think of anything else I’m always eager for any other possible hardening strategies I can apply!