From 75f9453b37b11aa8740ade31a92fbf4a1f74eec7 Mon Sep 17 00:00:00 2001 From: "securityeng-bot[bot]" <219863240+securityeng-bot[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 15:33:23 +0000 Subject: [PATCH 1/3] ci: enforce ignore-scripts policy for Node package managers --- .npmrc | 1 + 1 file changed, 1 insertion(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..97b895e --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +ignore-scripts=true From 27889c314e9dccfd34d81021c5ebc2ea37d55307 Mon Sep 17 00:00:00 2001 From: "securityeng-bot[bot]" <219863240+securityeng-bot[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 15:33:25 +0000 Subject: [PATCH 2/3] ci: enforce ignore-scripts policy for Node package managers --- .yarnrc.yml | 1 + 1 file changed, 1 insertion(+) create mode 100644 .yarnrc.yml diff --git a/.yarnrc.yml b/.yarnrc.yml new file mode 100644 index 0000000..1e5671c --- /dev/null +++ b/.yarnrc.yml @@ -0,0 +1 @@ +enableScripts: false From b87660aadf25821145dda587d3140b70846d051f Mon Sep 17 00:00:00 2001 From: Docker Agent Date: Wed, 27 May 2026 17:33:24 +0000 Subject: [PATCH 3/3] fix: add COPY for .npmrc/.yarnrc.yml and place files in build contexts Each sample's Makefile uses '.' (the sample directory) as the docker build context. The .npmrc and .yarnrc.yml files were added at repo root but were never copied into the sample subdirectories, making them unreachable from their build contexts. For npm-based samples (kubernetes-sample-extension, oauth-sample): - Add COPY .npmrc . before npm ci in the Dockerfile - Add .npmrc to each sample directory For yarn-based samples (minimal-backend, minimal-docker-cli, react): - Add COPY .yarnrc.yml . before yarn install in the Dockerfile - Add .yarnrc.yml to each sample directory Skipped minimal-frontend (no package installs) and vm-service (Go only). --- samples/kubernetes-sample-extension/.npmrc | 1 + samples/kubernetes-sample-extension/Dockerfile | 1 + samples/minimal-backend/.yarnrc.yml | 1 + samples/minimal-backend/Dockerfile | 1 + samples/minimal-docker-cli/.yarnrc.yml | 1 + samples/minimal-docker-cli/Dockerfile | 1 + samples/oauth-sample/.npmrc | 1 + samples/oauth-sample/Dockerfile | 1 + samples/react/.yarnrc.yml | 1 + samples/react/Dockerfile | 1 + 10 files changed, 10 insertions(+) create mode 100644 samples/kubernetes-sample-extension/.npmrc create mode 100644 samples/minimal-backend/.yarnrc.yml create mode 100644 samples/minimal-docker-cli/.yarnrc.yml create mode 100644 samples/oauth-sample/.npmrc create mode 100644 samples/react/.yarnrc.yml diff --git a/samples/kubernetes-sample-extension/.npmrc b/samples/kubernetes-sample-extension/.npmrc new file mode 100644 index 0000000..97b895e --- /dev/null +++ b/samples/kubernetes-sample-extension/.npmrc @@ -0,0 +1 @@ +ignore-scripts=true diff --git a/samples/kubernetes-sample-extension/Dockerfile b/samples/kubernetes-sample-extension/Dockerfile index 309b875..9c7efd6 100644 --- a/samples/kubernetes-sample-extension/Dockerfile +++ b/samples/kubernetes-sample-extension/Dockerfile @@ -5,6 +5,7 @@ WORKDIR /ui # cache packages in layer COPY ui/package.json /ui/package.json COPY ui/package-lock.json /ui/package-lock.json +COPY .npmrc . RUN --mount=type=cache,target=/usr/src/app/.npm \ npm set cache /usr/src/app/.npm && \ diff --git a/samples/minimal-backend/.yarnrc.yml b/samples/minimal-backend/.yarnrc.yml new file mode 100644 index 0000000..1e5671c --- /dev/null +++ b/samples/minimal-backend/.yarnrc.yml @@ -0,0 +1 @@ +enableScripts: false diff --git a/samples/minimal-backend/Dockerfile b/samples/minimal-backend/Dockerfile index 67ab8f2..6f673f2 100644 --- a/samples/minimal-backend/Dockerfile +++ b/samples/minimal-backend/Dockerfile @@ -3,6 +3,7 @@ WORKDIR /app/client # cache packages in layer COPY client/package.json /app/client/package.json COPY client/yarn.lock /app/client/yarn.lock +COPY .yarnrc.yml . ARG TARGETARCH RUN yarn config set cache-folder /usr/local/share/.cache/yarn-${TARGETARCH} RUN --mount=type=cache,target=/usr/local/share/.cache/yarn-${TARGETARCH} yarn diff --git a/samples/minimal-docker-cli/.yarnrc.yml b/samples/minimal-docker-cli/.yarnrc.yml new file mode 100644 index 0000000..1e5671c --- /dev/null +++ b/samples/minimal-docker-cli/.yarnrc.yml @@ -0,0 +1 @@ +enableScripts: false diff --git a/samples/minimal-docker-cli/Dockerfile b/samples/minimal-docker-cli/Dockerfile index 0857369..a59e883 100644 --- a/samples/minimal-docker-cli/Dockerfile +++ b/samples/minimal-docker-cli/Dockerfile @@ -3,6 +3,7 @@ WORKDIR /app/client # cache packages in layer COPY client/package.json /app/client/package.json COPY client/yarn.lock /app/client/yarn.lock +COPY .yarnrc.yml . ARG TARGETARCH RUN yarn config set cache-folder /usr/local/share/.cache/yarn-${TARGETARCH} RUN --mount=type=cache,target=/usr/local/share/.cache/yarn-${TARGETARCH} yarn diff --git a/samples/oauth-sample/.npmrc b/samples/oauth-sample/.npmrc new file mode 100644 index 0000000..97b895e --- /dev/null +++ b/samples/oauth-sample/.npmrc @@ -0,0 +1 @@ +ignore-scripts=true diff --git a/samples/oauth-sample/Dockerfile b/samples/oauth-sample/Dockerfile index f216465..9099d3b 100644 --- a/samples/oauth-sample/Dockerfile +++ b/samples/oauth-sample/Dockerfile @@ -3,6 +3,7 @@ WORKDIR /ui # cache packages in layer COPY ui/package.json /ui/package.json COPY ui/package-lock.json /ui/package-lock.json +COPY .npmrc . RUN --mount=type=cache,target=/usr/src/app/.npm \ npm set cache /usr/src/app/.npm && \ npm ci diff --git a/samples/react/.yarnrc.yml b/samples/react/.yarnrc.yml new file mode 100644 index 0000000..1e5671c --- /dev/null +++ b/samples/react/.yarnrc.yml @@ -0,0 +1 @@ +enableScripts: false diff --git a/samples/react/Dockerfile b/samples/react/Dockerfile index fa98757..f709c35 100644 --- a/samples/react/Dockerfile +++ b/samples/react/Dockerfile @@ -3,6 +3,7 @@ WORKDIR /app/client # cache packages in layer COPY client/package.json /app/client/package.json COPY client/yarn.lock /app/client/yarn.lock +COPY .yarnrc.yml . ARG TARGETARCH RUN yarn config set cache-folder /usr/local/share/.cache/yarn-${TARGETARCH} RUN --mount=type=cache,target=/usr/local/share/.cache/yarn-${TARGETARCH} yarn