fix: upload the verification log right after the install writes it

Browse Source

Saving in the post step left the whole job between the install and the upload.
Anything running in that window — the job's tests, its build, a dependency's
own install scripts — can rewrite the log on disk, and the job's own cache
write would then publish a record claiming some other lockfile passed
verification, for every later job to restore and trust. No cache credentials
needed: the attacker rides the write the job performs anyway.

The log is complete the moment the install finishes, so it is uploaded there.
The post step still covers a job that installs in a step of its own, where
that is the first point the log is known to be final; the save is idempotent
across the two, and the process-local flags exist because main and post do not
share state within a run.

...

This commit is contained in:

Zoltan Kochan

2026-08-13 17:03:37 +02:00

parent b543421fa5

commit e6cb65ab2f

4 changed files with 156 additions and 128 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

dist/index.js

Vendored

+122 -122

File diff suppressed because one or more lines are too long