Merge pull request #107 from docker/sec-cli/npm-ci-20260615-142203

fix: replace npm install with npm ci (20260615-142203)
fix: use lockfile-aware install commands
2026-06-29 03:25:08 +00:00 · 2026-06-15 11:53:25 -04:00 · 2026-06-15 14:22:04 +00:00 · 2026-05-28 18:45:01 +02:00 · 2026-05-28 15:13:46 +02:00 · 2026-05-28 10:22:30 +02:00
6 changed files with 128 additions and 125 deletions
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc

-compressionLevel: mixed
-enableGlobalCache: false
-enableHardenedMode: true
+nodeLinker: node-modules

 logFilters:
+  - code: YN0004
+    level: discard
  - code: YN0013
    level: discard
  - code: YN0019
@ -14,4 +14,8 @@ logFilters:
  - code: YN0086
    level: discard

-nodeLinker: node-modules
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+enableScripts: false
+npmMinimalAgeGate: 2d
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@ -17,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /vendor && cp yarn.lock /vendor
+  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor

 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
--- a/dist/index.cjs
+++ b/dist/index.cjs
--- a/dist/index.cjs.map
+++ b/dist/index.cjs.map
--- a/package.json
+++ b/package.json
@ -21,9 +21,9 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@4.9.2",
+  "packageManager": "yarn@4.15.0",
  "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^3.0.1",
    "@docker/actions-toolkit": "^0.91.0"
  },
  "devDependencies": {
--- a/yarn.lock
+++ b/yarn.lock
@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!

 __metadata:
-  version: 8
+  version: 10
  cacheKey: 10

 "@aashutoshrathi/word-wrap@npm:^1.2.3":
@ -2814,7 +2814,7 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "docker-setup-compose@workspace:."
  dependencies:
-    "@actions/core": "npm:^3.0.0"
+    "@actions/core": "npm:^3.0.1"
    "@docker/actions-toolkit": "npm:^0.91.0"
    "@eslint/js": "npm:^9.39.3"
    "@types/node": "npm:^24.11.0"
Author	SHA1	Message	Date
Alexandre Vallières-Lagacé	6fe408f5ba	Merge pull request #107 from docker/sec-cli/npm-ci-20260615-142203 Some checks failed ci / main () (push) Has been cancelled Details ci / main (cloud:latest) (push) Has been cancelled Details ci / main (cloud:v2.29.1-desktop.2) (push) Has been cancelled Details ci / main (latest) (push) Has been cancelled Details ci / main (v2.32.4) (push) Has been cancelled Details ci / multi (push) Has been cancelled Details ci / standalone (push) Has been cancelled Details ci / cache-binary (false) (push) Has been cancelled Details ci / cache-binary (true) (push) Has been cancelled Details zizmor / zizmor (push) Has been cancelled Details codeql / analyze (push) Has been cancelled Details validate / prepare (push) Has been cancelled Details test / test (push) Has been cancelled Details validate / validate (push) Has been cancelled Details fix: replace npm install with npm ci (20260615-142203)	2026-06-15 11:53:25 -04:00
securityeng-bot[bot]	f6cde28f68	fix: use lockfile-aware install commands	2026-06-15 14:22:04 +00:00
CrazyMax	dd8b913e80	Merge pull request #101 from crazy-max/yarn-update Some checks failed ci / main () (push) Has been cancelled Details ci / main (cloud:latest) (push) Has been cancelled Details validate / prepare (push) Has been cancelled Details zizmor / zizmor (push) Has been cancelled Details ci / main (v2.32.4) (push) Has been cancelled Details ci / multi (push) Has been cancelled Details validate / validate (push) Has been cancelled Details ci / standalone (push) Has been cancelled Details codeql / analyze (push) Has been cancelled Details test / test (push) Has been cancelled Details ci / main (cloud:v2.29.1-desktop.2) (push) Has been cancelled Details ci / main (latest) (push) Has been cancelled Details ci / cache-binary (false) (push) Has been cancelled Details ci / cache-binary (true) (push) Has been cancelled Details update yarn to 4.15.0	2026-05-28 18:45:01 +02:00
CrazyMax	168cd6c426	update yarn to 4.15.0 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-05-28 15:13:46 +02:00
CrazyMax	410c00e878	Merge pull request #100 from docker/dependabot/npm_and_yarn/actions/core-3.0.1 Some checks are pending ci / cache-binary (true) (push) Waiting to run Details ci / main (cloud:v2.29.1-desktop.2) (push) Waiting to run Details ci / main (latest) (push) Waiting to run Details ci / multi (push) Waiting to run Details validate / prepare (push) Waiting to run Details ci / main (v2.32.4) (push) Waiting to run Details ci / standalone (push) Waiting to run Details ci / cache-binary (false) (push) Waiting to run Details codeql / analyze (push) Waiting to run Details test / test (push) Waiting to run Details validate / validate (push) Blocked by required conditions Details zizmor / zizmor (push) Waiting to run Details ci / main () (push) Waiting to run Details ci / main (cloud:latest) (push) Waiting to run Details chore(deps): bump @actions/core from 3.0.0 to 3.0.1	2026-05-28 10:22:30 +02:00
CrazyMax	5d29e18d06	Merge pull request #99 from docker/sec-cli/ignore-scripts-fix-20260527-193420 ci: add ignore-scripts to Node package manager config (20260527-193420)	2026-05-28 09:59:38 +02:00
github-actions[bot]	70b1359563	chore: update generated content	2026-05-28 01:58:55 +00:00
dependabot[bot]	f0bcefd12e	chore(deps): bump @actions/core from 3.0.0 to 3.0.1 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 3.0.0 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-28 01:58:09 +00:00
securityeng-bot[bot]	41e3c799a3	ci: enforce ignore-scripts policy for Node package managers	2026-05-27 20:05:06 +00:00