Repository navigation
feat(host-tools): npm and pnpm package-install security settings and shell environment variables - #168
Merged
Conversation
Four variables, all empty by default and then writing nothing, let a host refuse packages younger than a minimum age and skip install scripts: github_runner_host_tools_npm_settings and github_runner_host_tools_npm_min_release_age_exclude go into one managed block of the connecting user's ~/.npmrc, and github_runner_host_tools_pnpm_settings and github_runner_host_tools_pnpm_minimum_release_age_exclude are merged into pnpm's global config.yaml at the path the operating system has. The npmrc block never touches another line. A key the user already sets outside the block is kept and named in the run's output rather than shadowed, since npm reads the last of two assignments. The file is read with no_log only to find those keys, a missing file is created with mode 0600 and the mode of an existing one is never changed. Dropping an entry removes its line, and dropping them all removes the block. The pnpm merge rewrites only the entries of keys whose value differs and keeps every other key, comment and blank line, then checks the result against what it should hold before it is written.
github_runner_host_tools_shell_env, empty by default and then writing nothing, maps variable names to values. Each becomes an export line in its own managed block of the shell's startup file (.zshenv for zsh, .bashrc for bash), under the same rule as the Homebrew and mise lines: a variable that any startup file of the shell already assigns is not added again, and the role's own block is kept current when the value changes. Values are quoted with shlex.quote, so quotes, dollar signs and backticks reach the variable as given in zsh and bash alike. The variables are written whether or not the shell integration is on and without Homebrew, so the shell setup moves from tools.yml to main.yml.
…de redundant A comment line starts with ; or # and the key and exclusion patterns are anchored to a key at the start of the line, so none of them could match one.
…'s empty block An empty block already removes the block and its markers, so the explicit state only restated it. Also covers an existing empty ~/.npmrc keeping its mode.
Mearman
marked this pull request as ready for review
November 2, 2026 16:38
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
🎉 This PR is included in version 2.17.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the package-install security settings from #162 to
github_runner_host_tools, plus a shell environment mapping so a consumer can set variables such asUV_PYTHON_DOWNLOADS=never.Every new variable defaults to empty and then writes nothing, so existing users of the role see no change.
github_runner_host_tools_npm_settingsandgithub_runner_host_tools_npm_min_release_age_excludego into oneANSIBLE MANAGED BLOCKin~/.npmrc. Nothing outside the block is touched, a missing file is created with mode 0600, an existing file's mode is never changed, and the file is read withno_logonly to find keys the user already sets. A key set outside the block is kept and named in the run output instead of overridden (npm reads the last of two assignments, so a block at the end would shadow it). Dropping entries removes their lines and the block.github_runner_host_tools_pnpm_settingsandgithub_runner_host_tools_pnpm_minimum_release_age_excludeare merged into pnpm's globalconfig.yaml(~/Library/Preferences/pnpm/config.yamlon macOS,~/.config/pnpm/config.yamlon Linux, per https://pnpm.io/cli/config). Only entries whose value differs are rewritten; other keys, comments and blank lines stay byte for byte, and the result is parsed and compared before it is written. Dropping a key from the variable leaves it in the file, since the role can't tell which keys it wrote.github_runner_host_tools_shell_envwrites one managedexportblock per variable to.zshenvor.bashrc, with the same rule as the Homebrew and mise lines: skipped when any startup file of the shell already assigns the variable. Values are quoted withshlex.quote. It applies whether or notgithub_runner_host_tools_shell_integrationis on, so the shell setup moved fromtools.ymltomain.yml.Tests cover the three new filters against golden strings and the role against stand-ins in a temporary home, including a round trip of a value with quotes and dollar signs through
shandbash. The README documents each variable.Fixes #162