stacklok / toolhive-studio / 25748156342

69%

main: 70%

Pull #2239

github

chore(security): add pnpm audit signatures and drop --ignore-registry-errors

Adds \`pnpm audit signatures\` (new in pnpm 11.1) as a second step in the existing PNPM Audit job. Verifies ECDSA signatures of installed packages against the registry's public keys at /-/npm/v1/keys — catches post-publish tampering, which the existing CVE-based audit doesn't.

Also drops --ignore-registry-errors from the CVE audit step. That flag was added when pnpm audit talked to the legacy /-/npm/v1/security/audits endpoints, which were notoriously flaky (now retired, return 410). pnpm 11's bulk advisories endpoint is well-maintained, and masking registry errors silently is a false-confidence trap.

4834 of 7602 branches covered (63.59%)

7216 of 10511 relevant lines covered (68.65%)

118.96 hits per line