fix(ci): resolve super-linter v8 failures (Biome + Zizmor) - #37
Conversation
Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.6 to 4.2.7. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.6...socket.io-parser@4.2.7) --- updated-dependencies: - dependency-name: socket.io-parser dependency-version: 4.2.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Biome: add root biome.json declaring the existing 4-space style and apply its fixes to apply.js. Zizmor: pin all actions to full commit SHAs (Dependabot keeps SHA pins updated) and route run: interpolations through env. Disable MULTI_STATUS instead of widening permissions.
…add persist-credentials Biome owns JS/JSON formatting and yamllint owns YAML; running Prettier on the same files fights Biome's style. artipacked: lint only reads the tree, so don't persist the checkout token.
|
Lint status after the second commit: only TRIVY remains red, and its two findings are repo state, not lint config — (1) |
Upstream defaults to root for bind-mount convenience but ships a node user with /app/data pre-chowned to it. Verified non-root locally: HTTP up, healthcheck OK, DB written on a tmpfs like Cloud Run's in-memory volume. Closes Trivy DS-0002.
There was a problem hiding this comment.
Pull request overview
This PR fixes CI failures introduced by super-linter v8 (Biome + Zizmor) by adding an explicit Biome configuration, applying Biome-driven cleanups to the Kuma config applier script, and hardening GitHub Actions workflows (pinning uses: to SHAs and removing template-injection patterns). It also folds in the socket.io-parser patch bump and switches the Kuma container to run as a non-root user.
Changes:
- Add root
biome.json(4-space indentation) and apply Biome’s fixes tokuma-config/apply.js. - Harden workflows: pin all actions to commit SHAs, fix zizmor template-injection findings via
env:indirection, and disable super-linterMULTI_STATUS. - Operational/security updates: bump
socket.io-parserin the lockfile and run the Kuma image as non-root (USER node).
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
biome.json |
Adds repo-root Biome config to match existing formatting conventions. |
kuma-config/apply.js |
Biome formatting + minor JS modernizations (e.g., node: imports, optional chaining). |
kuma-config/package-lock.json |
Updates socket.io-parser to 4.2.7 in the lockfile. |
docker/Dockerfile |
Runs the container as the built-in non-root node user. |
.github/workflows/ci-lint-codebase.yml |
Pins super-linter/checkout to SHAs; disables MULTI_STATUS; turns off Prettier validators to avoid formatter conflicts. |
.github/workflows/sub-cloudrun-deploy.yml |
Pins actions; routes expressions through env: to address template-injection findings; improves shell quoting. |
.github/workflows/sub-build-docker-image.yml |
Pins all referenced actions to full commit SHAs. |
.github/workflows/chore-clean-dev.yml |
Pins actions; routes expressions through env: to avoid template injection in run: blocks. |
.github/workflows/cd-apply-kuma-config.yml |
Pins actions (checkout/auth/setup-gcloud/setup-node) to SHAs for supply-chain hardening. |
Files not reviewed (1)
- kuma-config/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
apply.js uses node: specifiers and optional chaining; engines makes the floor machine-checked instead of prose-only.
markdownlint is already off; keep its formatter consistent.
Closes #36.
Lint has failed on every run since the super-linter v8 bump enabled Biome and Zizmor. This fixes all findings at the root instead of suppressing them.
Biome
biome.jsondeclaring the style the code already uses (4-space indent). Biome does its own config discovery (it ignoresLINTER_RULES_PATH), so root placement is the supported location.kuma-config/apply.js: formatting,node:import protocol, optional chaining, template literal. All mechanical/equivalent;node --checkpasses and the file is now fully clean (biome checkexit 0, zero warnings).Zizmor
unpinned-uses: pin all 12 actions across the workflows to full commit SHAs with a# vX.Y.Zcomment. Tags are mutable — a compromised maintainer can repoint one and run arbitrary code with our WIF credentials; a full SHA is immutable (GitHub hardening guidance). Dependabot updates SHA pins and their version comments, so maintenance is unchanged.template-injection: route${{ … }}interpolations inrun:blocks throughenv:(insub-cloudrun-deploy.ymlandchore-clean-dev.yml), matching the patterncd-apply-kuma-config.ymlalready uses. The shell now only ever expands plain env vars.Noise fix
MULTI_STATUS: falseon super-linter: it was failing to POST commit statuses (403) because the job doesn't grantstatuses: write. The job summary already carries per-linter results; disabling beats widening token permissions.Verification
biome checkclean locally with the new config;node --checkpasses onapply.js.repos/<owner>/<repo>/commits/<tag>).Update: now also carries the
socket.io-parser4.2.7 bump (#35, CVE-2026-69185) and the non-root Dockerfile fix (#38 / PR #39) merged in, so lint goes fully green on this PR's merge. Closes #38.