Add npm min release age (#45268)

**Related issue:** Related to, but does not resolve, #45267 Adds a 12h cooldown period such that when npm is resolving dependencies it will not resolve anything released less than 12 hours ago. This doesn't apply globally within the fleet project because some portions use yarn which #45267 will take care of however this does add it to our CI jobs and the .npmrc files for projects that use npm I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but that won't automatically set it on every runner so leaving it in here for now As far as QA local builds and CI are both green. Tested NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally using the npm package feed https://registry.npmjs.org/-/rss to verify that recently updated packages either chose an older version OR the update was blocked if I tried to choose a newer one # Checklist for submitter ## Testing - [x] QA'd all new/changed functionality manually  ## Summary by CodeRabbit * **Chores** * Enhanced npm supply-chain security by implementing package installation policies across build workflows and configuration files to exclude packages released within the last 12 hours.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
2026-05-13 10:20:13 -04:00
parent b1ecaefedc
commit 8ae22b5586
24 changed files with 89 additions and 0 deletions
@@ -0,0 +1,2 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
@@ -36,6 +36,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -35,6 +35,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    runs-on: macos-latest
@@ -27,6 +27,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  check-doc-gen:
    runs-on: macos-latest
@@ -21,6 +21,10 @@ concurrency:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  test:
    name: Test Engineering Metrics Action
@@ -14,6 +14,10 @@ permissions:
  contents: read          # fetch repo metadata
  pull-requests: read     # read PR timelines

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  collect-metrics:
    runs-on: ubuntu-latest
@@ -9,6 +9,10 @@ on:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    permissions:
@@ -24,6 +24,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    if: ${{ github.repository == 'fleetdm/fleet' }}
@@ -9,6 +9,10 @@ on:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    permissions:
@@ -45,6 +45,10 @@ defaults:
    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:

  # Generate a random UUID to be used for the Cloudflare tunnel subdomain and make it available to later jobs.
@@ -17,6 +17,10 @@ concurrency:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  test-preview:
    timeout-minutes: 60
@@ -38,6 +38,8 @@ env:
  R2_ACCESS_KEY_SECRET: ${{ secrets.R2_DOWNLOAD_ACCESS_KEY_SECRET }} # Production: ${{ secrets.R2_DOWNLOAD_ACCESS_KEY_SECRET }} | Testing: ${{ secrets.R2_DOWNLOAD_TESTING_ACCESS_KEY_SECRET }}
  R2_BUCKET: download # Production: download | Testing: download-testing
  BASE_URL: https://download.fleetdm.com # Production: https://download.fleetdm.com | Testing: https://download-testing.fleetdm.com
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5

 jobs:
  check-for-fleetd-component-updates:
@@ -26,6 +26,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  release-fleetd-chrome-beta:
    runs-on: ubuntu-latest
@@ -27,6 +27,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  release-fleetd-chrome:
    runs-on: ubuntu-latest
@@ -12,6 +12,10 @@ concurrency:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    permissions:
@@ -23,6 +23,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  test-fleetd-chrome:
    strategy:
@@ -12,6 +12,10 @@ concurrency:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    permissions:
@@ -24,6 +24,10 @@ defaults:
 permissions:
  contents: read

+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -14,6 +14,8 @@ defaults:
 env:
  AWS_REGION: us-east-1
  AWS_IAM_ROLE: arn:aws:iam::142412512209:role/github-actions-role
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5

 permissions:
  id-token: write # This is required for aws-actions/configure-aws-credentials
@@ -0,0 +1,8 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Guards
+# against supply-chain attacks where malicious versions get yanked within hours
+# of publication.
+#
+# Honored by npm (>=11.5) and npx. NOT honored by Yarn 1 — yarn.lock-managed
+# projects (root, tools/fleetctl-npm, tools/fleet-slackbot, ee/tools/license)
+# rely on their pinned lockfile entries instead.
+min-release-age=0.5
@@ -9,3 +9,6 @@ loglevel=error

 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
@@ -0,0 +1,2 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
@@ -9,3 +9,6 @@ loglevel=error

 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
@@ -9,3 +9,6 @@ loglevel=error

 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5