enable hardened mode

2026-02-04 13:26:16 -06:00
parent 6831a46a8c
commit 825d2a6073
1 changed files with 3 additions and 2 deletions
@@ -34,11 +34,12 @@ jobs:
          BASE_REF: ${{ github.base_ref }}
        run: git show "origin/$BASE_REF:yarn.lock" > yarn.lock

-      - name: Yarn install
+      - name: Yarn install (with hardened mode)
        uses: Wandalen/wretry.action@master
        with:
          # Fine to skip scripts since we don't run any code
-          command: yarn install --skip-builds
+          # Hardened mode validates lockfile security (no mismatched metadata, valid resolutions)
+          command: YARN_ENABLE_HARDENED_MODE=1 yarn install --skip-builds
          attempt_limit: 3
          attempt_delay: 2000