enable hardened mode

This commit is contained in:
Samuel Newman
2026-02-04 13:26:16 -06:00
parent 6831a46a8c
commit 825d2a6073
+3 -2
View File
@@ -34,11 +34,12 @@ jobs:
BASE_REF: ${{ github.base_ref }} BASE_REF: ${{ github.base_ref }}
run: git show "origin/$BASE_REF:yarn.lock" > yarn.lock run: git show "origin/$BASE_REF:yarn.lock" > yarn.lock
- name: Yarn install - name: Yarn install (with hardened mode)
uses: Wandalen/wretry.action@master uses: Wandalen/wretry.action@master
with: with:
# Fine to skip scripts since we don't run any code # Fine to skip scripts since we don't run any code
command: yarn install --skip-builds # Hardened mode validates lockfile security (no mismatched metadata, valid resolutions)
command: YARN_ENABLE_HARDENED_MODE=1 yarn install --skip-builds
attempt_limit: 3 attempt_limit: 3
attempt_delay: 2000 attempt_delay: 2000