chore(deploy): migrating to leverage `electron` GHA to isolate CI/CD token scopes #9302

mmaietta · 2025-10-04T15:32:25Z

Adding additional security to the repo with 2 new electron org actions that generate dynamic tokens as replacements for GITHUB_TOKEN and NPM_TOKEN setups

      # Auto-setup of NPM_TOKEN
      - name: Authenticate to npm registry
        uses: electron/npm-trusted-auth-action@v1
        with:
          package-name: 'electron-builder'

      - name: Generate GitHub App token
        uses: electron/[email protected]
        id: generate-token
        with:
          creds: ${{ secrets.creds_from_github_app }}

changeset-bot · 2025-10-04T15:32:29Z

⚠️ No Changeset found

Latest commit: 9e8590b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2025-10-11T20:00:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
stat-mode@1.0.0
simple-update-notifier@2.0.0
sanitize-filename@1.6.3
sax@1.4.1
resedit@1.7.0
source-map-support@0.5.21
request@2.88.2
semver@6.3.0 ⏵ 7.7.2	⁺¹	⁺²²	⁺¹	⁺¹

View full report

socket-security · 2025-10-11T20:00:55Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`[email protected]` is a Possible typosquat attack. Did you mean: [quarchived by owner~~y-ast~~](https://socket.dev/npm/package/archived by owner) From: pnpm-lock.yaml → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a typosquat? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` has Obfuscated code. Confidence: 0.94 Location: Package overview From: pnpm-lock.yaml → `npm/[email protected]` → `npm/[email protected]` → `npm/@changesets/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` is Deprecated. Reason: request has been deprecated, see https://github.com/request/request/issues/3142 From: pnpm-lock.yaml → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` is Deprecated. Reason: Rimraf versions prior to v4 are no longer supported From: pnpm-lock.yaml → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

MarshallOfSound · 2025-10-14T07:16:37Z

.github/workflows/pr-release.yml

-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # Auto-setup of NPM_TOKEN env var for for changesets/action
+      - name: Authenticate to npm registry
+        uses: electron/npm-trusted-auth-action@v1


MarshallOfSound · 2025-10-14T07:17:17Z

.github/workflows/pr-release.yml

+      - name: Authenticate to npm registry
+        uses: electron/npm-trusted-auth-action@v1
+        with:
+          package-name: 'electron-builder'


Not 100% sure about package structure, is this really the only package that gets published here. I thought this was a monorepo that had a few packages in it?

Hmmm, I need a single token that is able to publish the monorepo topographically via pnpm publish -r. Is there a way to provide a single token for a list of package-names?

MarshallOfSound · 2025-10-14T07:17:22Z

.github/workflows/pr-release.yml

+          package-name: 'electron-builder'
+
+      - name: Generate GitHub App token
+        uses: electron/[email protected]


mmaietta added 2 commits October 4, 2025 08:30

leveraging env NPM_TOKEN instead of secret

e6f7f31

correct package name

0372d68

move permissions scope

beef43a

mmaietta marked this pull request as ready for review October 4, 2025 16:31

mmaietta and others added 4 commits October 11, 2025 07:27

Merge branch 'master' into chore/migrate-to-npm-OIDC-token

f5b7659

add all things in to pr release job

bfcf874

purge github_token perms that aren't needed

ffd0077

corepack prepare and activate

b85839d

mmaietta changed the title ~~chore(deploy): migrate to electron/npm-trusted-auth-action~~ chore(deploy): migrating to leverage electron GHA to isolate CI/CD token scopes Oct 11, 2025

mmaietta added 4 commits October 11, 2025 13:03

test

9665042

get that corepack running

b486a53

revert

fbd3563

install corepack

9e8590b

mmaietta requested a review from MarshallOfSound October 12, 2025 06:03

MarshallOfSound reviewed Oct 14, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deploy): migrating to leverage `electron` GHA to isolate CI/CD token scopes #9302

chore(deploy): migrating to leverage `electron` GHA to isolate CI/CD token scopes #9302

Uh oh!

mmaietta commented Oct 4, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Oct 4, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Oct 11, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Oct 11, 2025 •

edited

Loading

Uh oh!

MarshallOfSound Oct 14, 2025

Uh oh!

MarshallOfSound Oct 14, 2025

Uh oh!

mmaietta Oct 14, 2025

Uh oh!

MarshallOfSound Oct 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

chore(deploy): migrating to leverage electron GHA to isolate CI/CD token scopes #9302

Are you sure you want to change the base?

chore(deploy): migrating to leverage electron GHA to isolate CI/CD token scopes #9302

Uh oh!

Conversation

mmaietta commented Oct 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Oct 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-security bot commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MarshallOfSound Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

mmaietta Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deploy): migrating to leverage `electron` GHA to isolate CI/CD token scopes #9302

chore(deploy): migrating to leverage `electron` GHA to isolate CI/CD token scopes #9302

mmaietta commented Oct 4, 2025 •

edited

Loading

changeset-bot bot commented Oct 4, 2025 •

edited

Loading

socket-security bot commented Oct 11, 2025 •

edited

Loading

socket-security bot commented Oct 11, 2025 •

edited

Loading