milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Skip min safe age to allow brand new PNPM boostrap

Browse source
This commit is contained in:
James McMeeking 2026-05-12 16:53:51 +01:00
parent d812231b2f
commit c93f1920fb
No known key found for this signature in database
GPG key ID: C69A11061EE15228
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
test/e2e/rush.e2e.spec.js
View file

@ -97,8 +97,14 @@ describe("E2E: rush coverage", () => {
}`,
});
// `--safe-chain-skip-minimum-package-age` is needed because Rush's
// internal pnpm bootstrap (`npm install pnpm@<resolvedVersion>`) goes
// through the safe-chain proxy. When the CI matrix selects pnpm
// `latest`, the just-released version can be below the minimum age
// threshold and Rush's install would otherwise be blocked before our
// malicious-download assertion is reached.
const result = await shell.runCommand(
"cd /testapp/apps/test-app && rush update"
"cd /testapp/apps/test-app && rush update --safe-chain-skip-minimum-package-age"
);
assert.ok(