🏁 Script executed:

sed -n '1,140p' .github/workflows/build-cordova.yml
printf '\n--- publish-release ---\n'
sed -n '1,140p' .github/workflows/publish-release.yml

Repository: grigoreo-dev/padloc

Length of output: 10046

🌐 Web query:

actions/setup-node v6 package-manager-cache cache pnpm elevated privileges sensitive information docs

💡 Result:

In GitHub Actions, the actions/setup-node v6 action provides a package-manager-cache input that controls automatic dependency caching [1][2]. By default, this is set to true [1][2]. For workflows that involve elevated privileges or access to sensitive information, official documentation explicitly recommends disabling automatic caching by setting package-manager-cache: false when caching is not strictly required for secure operation [1][2][3]. Regarding pnpm specifically: - Unlike npm, which may trigger automatic caching based on the packageManager field in package.json, caching for pnpm is not automatic [1][2]. - To use caching with pnpm, you must explicitly configure it using the cache input (e.g., cache: 'pnpm') [4][2]. - When using pnpm, ensure you are using a supported version (v6.10+) and generally should use --frozen-lockfile in your install commands to maintain consistency [4]. If you are concerned about sensitive information leakage or security in privileged workflows, the primary mitigation is to explicitly disable the caching feature in your workflow YAML [1][2]: steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6 with: node-version: '24' package-manager-cache: false # Security recommendation for privileged workflows

Citations:

• 1: https://github.com/actions/setup-node/blob/v6/README.md
• 2: https://github.com/actions/setup-node/blob/main/README.md
• 3: https://github.com/marketplace/actions/setup-node-js-environment
• 4: https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md

🏁 Script executed:

python3 - <<'PY'
import json, subprocess, textwrap, os, sys, urllib.request
url = "https://raw.githubusercontent.com/actions/setup-node/main/action.yml"
print("fetch", url)
print(urllib.request.urlopen(url, timeout=20).read().decode()[:4000])
PY

Repository: grigoreo-dev/padloc

Length of output: 2826

🏁 Script executed:

python3 - <<'PY'
import urllib.request, re
for url in [
    "https://raw.githubusercontent.com/actions/setup-node/main/action.yml",
    "https://raw.githubusercontent.com/actions/setup-node/main/README.md",
]:
    print(f"--- {url} ---")
    txt = urllib.request.urlopen(url, timeout=20).read().decode()
    for needle in ["package-manager-cache", "cache:", "elevated privileges", "sensitive information"]:
        if needle in txt:
            print(f"found {needle!r}")
    # Print relevant excerpts
    for pat in [r"package-manager-cache.*", r"cache.*", r"elevated privileges.*", r"sensitive information.*"]:
        m = re.search(pat, txt, re.I)
        if m:
            start = max(0, m.start()-300)
            end = min(len(txt), m.end()+700)
            print(txt[start:end])
            print()
PY

Repository: grigoreo-dev/padloc

Length of output: 2828

🌐 Web query:

site:github.com/actions/setup-node package-manager-cache elevated privileges sensitive information cache-poisoning

💡 Result:

In the context of package managers, particularly within CI/CD environments like GitHub Actions, using automatic caching features in workflows with elevated privileges or access to sensitive information introduces a risk of cache poisoning [1][2]. When a package manager cache is automatically enabled, the system restores dependency data from a shared or persistent cache to speed up builds [3][4]. If an attacker can influence the workflow execution—for example, by submitting a pull request that alters dependency definitions or environment configurations—they may be able to poison the cache [5][2]. In a privileged environment (such as a workflow with access to secrets, OIDC tokens, or deployment credentials), this poisoned cache can be used to inject malicious code or exfiltrate sensitive information [5][2]. Because the package manager or the CI/CD action cannot reliably determine if a specific workflow context is inherently "privileged," official guidance recommends the following mitigations: 1. Explicitly Disable Caching: For workflows handling sensitive credentials, secrets, or those running in highly privileged environments, disable automatic caching by setting package-manager-cache: false in your configuration [6][5][7]. 2. Use Explicit Cache Keys: When caching is necessary, avoid implicit or automatic behavior. Use explicit, immutable cache keys that you control and verify [2]. 3. Monitor Logs: Ensure that your workflow logs are configured to explicitly indicate when caching operations occur, allowing you to audit whether caching is happening in sensitive steps [2]. By disabling automatic caching in sensitive workflows, you prevent the risk of attackers using the cache as a persistence or exfiltration vector for privileged data [5][2].

Citations:

• 1: Don't cache automatically in privileged workflows actions/setup-node#1358
• 2: Don't cache automatically in privileged workflows actions/setup-node#1358
• 3: Enhance caching in setup-node with automatic package manager detection actions/setup-node#1348
• 4: Question: What is cached? actions/setup-node#612
• 5: docs: Update caching recommendations to mitigate cache poisoning risks actions/setup-node#1567
• 6: https://github.com/actions/setup-node/blob/main/README.md?plain=1
• 7: https://github.com/actions/setup-node

🏁 Script executed:

python3 - <<'PY'
import urllib.request, re
txt = urllib.request.urlopen("https://raw.githubusercontent.com/actions/setup-node/main/README.md", timeout=20).read().decode()
for term in ["package-manager-cache", "cache: 'pnpm'", "cache: \"pnpm\"", "elevated privileges", "sensitive information"]:
    print(f"== {term} ==")
    for m in re.finditer(term, txt, re.I):
        start = max(0, m.start()-250)
        end = min(len(txt), m.end()+600)
        print(txt[start:end])
        print("---")
        break
PY

Repository: grigoreo-dev/padloc

Length of output: 2751

🏁 Script executed:

python3 - <<'PY'
import urllib.request, ssl, re
urls = {
    "README": "https://raw.githubusercontent.com/actions/setup-node/main/README.md",
    "action": "https://raw.githubusercontent.com/actions/setup-node/main/action.yml",
}
ctx = ssl._create_unverified_context()
for name, url in urls.items():
    print(f"--- {name} ---")
    txt = urllib.request.urlopen(url, context=ctx, timeout=20).read().decode()
    for needle in ["package-manager-cache", "cache:", "elevated privileges", "sensitive information"]:
        idx = txt.lower().find(needle.lower())
        if idx >= 0:
            print(txt[max(0, idx-220):min(len(txt), idx+900)])
            print("\n---\n")
PY

Repository: grigoreo-dev/padloc

Length of output: 6951

🏁 Script executed:

python3 - <<'PY'
import urllib.request, ssl, re

ctx = ssl._create_unverified_context()
txt = urllib.request.urlopen("https://raw.githubusercontent.com/actions/setup-node/main/README.md", context=ctx, timeout=20).read().decode()

for needle in ["package-manager-cache", "cache:", "elevated privileges", "sensitive information"]:
    print(f"\n== {needle} ==")
    for m in re.finditer(needle, txt, re.I):
        start = max(0, m.start()-250)
        end = min(len(txt), m.end()+700)
        print(txt[start:end])
        print("\n---")
        break
PY

Repository: grigoreo-dev/padloc

Length of output: 4149

🏁 Script executed:

python3 - <<'PY'
import urllib.request, ssl, re

ctx = ssl._create_unverified_context()
txt = urllib.request.urlopen("https://raw.githubusercontent.com/actions/setup-node/main/README.md", context=ctx, timeout=20).read().decode()

# Print only the relevant sections near cache-related inputs and recommendations
patterns = [
    r"package-manager-cache",
    r"cache\s*input",
    r"elevated privileges",
    r"sensitive information",
]
for pat in patterns:
    m = re.search(pat, txt, re.I)
    print(f"\n== {pat} ==")
    if m:
        start = max(0, m.start()-300)
        end = min(len(txt), m.end()+1000)
        print(txt[start:end])
    else:
        print("not found")
PY

Repository: grigoreo-dev/padloc

Length of output: 5541

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/build-electron.yml
wc -l .github/workflows/build-electron.yml
cat -n .github/workflows/build-electron.yml | sed -n '70,140p'

printf '\n---\n'

rg -n 'runs-on: macos-11|actions/checkout@v5|pnpm/action-setup@v6|actions/setup-node@v6|actions/upload-artifact@v6' .github/workflows/build-electron.yml

Repository: grigoreo-dev/padloc

Length of output: 4825

🌐 Web query:

GitHub Actions macos-11 retired runner image June 28 2024

💡 Result:

GitHub officially retired the macos-11 runner image for GitHub Actions on June 28, 2024 [1][2]. Following its initial announcement of the deprecation in January 2024 [3], GitHub confirmed the specific retirement date of June 28, 2024, in a May 2024 update [1]. Users who continue to reference macos-11 in their workflow files will experience build failures, as the environment is no longer supported or available [2][4]. Users are advised to migrate to newer, supported macOS runner versions, such as macos-12, macos-13, or macos-14 [3][4].

Citations:

• 1: https://github.blog/changelog/2024-05-19-actions-upcoming-changes-to-github-hosted-macos-runners/
• 2: Missing deprecation date for macos-11 actions/runner-images#10097
• 3: https://github.blog/changelog/2024-01-30-github-actions-macos-14-sonoma-is-now-available/
• 4: macos-11 failures actions/runner-images#10183

🌐 Web query:

actions/checkout v5 minimum runner version 2.327.1

💡 Result:

Yes, actions/checkout v5 requires a minimum GitHub Actions Runner version of v2.327.1 [1][2][3]. This requirement exists because actions/checkout v5 was updated to the Node.js 24 runtime, and runner version v2.327.1 is the minimum version necessary to support Node.js 24-based actions [2][4]. If you are using self-hosted runners, they must be updated to at least this version to run checkout v5 [4].

Citations:

• 1: https://github.com/actions/checkout/releases/tag/v5.0.0
• 2: https://github.com/actions/checkout
• 3: https://github.com/actions/checkout/?tab=readme-ov-file
• 4: Breaking change with v5 release - can't run any builds - Parameter ''using: node24' is not supported actions/checkout#2240

🌐 Web query:

actions/setup-node v6 minimum runner version

💡 Result:

The actions/setup-node v6 action requires the GitHub runner to be version v2.327.1 or later to ensure compatibility [1][2]. Using an older runner version may result in issues when utilizing this major version release [3][4].

Citations:

• 1: https://github.com/actions/setup-node/blob/v6/README.md
• 2: https://github.com/actions/setup-node?tab=readme-ov-file
• 3: https://github.com/actions/setup-node/releases
• 4: https://github.com/actions/setup-node/releases/tag/v6.0.0

🌐 Web query:

actions/upload-artifact v6 minimum runner version

💡 Result:

The actions/upload-artifact version 6 action requires a minimum Actions Runner version of 2.327.1 [1][2][3]. This version of the action runs on Node.js 24 (runs.using: node24) [1][4]. If you are using self-hosted runners, you must ensure they are updated to at least version 2.327.1 before upgrading to v6 to maintain compatibility [1][5].

Citations:

• 1: https://github.com/actions/upload-artifact/releases/tag/v6.0.0
• 2: https://github.com/actions/upload-artifact/releases
• 3: prepare release v6.0.0 for Node.js 24 support actions/upload-artifact#745
• 4: https://github.com/actions/upload-artifact/tree/refs/heads/upload-artifact-v6-release
• 5: Bump actions/upload-artifact from 5 to 6 actions/runner#4157

🌐 Web query:

pnpm/action-setup v6 minimum runner version

💡 Result:

The pnpm/action-setup v6 action requires a runner capable of executing Node.js 24 [1][2][3]. Because the action is built to run on Node.js 24, it requires a GitHub Actions runner environment that supports this runtime [1][2]. Specifically, internal configuration for v6 specifies a minimum runner version of 2.327.1 [2]. This version upgrade was driven by the deprecation of the Node 20 runtime on GitHub Actions runners, necessitating a transition to Node 24 [2]. Users are encouraged to ensure their self-hosted runners or environment settings meet these requirements to maintain compatibility [2].

Citations:

• 1: pnpm/action-setup@v3.0.0...v6.0.8
• 2: manehorizons/cadence@ce23b9f
• 3: pnpm/action-setup@v4...v6.0.8

🏁 Script executed:

sed -n '120,170p' .github/workflows/build-electron.yml

Repository: grigoreo-dev/padloc

Length of output: 1730

🌐 Web query:

GitHub Actions windows-2019 retired 2025-06-30 official announcement

💡 Result:

The GitHub Actions windows-2019 runner image was officially retired and reached end-of-support on June 30, 2025 [1][2][3]. GitHub announced the deprecation of the windows-2019 image on April 15, 2025, citing its N-1 OS support policy [3][4]. Following the announcement, the deprecation process began on June 1, 2025 [1][2]. To encourage users to migrate to newer images like windows-2022 or windows-2025, GitHub implemented a series of "brownout" periods throughout June 2025, during which jobs using the windows-2019 label were configured to fail [4]. Since June 30, 2025, the image is no longer supported [2][5].

Citations:

• 1: The Windows 2019 Actions runner image will begin deprecation on 2025-06-01 and will be fully unsupported by 2025-06-30 actions/runner-images#12045
• 2: The Windows 2019 Actions runner image will begin deprecation on 2025-06-01 and will be fully unsupported by 2025-06-30 actions/runner-images#12045
• 3: https://github.blog/changelog/2025-04-15-upcoming-breaking-changes-and-releases-for-github-actions/
• 4: Consider dropping Windows Server 2019 / 1809 support docker-library/official-images#18910
• 5: Deprecation note for windows-2019 missing in README actions/runner-images#12399