[pimfeltkamp]

What was vulnerable

.github/workflows/cli-release.yml runs with NPM_TOKEN, contents: write and id-token: write, but referenced every third-party action by a mutable major tag (oven-sh/setup-bun@v2, softprops/action-gh-release@v3, actions/checkout@v6, actions/setup-node@v6, actions/upload-artifact@v7) and installed Bun with bun-version: latest. If any of those tags were moved to malicious code, or a Bun "latest" release were compromised, the job could publish a tampered @cryptohopper/cli npm package or tampered release binaries to users who hold exchange-trading tokens.

What the fix does

• Pins each uses: to the full 40-character commit SHA that the tag currently resolves to, with the version in a trailing comment:
  • actions/checkout → d23441a4… (v6.1.0)
  • oven-sh/setup-bun → 0c5077e5… (v2.2.0)
  • actions/setup-node → 24997072… (v6.5.0)
  • actions/upload-artifact → cf430e03… (v7.0.2)
  • softprops/action-gh-release → 8a0cd651… (v3.0.4, annotated tag peeled to its commit)
• Pins bun-version to "1.4.4", the current Bun release.

All SHAs were resolved live from the upstream repositories' tag refs via the GitHub API during this run, and independently re-verified by a second reviewer (owners are the genuine actions, oven-sh and softprops upstreams, none are forks).

Why it is non-breaking

The pinned commits are exactly the commits the floating tags point to today, so the workflow runs the same action code it would run now. Bun 1.4.4 is the current latest, and its release has assets for all four bun build --compile targets used in package.json. No inputs or steps changed.

Trade-off: Dependabot or a manual bump is now needed to pick up future action/Bun versions.

Tests run

• git diff --stat: 1 file changed, 8 insertions(+), 6 deletions(-).
• YAML parsed as valid by the reviewer using js-yaml (comments correctly stripped from uses values). My own local parse attempt failed only because neither yaml, js-yaml nor PyYAML is installed in this worktree.
• The release workflow itself only runs on cli-v* tags, so it was not executed.

Reviewer notes (not changed here)

• ci.yml still uses actions/checkout@v6 and actions/setup-node@v6. It holds no secrets and has no write permissions, so it is outside this finding; pinning it is a separate optional hardening.
• setup-bun downloads the Bun binary by version without a checksum check in this workflow. That is a residual risk weaker than a SHA pin, but far better than latest.

🤖 Automated security fix by claude-code-security. It is reviewed by the automated PR reviewer and auto-merged only if the review passes, CI is green, and the change is small and non-breaking.

🤖 Generated with Claude Code

[pimfeltkamp]

✅ Automated review passed — no issues found. (Would approve, but the reviewer account authored this PR and GitHub forbids self-approval.)

✅ Safe to merge