What the developer wrote
Authored by Salvatore Ingala
Respect lockfile in CI JS tests
What changed, and why it matters
This commit changes the JavaScript test step in the project's automated CI workflow to use 'yarn install --immutable' instead of 'yarn install'. This tells the package manager to strictly follow the existing lockfile and fail if it would need to change it. It is a supply-chain hygiene improvement for testing, not a fix for a runtime security vulnerability in the Bitcoin app itself.
No security response required; this is a beneficial CI hardening change. Continue ensuring lockfiles are kept up to date and consider applying the same --immutable flag to other JS install steps in the repository.
Security signals we found
CI dependency-install command hardened with --immutable lockfile enforcement
Evidence from the diff
The diff modifies .github/workflows/ci-workflow.yml, replacing ‘yarn install’ with ‘yarn install –immutable’ in the JS client test job. –immutable (formerly –frozen-lockfile) ensures CI installs exactly the dependency versions recorded in yarn.lock and errors if the lockfile is out of sync. This prevents CI from silently accepting updated or drifting dependencies, reducing supply-chain attack surface during automated testing. There is no change to application code, cryptographic logic, or device firmware.
Changed components
.github/workflows/ci-workflow.ymlInspect captured patch +1 / −1
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index 6dbdbb2..e0a3366 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -245,7 +245,7 @@ jobs:
- name: Run tests
run: |
cd bitcoin_client_js
- yarn install
+ yarn install --immutable
LOG_SPECULOS=1 LOG_APDUS=1 SPECULOS="/speculos/speculos.py" yarn test
deploy_js_client_check_tag:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.