Repository navigation
feat: integrate Takumi Guard for npm supply chain protection - #8
Merged
Merged
Conversation
Add flatt-security/setup-takumi-guard-npm to all jobs that run npm install, routing packages through Takumi Guard's security proxy to detect and block malicious packages. - Add setup-takumi-guard-npm step before npm install in all jobs - Add id-token: write permission (required for OIDC auth) - Add git checkout -- .npmrc after npm install to prevent Takumi Guard's .npmrc changes from being committed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The .npmrc file may not exist in the repository, causing git checkout -- .npmrc to fail. Use || true to ignore the error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Takumi Guard's anonymous mode has IP-based rate limits which can trigger 429 errors when multiple matrix jobs run concurrently. Retry npm install with increasing delays (30s, 60s) on failure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
linhmtran168
previously approved these changes
Apr 2, 2026
linhmtran168
approved these changes
Apr 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ソフトウェアサプライチェーン攻撃の予防的対策として、npm installを実行する全GitHub ActionsジョブにTakumi Guard（GMO Flatt Security社提供のセキュアレジストリ）を導入しました。
https://88-oct.atlassian.net/wiki/spaces/OCT/pages/4693622946/Takumi+Guard
変更内容
tests.ymlの全ジョブ（test / benchmark / typescript）にsetup-takumi-guard-npmステップを追加asset-size.ymlの compare ジョブにsetup-takumi-guard-npmステップを追加id-token: writeパーミッションを追加npm install後にgit checkout -- .npmrcを実行し、Takumi Guardによる.npmrc変更がコミットされることを防止対象ジョブ一覧
tests.ymltests.ymltests.ymlasset-size.ymlTest plan
setup-takumi-guard-npmステップが正常に完了すること🤖 Generated with Claude Code