react-doctor/build-pipeline-secret-boundary

Installing dependencies while CI secrets are in the environment lets a malicious package's lifecycle script read those secrets, which risks supply-chain compromise.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires in a CI/build config file (a .github/workflows/*.yml, Dockerfile, docker-compose.yml, vercel.json, next.config.*, or netlify.toml; package.json is excluded) when a dependency install (npm/pnpm/yarn/bun install/ci) appears within ~700 characters of a secrets.<NAME> reference (in either order) AND --ignore-scripts does NOT appear between them. The concern: untrusted dependency lifecycle scripts can execute while CI secrets are in the environment, enabling secret exfiltration or supply-chain compromise.

Suppress when: the install and the secret are in genuinely separate jobs/steps that do not share an environment, or the install is already hardened (--ignore-scripts, isolated runner) even though the literal flag is not inside the ~700-char window the regex inspects.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Install dependencies in a step that has no secrets in its environment, using npm ci --ignore-scripts (or the pnpm/yarn/bun equivalent). Inject secrets only into a later, minimal step that runs your own trusted code (signing, publish, deploy). Pin and lock dependencies, install on an isolated runner, and scope each secret to the narrowest job that needs it so a postinstall script cannot read it.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.