源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

apps/server/src/supply-chain-lockfile.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+/**
+ * The xlsx dependency is fetched from cdn.sheetjs.com rather than the npm
+ * registry, and some pnpm versions drop its `integrity` field when rewriting
+ * the lockfile. Without that hash the tarball is trusted on faith. This canary
+ * pins the integrity line so any lockfile rewrite that loses it fails fast.
+ */
+describe("root pnpm lockfile supply chain", () => {
+  test("the xlsx CDN tarball keeps its integrity hash", async () => {
+    const lockfile = await readFile(join(import.meta.dir, "..", "..", "..", "pnpm-lock.yaml"), "utf8");
+
+    const resolutionLines = lockfile
+      .split("\n")
+      .filter((line) => {
+        if (!line.includes("resolution:")) return false;
+        const tarballMatch = line.match(/tarball:\s*([^,\s}]+)/);
+        if (!tarballMatch) return false;
+        try {
+          return new URL(tarballMatch[1]).hostname === "cdn.sheetjs.com";
+        } catch {
+          return false;
+        }
+      });
+
+    expect(resolutionLines.length).toBeGreaterThan(0);
+    for (const line of resolutionLines) {
+      expect(line).toContain("integrity: sha512-");
+    }
+  });
+});