Cornelius A. Ludmann e9f25f4224
Replace npx with pinned npm-tools and add security hardening (#21166)
* [dev] disable npm lifecycle scripts and npx

* Add npm-tools

* update npm-tools

* dev/image/Dockerfile

* update

Co-authored-by: Ona <no-reply@ona.com>

* Bump leeay version to 0.10.6

Co-authored-by: Ona <no-reply@ona.com>

* Fix npx removal to also delete the target script

The symlink at /root/.nvm/.../bin/npx points to npx-cli.js.
Remove both to ensure npx is fully disabled.

Co-authored-by: Ona <no-reply@ona.com>

* Remove gce-github-runner usage from all workflows

Replace self-hosted GCE runner pattern with GitHub-hosted ubuntu-latest runners across all workflows. This removes the three-phase pattern (create-runner, use-runner, delete-runner) and simplifies workflow execution.

Changes:
- Remove create-runner and delete-runner jobs from all workflows
- Replace runs-on: ${{ needs.create-runner.outputs.label }} with runs-on: ubuntu-latest
- Remove create-runner from job dependencies
- Preserve all other job dependencies and concurrency controls

Affected workflows:
- build.yml (8 jobs)
- workspace-integration-tests.yml (4 jobs)
- ide-integration-tests.yml (4 jobs)
- preview-env-check-regressions.yml (4 jobs)
- preview-env-gc.yml (2 jobs)
- jetbrains-auto-update-template.yml (1 job)
- jetbrains-integration-test.yml (1 job)
- code-nightly.yml (1 job)
- preview-env-delete.yml (1 job)

Co-authored-by: Ona <no-reply@ona.com>

* [dev] use ubuntu-latest-16-cores for builds

* Fix container permissions for GitHub-hosted runners

Add 'options: --user root' to all container configurations to resolve EACCES permission errors when GitHub Actions tries to write to internal directories.

GitHub-hosted runners require containers to run as root to allow the Actions runtime to write to /__w/_temp/_runner_file_commands/ and other internal paths.

Affected workflows:
- build.yml (3 container jobs)
- workspace-integration-tests.yml (2 container jobs)
- ide-integration-tests.yml (2 container jobs)
- preview-env-check-regressions.yml (1 container job)
- preview-env-gc.yml (1 container job)
- jetbrains-auto-update-template.yml (1 container job)
- jetbrains-integration-test.yml (1 container job)
- code-nightly.yml (1 container job)

Co-authored-by: Ona <no-reply@ona.com>

* Fix dev/image build by adding leeway dependency for npm-tools

Create leeway generic build for dev/npm-tools and use it as a dependency in dev/image:docker build. This resolves the build error where npm-tools files were not accessible during Docker build.

Changes:
- Add dev/npm-tools/BUILD.yaml with generic package containing package.json and package-lock.json
- Add dev/npm-tools:pkg as dependency in dev/image/BUILD.yaml
- Update Dockerfile to use COPY from leeway dependency path (dev-npm-tools--pkg/)

This follows the established pattern used in other builds like install/installer where dependencies are copied from leeway-generated paths.

Co-authored-by: Ona <no-reply@ona.com>

* Fix npm-tools installation permissions in dev/image

Add chown command to fix EACCES permission error when installing npm-tools. The COPY command creates files owned by root, but npm ci runs as gitpod user and needs write access to create node_modules.

Changes:
- Add 'sudo chown -R gitpod:gitpod /opt/npm-tools' before npm ci
- This ensures the gitpod user can write to /opt/npm-tools/node_modules/

Error fixed:
  npm error code EACCES
  npm error syscall mkdir
  npm error path /opt/npm-tools/node_modules
  npm error errno -13

Co-authored-by: Ona <no-reply@ona.com>

* [dev] Split builds into branch and main

Co-authored-by: Ona <no-reply@ona.com>

---------

Co-authored-by: Cornelius Ludmann <cornelius@ona.com>
Co-authored-by: Ona <no-reply@ona.com>
Co-authored-by: Gero Posmyk-Leinemann <gero@gitpod.io>
2025-12-05 16:25:19 +01:00
..
2025-05-28 13:32:00 -04:00
2022-12-08 13:05:19 -03:00
2022-12-08 13:05:19 -03:00
2022-12-08 13:05:19 -03:00
2020-08-25 09:25:15 +00:00
2022-12-08 13:05:19 -03:00
2022-12-08 13:05:19 -03:00

Gitpod-db

Contains all the database related functionality, implemented using typeorm.

Working on gitpod-protocol component

When you are making changes to gitpod-protocol component, make sure to run yarn build in gitpod-protocol folder to make sure your changes will be rebuild. Also consider running yarn watch so that any changes are rebuilt in realtime.

Adding a new table

  1. Create a migration - use the baseline as an exemplar
  2. Create a new entity that implements the requisite interface or extend an existing entity as required - see db-user.ts
  3. If it is a new table, create the matching injectable ORM implementation and interface (if required) - see user-db-impl.ts and user-db.ts. Otherwise extend the existing interface and implementation as required.
  4. Add the injectable implementation to the DB container module, binding the interface and implementation as appropriate, otherwise it will not be instantiated correctly e.g.
    bind(TypeORMUserDBImpl).toSelf().inSingletonScope();
    bind(UserDB).toService(TypeORMUserDBImpl);
  1. Add the new ORM as an injected component where required e.g. in user-controller.ts
    @inject(UserDB) protected readonly userDb: UserDB;