[ci] CodeQL: Incorrect suffix check

[ianlewis]

CodeQL is finding an "Incorrect suffix check" in the sourcemap-register.js included in our TypeScript actions which follow the [typescript-action](https://github.com/actions/typescript-action) template.

[ianlewis]

This issue seems like it is related: evanw/node-source-map-support#320

[ianlewis]

This is happening now in our build files and not just our map files. It seems to be caused by code from depd 1.1.2.

https://github.com/dougwilson/nodejs-depd/blob/v1.1.2/lib/compat/callsite-tostring.js#L74

I think this should be fixed by upgrading to depd 2.0.0 but we have dependencies that depend on depd ^1.1.2 which isn't compatible with 2.0.0. The dependency comes to us via sigstore-js and tuf-js depending on make-fetch-happen.

verify-token$ npm list depd

verify-token@1.0.0 /usr/local/google/home/ianlewis/src/slsa-github-generator/.github/actions/verify-token
└─┬ sigstore@1.0.0
  └─┬ make-fetch-happen@11.0.2
    └─┬ agentkeepalive@4.2.1
      └── depd@1.1.2

We could potentially fix this issue by submitting a PR to agentkeepalive to upgrade to depd 2.0.0 (and then to make-fetch-happen to upgrade agentkeepalive, and then to sigstore-js and tuf-js but maybe these could be handled by dependabot depending on if a major version bump is needed) or by removing the dependency on make-fetch-happen from sigstore-js and tuf-js.

/cc @bdehamer

[bdehamer]

We're using make-fetch-happen primarily because its the "fetch" library used by the npm CLI (so we're not introducing any new dependencies when npm integrates sigstore-js). I'd like to avoid ditching that if we can avoid it.

If we can get agentkeepalive updated to depd@2.0.0, I'm confident we can get the rest of the chain updated easily. Lemme see what I can do here.

[bdehamer]

Let's see what happens here: node-modules/agentkeepalive#109

[ianlewis]

Thanks! Here's hoping that upgrading to depd@2.0.0 doesn't run afoul of CodeQL in some other way 😂

[bdehamer]

My agentkeepalive PR with the updated depd dependency was merged. This should find its way into make-fetch-happen in the next day or so.

[bdehamer]

@ianlewis I realized that make-fetch-happen is already set-up to consume v4.3.0 of agentkeepalive (they're using ^4.2.1 in the package.json).

Doing an npm update agentkeepalive in your project should get you the newest agentkeepalive (and corresponding update to depd)

[ianlewis]

Thanks @bdehamer! I'll give that a try in #1771 and we'll see if the CodeQL issue goes away.