From 18f519e3496b38ad9fe47f697e97cf3e6fa9b272 Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 13:29:05 +0100 Subject: [PATCH] Align release audit guard with positive-evidence precedence The executable audit fixtures pass, but the release-asset check still pins the superseded total-only parser. Preserve the no-threshold and required-workflow checks while asserting positive package/count precedence and a complete typed clean verdict. Change-source: pulse-maintainer --- scripts/installtests/build_release_assets_test.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 1f8fca5a6a..86b842960f 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -4118,7 +4118,8 @@ func TestFrontendDependencySecurityAuditsAreRequired(t *testing.T) { ) // The gate itself must stay strict. An unreachable endpoint may be // retried, but no severity threshold may be introduced that lets a real - // advisory through, and any vulnerability total must still fail. + // advisory through. Any positive package, severity or total evidence + // must fail, even when the summary is missing or contradictory. runnerPath := repoFile("scripts", "npm-audit-retry.sh") runner, err := os.ReadFile(runnerPath) if err != nil { @@ -4130,8 +4131,13 @@ func TestFrontendDependencySecurityAuditsAreRequired(t *testing.T) { assertFileContainsAll(t, runnerPath, `NPM_AUDIT_REQUIRE_RESULT:-true`, `AUDIT_ARGS=("$@")`, - `if isinstance(vulns, dict) and "total" in vulns:`, - `print("vulnerable" if total else "clean")`, + `if type(value) is int and value >= 0:`, + `has_findings = isinstance(findings, dict) and bool(findings)`, + `if has_findings or any(count > 0 for count in counts.values()):`, + `print("vulnerable")`, + `isinstance(report, dict) and not report.get("error")`, + `len(counts) == len(count_names) and all(count == 0 for count in counts.values())`, + `and ("vulnerabilities" not in report or isinstance(findings, dict))`, ) // Retrying must be bounded by wall clock, not by attempt count alone. // npm's own fetch-timeout defaults to five minutes and it retries