mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-27 05:57:27 +00:00
pulse-triage[bot]
dbf65f305c
The latest daily advisory watch passes main and fails only retained release branches, then recommends backports that no longer have a delivery route. Keep the complete strict main audit, read-only/cache-free execution and security proof, remove obsolete line discovery and give accurate main repair and containing-release guidance. Add fixed-main recipe, retired-branch refusal and preserved strict-audit controls. Change-source: pulse-maintainer
83 lines
3.3 KiB
YAML
83 lines
3.3 KiB
YAML
name: Dependency Advisory Watch
|
|
|
|
# A new npm advisory against an unchanged lockfile used to fail the required
|
|
# "Audit complete frontend dependency graph" step in build-and-test.yml on
|
|
# every pull request to that branch. On 30 Sep-1 Oct 2026 two advisories did
|
|
# exactly that to main, release/v6.4 and release/v6.5 at once, and nothing
|
|
# owned the fix. Since 3 Oct 2026 that step only warns for a pull request that
|
|
# leaves the lockfile alone, so this watch is where such an advisory fails: it
|
|
# runs the same audit daily against main with
|
|
# NPM_AUDIT_REQUIRE_RESULT=true, fails on any finding, and names the branch,
|
|
# the advisories and the fix in the step summary. Releases have come only
|
|
# from main since 4 October 2026; retained release branches are not delivery
|
|
# inputs and must not generate backport instructions. The audit reads only
|
|
# main's frontend-modern/package.json and package-lock.json as data, never
|
|
# installing or executing fetched code.
|
|
on:
|
|
schedule:
|
|
- cron: '17 5 * * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: dependency-advisory-watch
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
audit:
|
|
name: Audit frontend dependencies (main)
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout watch helpers
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Read main's lockfile inputs
|
|
env:
|
|
AUDITED: ${{ runner.temp }}/audited
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p "${AUDITED}"
|
|
git fetch --no-tags --depth=1 origin '+refs/heads/main:refs/remotes/audited/head'
|
|
printf 'AUDITED_MAIN_SHA=%s\n' "$(git rev-parse refs/remotes/audited/head)"
|
|
for file in package.json package-lock.json; do
|
|
git show "refs/remotes/audited/head:frontend-modern/${file}" > "${AUDITED}/${file}"
|
|
done
|
|
|
|
# Same Node.js and audit runner as the required build-and-test Frontend
|
|
# job. npm audit reads the lockfile, so no install is needed and no
|
|
# package from main is fetched or run. The runner always comes from
|
|
# this workflow's own commit, never the fetched main source.
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '24'
|
|
# setup-node enables npm caching by itself once package.json names
|
|
# npm as its packageManager; keep this scheduled job cache-free.
|
|
package-manager-cache: false
|
|
|
|
- name: Audit complete frontend dependency graph
|
|
id: audit
|
|
working-directory: ${{ runner.temp }}/audited
|
|
env:
|
|
NPM_AUDIT_REQUIRE_RESULT: 'true'
|
|
run: |
|
|
set -o pipefail
|
|
bash "$GITHUB_WORKSPACE/scripts/npm-audit-retry.sh" all 2>&1 | tee "$RUNNER_TEMP/npm-audit.log"
|
|
|
|
- name: Report advisories and fix
|
|
if: ${{ !cancelled() }}
|
|
env:
|
|
BRANCH: main
|
|
AUDIT_OUTCOME: ${{ steps.audit.outcome }}
|
|
run: |
|
|
python3 scripts/dependency_advisory_watch.py summary \
|
|
--branch "${BRANCH}" \
|
|
--outcome "${AUDIT_OUTCOME}" \
|
|
--log "$RUNNER_TEMP/npm-audit.log" \
|
|
--summary-file "$GITHUB_STEP_SUMMARY"
|