mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
rcourtman
c01d152a35
On 2026-09-03 registry.npmjs.org returned 503s and then timeouts from its bulk advisory endpoint for over an hour. `npm audit` exits non-zero both for a real advisory and for an endpoint it cannot reach, so the Frontend job failed four times running and, because it is a required check, no pull request could land at all - including Go-only ones that touch no JavaScript. Every one of those failures was the outage. In two of the runs the other audit call in the same job succeeded and reported zero vulnerabilities. The audits now run through scripts/npm-audit-retry.sh, which separates the two cases and does nothing else. A conclusive result is acted on immediately, and the gate stays exactly as strict as before: any vulnerability at any severity still fails, and no severity threshold is introduced. Only an unreachable endpoint is retried, with backoff. When retries are exhausted the outcome depends on whether the answer is actually unknown. A change that touches frontend-modern/package.json, frontend-modern/package-lock.json, or the runner itself fails, because the dependency graph moved and no result means no answer. A change that touches none of them warns and continues, because the graph is then identical to the base commit that already produced a passing answer. Advisories published later against unchanged dependencies are what Dependabot security updates are for, not a per-pull-request audit. Deliberately not done: relaxing the severity threshold. That was my first instinct, but the evidence does not support it. None of the four failures was an advisory, the lockfile reports zero vulnerabilities at every severity, and a threshold would have weakened the gate without fixing anything. The contract's rule that audit suppression is not a valid closure stands. The pinning test now requires the runner's invocation and the dependency detection wiring, and additionally asserts the runner carries no --audit-level flag, so the strictness cannot be quietly traded away later.