chore(ci): decouple the supply-chain audit from unrelated PRs#77
Merged
Conversation
The `pnpm audit --audit-level=high` gate kept failing in-flight feature PRs on newly-published advisories for dependencies those PRs never touched (esbuild, vite, undici — three times). The audit's coverage is correct; the per-PR *coupling* was the problem. Keep full-tree coverage (dev + build + transitive — npm supply-chain campaigns target those, not just prod), change only the enforcement: - ci.yml: on a pull_request the audit runs ONLY when the PR changes a dependency manifest or install input — package.json / pnpm-lock.yaml / pnpm-workspace.yaml / .npmrc / .pnpmfile.* / patches/** — detected via inline `git diff` (no new action dependency). Otherwise it emits a notice and the check stays green. Fails CLOSED: unknown event, missing base SHA, diff error, or grep error all run the full audit. push-to-main still audits unconditionally. - security-audit.yml: new daily (+ manual) full-tree audit as the standing-tree backstop; opens/updates a tracking issue on failure so it's actionable. - release.yml already audits the full tree before publishing (unchanged) — the ship-time guarantee. - CONTRIBUTING.md: documents the posture, the triage-by-type rule (a malicious / install-RCE / token-exfil advisory is an incident regardless of dev-vs-prod; benign dev-tool vulns get a time-boxed ignore + tracking issue), the register of current dev-only ignores, and the branch-protection this control depends on. Safety invariant: with --frozen-lockfile, leaving every dependency manifest / install input unchanged means an unchanged installed tree, so a skipped PR audit can introduce nothing unaudited; the standing tree stays covered by main, release, the daily audit, and Dependabot. No pull_request_target; base SHA is passed via env, not interpolated into the script. Implements the convention/decoupling from #75 (enable Dependabot security updates + branch protection separately, as repo settings). #64 stays open: the esbuild/vite ignores remain until vite is upgraded.
GitHub runs `shell: bash` with `-e` (errexit), which my `set -uo pipefail` did not override. On the skip path the bare `printf … | grep -Eq` returns 1 (no dependency manifest changed) and errexit aborted the step before `rc=$?` — so any dep-unrelated PR (the exact case this feature is meant to allow) failed CI with exit 1. Add `set +e`; exit codes are already handled explicitly (rc checks + `run_audit; exit $?`), so the audit's own failure still propagates. Verified under `bash -e -o pipefail`: skip path exits 0 with the notice; a manifest / .pnpmfile / patches change runs the full audit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Keep full-tree coverage (dev + build + transitive — npm supply-chain campaigns target those, not just prod), change only the enforcement:
git diff(no new action dependency). Otherwise it emits a notice and the check stays green. Fails CLOSED: unknown event, missing base SHA, diff error, or grep error all run the full audit. push-to-main still audits unconditionally.Safety invariant: with --frozen-lockfile, leaving every dependency manifest / install input unchanged means an unchanged installed tree, so a skipped PR audit can introduce nothing unaudited; the standing tree stays covered by main, release, the daily audit, and Dependabot. No pull_request_target; base SHA is passed via env, not interpolated into the script.
Implements the convention/decoupling from #75 (enable Dependabot security updates
Type of Change
Packages Affected
packages/proxypackages/dashboardpackages/python-sdkdocs/examples/Checklist
anytypes or@ts-ignorewithout justificationpnpm secrets:scan,pnpm docs:check:ci,pnpm audit --audit-level=high,pnpm build,pnpm lint,pnpm format:check,pnpm typecheck,pnpm test)feat:,fix:,docs:)How to Test
workflow_dispatchthe new Security Audit workflow → full-tree audit runs green.pnpm-lock.yamlruns the full audit (unchanged behavior).Part of chore(ci): enable Dependabot security updates so advisories stop breaking unrelated PRs' audit gate #75 (Dependabot security updates + branch protection are separate repo settings). chore(deps): upgrade vite so esbuild ≥0.28.1, then drop the GHSA-gv7w-rqvm-qjhr audit ignore #64 unaffected (esbuild/vite ignores stay until vite is upgraded).
checkout main && git pull && git branch -d chore/decouple-audit-gate.
Additional Context