[INT-3874] Harden CI workflow and fix red audit gate - #130
Open
diego-suntaxi-onfleet wants to merge 3 commits into
Open
diego-suntaxi-onfleet wants to merge 3 commits into
diego-suntaxi-onfleet wants to merge 3 commits into
Conversation
- Regenerate package-lock.json via `npm audit fix`: js-yaml 4.1.1 -> 4.3.2 and brace-expansion 1.x/2.x/5.x to patched releases. Clears the two high-severity advisories that have failed the Security audit job on master since 2026-09-15. package.json is unchanged. - ci.yml: add concurrency (cancel superseded runs per branch/PR) and a 10-minute timeout on every job. No paths-ignore on purpose: with required status checks, a skipped workflow leaves docs-only PRs unmergeable (explained in a comment in the file). - ci.yml + npm-publish.yml: bump actions/checkout, actions/setup-node and actions/upload-artifact to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job. - Remove dead .travis.yml. - CHANGELOG: Unreleased entry. Already done on master by #127 and therefore not repeated here: lockfile JSON repair, createRequire replacing the JSON import attribute, Node 20/22/24 matrix, lint/audit/coverage jobs, mocha env for test/**. engines stays at >=20.0.0 because the `with {}` syntax that motivated >=20.10.0 is no longer used. Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0: npm ci, lint (0 errors), 44 tests passing, coverage thresholds met, audit clean at high. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- npm-publish.yml: timeout-minutes: 10 on build, publish and notify so a stalled release job fails fast instead of holding a runner for 6 hours. No concurrency group on purpose: cancelling an in-flight npm publish is worse than a slow one, and release-triggered runs do not overlap. - CHANGELOG: only v4 of the bumped actions targets the Node 20 runtime (v2 was node12/16), so the parenthetical now says v4. - CHANGELOG: lockfile advisory fix moved from Changed to Security, per Keep a Changelog and the repo PR template. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Shadow auto-approve: would auto-approve. Bumps GitHub Actions to v7, adds CI concurrency/timeouts, drops the dead Travis config, and regenerates package-lock.json to clear dev-only audit advisories without changing package.json; a bounded CI/security hardening change.
Re-trigger cubic
Resolve package-lock.json conflict by taking master's version: #131 and #132 already landed the same js-yaml 4.3.2 / brace-expansion patches plus new overrides, so this branch no longer changes dependencies. Verified: npm ci in sync, audit clean at high, lint OK, 44 tests passing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe the solution
The
Security auditjob onmasterfailed on 2026-09-15 because the lockfile pinnedjs-yaml4.1.1 and olderbrace-expansionreleases with high-severity advisories. That part has since landed onmasterthrough #131 and #132 (this branch is merged up to them and no longer changespackage.jsonor the lockfile). What remains here is the CI hardening: run concurrency, job timeouts, current action versions, and removal of the dead Travis config.Most of the original CI work (PR-level workflow, Node 20/22/24 matrix, lint/audit/coverage jobs,
createRequireimport fix, lint baseline) already landed in #127 and is not repeated here.Two deliberate choices:
paths-ignorefor README/CHANGELOG. Once branch protection requires these checks, a workflow that is skipped for docs-only changes never reports them, and the PR cannot be merged. Each job takes about 20 seconds, so always running is cheap. A comment inci.ymlrecords this.enginesstays at>=20.0.0. The>=20.10.0bump was only needed for thewith { type: 'json' }import syntax, which [INT-3686] Overhaul CI/CD and quality assurance #127 replaced withcreateRequire.Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0:
npm ci,npm run lint(0 errors),npm test(44 passing),npm run coverage(thresholds met),npm audit --audit-level=high(0 vulnerabilities).Changed
ci.yml:concurrencywithcancel-in-progressso superseded runs on the same branch/PR are cancelled;timeout-minutes: 10on every job in bothci.ymlandnpm-publish.yml.ci.ymlandnpm-publish.yml:actions/checkout,actions/setup-nodeandactions/upload-artifactbumped to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job.Removed
.travis.yml(dead since GitHub Actions was adopted).Security
js-yaml4.3.2 andbrace-expansionpatches that make the audit gate green came in via fix: remediate brace-expansion vulnerability #131 and fix: remediate js-yaml vulnerability #132; the changelog entry here records them for the next release.Follow-up for a repo admin after this merges (not doable from a PR)
Settings → Branches →
master→ enable Require status checks to pass before merging with Require branches to be up to date before merging, and select these checks:LintTest (Node 20)Test (Node 22)Test (Node 24)Security auditCoverageThe names only appear in the picker after they have run at least once, which this PR's CI run takes care of.
🤖 Generated with Claude Code