From b5f88f8944b944ca82a0e66f4db2b0e5435c6087 Mon Sep 17 00:00:00 2001 From: Diego Suntaxi Date: Tue, 15 Sep 2026 18:26:48 -0500 Subject: [PATCH 1/2] [INT-3874] Harden CI workflow and fix red audit gate - Regenerate package-lock.json via `npm audit fix`: js-yaml 4.1.1 -> 4.3.2 and brace-expansion 1.x/2.x/5.x to patched releases. Clears the two high-severity advisories that have failed the Security audit job on master since 2026-09-15. package.json is unchanged. - ci.yml: add concurrency (cancel superseded runs per branch/PR) and a 10-minute timeout on every job. No paths-ignore on purpose: with required status checks, a skipped workflow leaves docs-only PRs unmergeable (explained in a comment in the file). - ci.yml + npm-publish.yml: bump actions/checkout, actions/setup-node and actions/upload-artifact to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job. - Remove dead .travis.yml. - CHANGELOG: Unreleased entry. Already done on master by #127 and therefore not repeated here: lockfile JSON repair, createRequire replacing the JSON import attribute, Node 20/22/24 matrix, lint/audit/coverage jobs, mocha env for test/**. engines stays at >=20.0.0 because the `with {}` syntax that motivated >=20.10.0 is no longer used. Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0: npm ci, lint (0 errors), 44 tests passing, coverage thresholds met, audit clean at high. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 32 ++++++++++++++++------- .github/workflows/npm-publish.yml | 8 +++--- .travis.yml | 7 ------ CHANGELOG.md | 8 ++++++ package-lock.json | 42 +++++++++++++++++++------------ 5 files changed, 61 insertions(+), 36 deletions(-) delete mode 100644 .travis.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bf6abb2..39e7fd8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,10 +16,21 @@ on: push: branches: [master] +# Deliberately no paths-ignore: branch protection requires these checks, and +# a workflow that is skipped for docs-only changes never reports them, which +# leaves the PR unmergeable. Each job takes ~20s, so always running is cheap. + +# Cancel superseded runs on the same branch/PR so only the latest commit is +# tested. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: test: name: Test (Node ${{ matrix.node-version }}) runs-on: ubuntu-latest + timeout-minutes: 10 strategy: fail-fast: false matrix: @@ -28,8 +39,8 @@ jobs: # caught here instead of at release. node-version: [20, 22, 24] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node-version }} cache: npm @@ -39,16 +50,17 @@ jobs: coverage: name: Coverage runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm - run: npm ci # Runs the suite under c8 and enforces the thresholds in .c8rc.json. - run: npm run coverage - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: always() with: name: coverage-lcov @@ -58,9 +70,10 @@ jobs: audit: name: Security audit runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm @@ -72,9 +85,10 @@ jobs: lint: name: Lint runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 59e142b..2d49bad 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,8 +12,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v2 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 - run: npm ci @@ -23,8 +23,8 @@ jobs: needs: build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v2 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 registry-url: https://registry.npmjs.org/ diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 938b1cb..0000000 --- a/.travis.yml +++ /dev/null @@ -1,7 +0,0 @@ -language: node_js -node_js: - - "stable" -cache: - directories: - - node_modules -install: npm install diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a70b13..d42830f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Changed +- CI: cancel superseded runs on the same branch (`concurrency`) and cap every job at 10 minutes. +- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v2/v4 target the deprecated Node 20 runner). +- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. + +### Removed +- Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted). + ## [1.4.1] - 2026-07-13 ### Added - Regression tests covering all five error branches (RateLimitError, PermissionError, ServiceError x2, HttpError, and the ValidationError path in the Onfleet constructor), none of which had prior test coverage. diff --git a/package-lock.json b/package-lock.json index 83a20ea..ef31be5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -524,16 +524,16 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/brace-expansion/node_modules/balanced-match": { @@ -1871,9 +1871,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -2630,10 +2630,20 @@ } }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -2817,9 +2827,9 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -2884,9 +2894,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { From 46ace1183b1320cae1b11dbaab0cc2d9f966d8bf Mon Sep 17 00:00:00 2001 From: Diego Suntaxi Date: Fri, 18 Sep 2026 18:08:33 -0500 Subject: [PATCH 2/2] [INT-3874] Address review: publish timeouts, changelog accuracy - npm-publish.yml: timeout-minutes: 10 on build, publish and notify so a stalled release job fails fast instead of holding a runner for 6 hours. No concurrency group on purpose: cancelling an in-flight npm publish is worse than a slow one, and release-triggered runs do not overlap. - CHANGELOG: only v4 of the bumped actions targets the Node 20 runtime (v2 was node12/16), so the parenthetical now says v4. - CHANGELOG: lockfile advisory fix moved from Changed to Security, per Keep a Changelog and the repo PR template. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/npm-publish.yml | 3 +++ CHANGELOG.md | 8 +++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 2d49bad..c03e5dc 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -11,6 +11,7 @@ jobs: build: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -22,6 +23,7 @@ jobs: publish: needs: build runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -36,6 +38,7 @@ jobs: notify: needs: publish runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: slackapi/slack-github-action@v1.18.0 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index d42830f..7d32c99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,13 +6,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Changed -- CI: cancel superseded runs on the same branch (`concurrency`) and cap every job at 10 minutes. -- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v2/v4 target the deprecated Node 20 runner). -- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. +- CI and publish workflows: cancel superseded CI runs on the same branch (`concurrency`) and cap every job at 10 minutes. +- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v4 targets the deprecated Node 20 runner). ### Removed - Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted). +### Security +- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. + ## [1.4.1] - 2026-07-13 ### Added - Regression tests covering all five error branches (RateLimitError, PermissionError, ServiceError x2, HttpError, and the ValidationError path in the Onfleet constructor), none of which had prior test coverage.