ci: enforce scoped production dependency audits

Closed
CO
1mo ago
+713-4

Summary

  • audit each published package as an isolated registry consumer without monorepo overrides
  • fail on unaccepted HIGH/CRITICAL findings and scope temporary exceptions by advisory, package, artifact, severity, and exact resolved path
  • validate waiver ownership, rationale, reachability, upstream HTTPS links, and expiry
  • gate both PR CI and tag publishing on policy tests plus the live audit using pinned Bun scanner semantics

Addresses #254 (enforces fail-closed production auditing; the two upstream vulnerabilities remain time-boxed exceptions)

Current accepted upstream blockers

  • @huggingface/transformers@4.2.0 > onnxruntime-node@1.24.3 > adm-zip@0.5.18
  • @huggingface/transformers@4.2.0 > sharp@0.34.5

Both expire 2026-11-17 and link their open upstream issues/PRs. No consumer-ineffective override is added.

Verification

  • 14 policy/parser/path tests pass
  • live audit accepts exactly the two documented paths for plugin and Pi; CLI is clean
  • synthetic wrong artifact/path, new HIGH, optional/required-peer, malformed date, and malformed URL cases fail closed
  • Biome and git diff --check pass

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

Summary by cubic

Enforces scoped production dependency audits in CI and release, failing on any unaccepted HIGH/CRITICAL advisory. Previously we didn’t audit published packages in isolation; now each package is audited as an isolated consumer with only time‑boxed, path‑scoped exceptions allowed. Satisfies Linear #254.

  • Adds an audit-production job to PR and release workflows; all npm publish jobs depend on it. Bun is pinned to 1.3.10 for audit jobs only to keep scanner semantics stable.
  • Exceptions live in .github/production-audit-policy.json and must match advisory ID, package, affected artifact, and exact resolved path; ownership, rationale, reachability, HTTPS upstream links, and expiry are required and validated by tests.
  • Current accepted upstream blockers (expire 2026-11-17): @huggingface/transformers@4.2.0 > onnxruntime-node@1.24.3 > adm-zip@0.5.18 and @huggingface/transformers@4.2.0 > sharp@0.34.5.
  • Stabilizes TUI test imports by warming @opentui/core to prevent Bun TDZ exposure.
  • Required action: if a new production dependency surfaces a HIGH/CRITICAL advisory, upgrade to a fixed version or add a temporary, fully scoped exception to the policy; otherwise CI and releases will fail.

Greptile Summary

The PR adds isolated production-dependency auditing and makes that audit a prerequisite for CI and npm publication.

  • Builds temporary consumer manifests for the three published packages.
  • Rejects unaccepted HIGH and CRITICAL advisories using artifact- and dependency-path-scoped exceptions.
  • Validates exception metadata, expiry dates, and upstream URLs.
  • Adds policy tests and pins Bun 1.3.10 for consistent audit behavior.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the available follow-up review scope.

No blocking failure remains.

Important Files Changed
FilenameOverview
scripts/audit-production.tsOrchestrates isolated installs, live audits, dependency-path resolution, rejection reporting, and temporary-directory cleanup.
scripts/audit-production-policy.tsParses Bun dependency output and requires advisory exceptions to match ID, package, severity, artifact, and exact resolved path.
scripts/audit-production-input.tsValidates policy metadata and constructs isolated manifests containing all production dependency groups.
scripts/audit-production.test.tsExercises policy matching, malformed metadata rejection, production manifest construction, and representative dependency-path parsing.
.github/workflows/release.ymlAdds the production audit job as a prerequisite for all three npm publication jobs.
.github/workflows/ci.ymlRuns policy tests and the live production audit for pull requests and master updates.
.github/production-audit-policy.jsonDefines two artifact- and path-scoped temporary exceptions with ownership, reachability, expiry, and upstream tracking.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  CI[PR or release workflow] --> Tests[Policy tests]
  Tests --> Manifests[Create isolated consumer manifests]
  Manifests --> Install[Bun lockfile-only install]
  Install --> Audit[Bun production audit]
  Audit --> Paths[Resolve dependency paths]
  Paths --> Policy{Exact policy exception?}
  Policy -->|Yes| Accept[Accept documented advisory path]
  Policy -->|No| Fail[Fail CI or publication]
  Accept --> Publish[Allow downstream release gates]

Reviews (4): Last reviewed commit: "ci: scope production audit Bun pin" | Re-trigger Greptile

Context used: