[INT-3874] Harden CI workflow and fix red audit gate

Merged
DI
2mo ago
+45-21

Describe the solution

The Security audit job on master failed on 2026-09-15 because the lockfile pinned js-yaml 4.1.1 and older brace-expansion releases with high-severity advisories. That part has since landed on master through #131 and #132 (this branch is merged up to them and no longer changes package.json or the lockfile). What remains here is the CI hardening: run concurrency, job timeouts, current action versions, and removal of the dead Travis config.

Most of the original CI work (PR-level workflow, Node 20/22/24 matrix, lint/audit/coverage jobs, createRequire import fix, lint baseline) already landed in #127 and is not repeated here.

Two deliberate choices:

  • No paths-ignore for README/CHANGELOG. Once branch protection requires these checks, a workflow that is skipped for docs-only changes never reports them, and the PR cannot be merged. Each job takes about 20 seconds, so always running is cheap. A comment in ci.yml records this.
  • engines stays at >=20.0.0. The >=20.10.0 bump was only needed for the with { type: 'json' } import syntax, which #127 replaced with createRequire.

Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0: npm ci, npm run lint (0 errors), npm test (44 passing), npm run coverage (thresholds met), npm audit --audit-level=high (0 vulnerabilities).

Changed

  • ci.yml: concurrency with cancel-in-progress so superseded runs on the same branch/PR are cancelled; timeout-minutes: 10 on every job in both ci.yml and npm-publish.yml.
  • ci.yml and npm-publish.yml: actions/checkout, actions/setup-node and actions/upload-artifact bumped to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job.

Removed

  • .travis.yml (dead since GitHub Actions was adopted).

Security

  • No dependency changes in this PR. The js-yaml 4.3.2 and brace-expansion patches that make the audit gate green came in via #131 and #132; the changelog entry here records them for the next release.

Follow-up for a repo admin after this merges (not doable from a PR)

Settings → Branches → master → enable Require status checks to pass before merging with Require branches to be up to date before merging, and select these checks:

  • Lint
  • Test (Node 20)
  • Test (Node 22)
  • Test (Node 24)
  • Security audit
  • Coverage

The names only appear in the picker after they have run at least once, which this PR's CI run takes care of.

🤖 Generated with Claude Code