ci: enforce scoped production dependency audits - #339
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="scripts/audit-production.sh">
<violation number="1" location="scripts/audit-production.sh:1">
P3: The new shell script carries a `#!/usr/bin/env bash` shebang but is committed non-executable (mode 100644); every other script under scripts/ is 100755. It works today because package.json.js invokes it as `bash scripts/audit-production.sh`, but direct execution (`./scripts/audit-production.sh`) fails with permission denied. Mark it executable to match the repo convention: `chmod +x scripts/audit-production.sh` and commit the mode change.</violation>
</file>
<file name="scripts/audit-production-policy.ts">
<violation number="1" location="scripts/audit-production-policy.ts:46">
P2: The hand-rolled `bun pm why` parser assumes a fixed 3-column-per-level indentation and rejects any non-integer depth or unrecognized line by throwing `AuditInputError`, which aborts the entire multi-package audit. Multi-branch trees that render `│` continuation characters break the `(indentation + 1) / 3` invariant, and any bun formatting change fails the whole gate even though the affected package is otherwise fine. Make the parser tolerant (skip or warn on an unrecognized line; fall back to a conservative unresolved path) instead of throwing, so a single transitive package's rendering cannot take down the audit for every published package.</violation>
<violation number="2" location="scripts/audit-production-policy.ts:118">
P2: When a valid waiver uses a lowercase GHSA/CVE ID, `parsePolicy` accepts it but this comparison rejects the waiver because the audit URL preserves different casing. Normalize both IDs before comparing, or require canonical uppercase IDs during policy parsing.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| if (finding === undefined) continue; | ||
| const exception = policy.acceptedAdvisories.find( | ||
| (candidate) => | ||
| candidate.id === finding.id && |
There was a problem hiding this comment.
P2: When a valid waiver uses a lowercase GHSA/CVE ID, parsePolicy accepts it but this comparison rejects the waiver because the audit URL preserves different casing. Normalize both IDs before comparing, or require canonical uppercase IDs during policy parsing.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At scripts/audit-production-policy.ts, line 118:
<comment>When a valid waiver uses a lowercase GHSA/CVE ID, `parsePolicy` accepts it but this comparison rejects the waiver because the audit URL preserves different casing. Normalize both IDs before comparing, or require canonical uppercase IDs during policy parsing.</comment>
<file context>
@@ -0,0 +1,130 @@
+ if (finding === undefined) continue;
+ const exception = policy.acceptedAdvisories.find(
+ (candidate) =>
+ candidate.id === finding.id &&
+ candidate.package === finding.package &&
+ candidate.severity === finding.severity &&
</file context>
| const node = match[2]; | ||
| if (node === undefined) | ||
| throw new AuditInputError(`missing package in bun pm why line: ${line}`); | ||
| const depth = indentation === 0 ? 0 : (indentation + 1) / 3; |
There was a problem hiding this comment.
P2: The hand-rolled bun pm why parser assumes a fixed 3-column-per-level indentation and rejects any non-integer depth or unrecognized line by throwing AuditInputError, which aborts the entire multi-package audit. Multi-branch trees that render │ continuation characters break the (indentation + 1) / 3 invariant, and any bun formatting change fails the whole gate even though the affected package is otherwise fine. Make the parser tolerant (skip or warn on an unrecognized line; fall back to a conservative unresolved path) instead of throwing, so a single transitive package's rendering cannot take down the audit for every published package.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At scripts/audit-production-policy.ts, line 46:
<comment>The hand-rolled `bun pm why` parser assumes a fixed 3-column-per-level indentation and rejects any non-integer depth or unrecognized line by throwing `AuditInputError`, which aborts the entire multi-package audit. Multi-branch trees that render `│` continuation characters break the `(indentation + 1) / 3` invariant, and any bun formatting change fails the whole gate even though the affected package is otherwise fine. Make the parser tolerant (skip or warn on an unrecognized line; fall back to a conservative unresolved path) instead of throwing, so a single transitive package's rendering cannot take down the audit for every published package.</comment>
<file context>
@@ -0,0 +1,130 @@
+ const node = match[2];
+ if (node === undefined)
+ throw new AuditInputError(`missing package in bun pm why line: ${line}`);
+ const depth = indentation === 0 ? 0 : (indentation + 1) / 3;
+ if (!Number.isInteger(depth))
+ throw new AuditInputError(`unrecognized bun pm why indentation: ${line}`);
</file context>
| @@ -0,0 +1,5 @@ | |||
| #!/usr/bin/env bash | |||
There was a problem hiding this comment.
P3: The new shell script carries a #!/usr/bin/env bash shebang but is committed non-executable (mode 100644); every other script under scripts/ is 100755. It works today because package.json.js invokes it as bash scripts/audit-production.sh, but direct execution (./scripts/audit-production.sh) fails with permission denied. Mark it executable to match the repo convention: chmod +x scripts/audit-production.sh and commit the mode change.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At scripts/audit-production.sh, line 1:
<comment>The new shell script carries a `#!/usr/bin/env bash` shebang but is committed non-executable (mode 100644); every other script under scripts/ is 100755. It works today because package.json.js invokes it as `bash scripts/audit-production.sh`, but direct execution (`./scripts/audit-production.sh`) fails with permission denied. Mark it executable to match the repo convention: `chmod +x scripts/audit-production.sh` and commit the mode change.</comment>
<file context>
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
</file context>
|
Retriggering the unchanged commit because the plugin job failed only in unrelated TUI runtime import probes; changed audit tests and live audit passed. |
|
The production audit itself is green. The plugin job failed twice in the unrelated |
1 participant
Summary
Addresses #254 (enforces fail-closed production auditing; the two upstream vulnerabilities remain time-boxed exceptions)
Current accepted upstream blockers
@huggingface/transformers@4.2.0 > onnxruntime-node@1.24.3 > adm-zip@0.5.18@huggingface/transformers@4.2.0 > sharp@0.34.5Both expire 2026-11-17 and link their open upstream issues/PRs. No consumer-ineffective override is added.
Verification
git diff --checkpassNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by cubic
Enforces scoped production dependency audits in CI and release, failing on any unaccepted HIGH/CRITICAL advisory. Previously we didn’t audit published packages in isolation; now each package is audited as an isolated consumer with only time‑boxed, path‑scoped exceptions allowed. Satisfies Linear #254.
audit-productionjob to PR and release workflows; all npm publish jobs depend on it. Bun is pinned to 1.3.10 for audit jobs only to keep scanner semantics stable..github/production-audit-policy.jsonand must match advisory ID, package, affected artifact, and exact resolved path; ownership, rationale, reachability, HTTPS upstream links, and expiry are required and validated by tests.@huggingface/transformers@4.2.0 > onnxruntime-node@1.24.3 > adm-zip@0.5.18and@huggingface/transformers@4.2.0 > sharp@0.34.5.@opentui/coreto prevent Bun TDZ exposure.Written for commit 6223f7d. Summary will update on new commits.
Greptile Summary
The PR adds isolated production-dependency auditing and makes that audit a prerequisite for CI and npm publication.
Confidence Score: 5/5
The PR appears safe to merge because no blocking failure remains in the available follow-up review scope.
No blocking failure remains.
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart LR CI[PR or release workflow] --> Tests[Policy tests] Tests --> Manifests[Create isolated consumer manifests] Manifests --> Install[Bun lockfile-only install] Install --> Audit[Bun production audit] Audit --> Paths[Resolve dependency paths] Paths --> Policy{Exact policy exception?} Policy -->|Yes| Accept[Accept documented advisory path] Policy -->|No| Fail[Fail CI or publication] Accept --> Publish[Allow downstream release gates]Reviews (4): Last reviewed commit: "ci: scope production audit Bun pin" | Re-trigger Greptile
Context used: