Repository navigation
Run npm audit on the repository's Node.js and allow --omit=dev - #13
Merged
Merged
Conversation
The audit job ran npm audit on the runner's Node.js. A repository with devEngines.runtime (the npm-harden policy) refuses an unpatched runner version, so the audit failed with EBADDEVENGINES before it checked anything. - The audit job now sets up Node.js from the new input node-version-file, or from the .nvmrc in working-directory when the input is empty. Without a version file it keeps the runner's Node.js. - New input npm-audit-omit-dev runs npm audit --omit=dev. Use it when a dev tool has an advisory without a fixed release, such as braces through stylelint. - The security fixture now fails unless both work: its .nvmrc and devEngines allow only Node.js 24.22.1, and its dev dependency braces 3.0.3 has a high advisory without a fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Dependency auditjob ofsecurity.ymlrunsnpm auditon the runner's Node.js (22.23.3 today). A repository that applies the npm-harden policy declaresdevEngines.runtimewith only patched Node.js versions. npm then refuses to run, and the job fails withEBADDEVENGINESbefore it audits anything. Seen in scify/annotation-management-system#65.A second, older problem:
braceshas a high advisory without a fixed release (GHSA-vfj7-8cjw-p6xm). It comes in throughstylelint, a dev tool, so every repository with stylelint fails the audit with no way to fix it. annotation-management-system has failed this job onmainsince 5 October.Changes
security.yml,auditjob: a new step finds the Node.js version file andactions/setup-node(same SHA aslaravel-ci.yml,package-manager-cache: false) installs that version beforenpm audit.node-version-file(default''): the.nvmrcinworking-directorywhen it exists, else the runner's Node.js, so repositories without.nvmrcbehave as before.npm-audit-omit-dev(defaultfalse): runsnpm audit --omit=dev, so only the production dependencies are audited.Both inputs are additive with defaults that keep the current behaviour, so this fits the
v0.1line (v0.1.8).Failing cases
The
securityfixture now has.nvmrc24.22.1, adevEnginesrule that allows only that version, and the dev dependencybraces3.0.3.security-fixturepasses only when the audit runs on the.nvmrcversion and withnpm-audit-omit-dev: true. Checked locally: without--omit=devthe audit exits 1; on Node.js 22.23.4 npm exits withEBADDEVENGINES.GitHub's dependency graph will report the fixture's
bracesentry. Dismiss that alert as "Vulnerable code is not actually used".Checked locally
actionlint1.7.12 on the workflows and templates,scripts/shellcheck-actions.pywith shellcheck 0.11.0,scripts/check-workflow-docs.py: all pass.