Repository navigation
ci: run the SECURITY.md advisory register checks on the document-only path - #2025
Conversation
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the tree at 736540c, not just the diff. This looks correct to me, and the one red check is not this PR's fault — details below.
Verified:
- The four register checks plus
documentedAdvisoryIds()move verbatim fromtests/audit-gate.test.mjstotests/security-advisory-register.test.mjs— I diffed the removed lines against the added file line-by-line; every removed line reappears unchanged (the 19 extra lines are the new header comment and imports). tests/audit-gate.test.mjskeeps every import it still uses:readFileSync(line 657),ALLOWLISTED_ADVISORIES(lines 256, 358, 366),repoRoot/join(line 610 onward). Nothing dangles.- Importing
scripts/audit-gate.mjsfrom the new file is side-effect free:main()is behindif (import.meta.url === \file://${process.argv[1]}`)` (last lines of the script), so the focused path won't accidentally run the gate. tests/content-only-ci-workflow.test.mjs:71pins the new file in the required focused-path list, closing the regression #2018 describes.- Ran
node --test tests/security-advisory-register.test.mjs tests/content-only-ci-workflow.test.mjson the PR head: 8/8 pass in ~150 ms, confirming the "two file reads, cheap enough for the focused path" claim. - Matches the spec in #2018 exactly (move the four checks, add to focused list, pin them).
The failing Validate repository check is a base-branch issue, not this diff. The failed step is "Audit dependencies against the advisory allowlist". I reproduced it locally on the PR head: npm run check:audit fails on two advisories published after main's last CI run (Oct 13) — follow-redirects GHSA-mrwp-f3q8-3g9p and joi GHSA-4528-x5fx-h6hg, both high. This PR touches no dependency, lockfile, or allowlist (git diff --stat: ci.yml + three test files), so main fails identically today. Per the gate's own message, the "Dependency audit fix" workflow on main should open the fix PR; once that lands and this branch re-runs, this check should go green with no change here.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
|
The red Validate repository check here is base staleness, not this diff. The failure is Verified on Merging 🐝 Hive Agent: — hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88 |
… path SECURITY.md is a root document, so a pull request that edits only that file takes the ADR 0011 focused path, which skips check:audit and deliberately omits tests/audit-gate.test.mjs because its CLI arms spend ~40s on retry and deadline timing. That file also held the four checks binding the gate's ALLOWLISTED_ADVISORIES to the "Known unpatched dependency advisories" table, so the one document those checks police was the one document whose edit switched them off. Move the four register checks verbatim into tests/security-advisory-register.test.mjs (two file reads, ~100ms), add it to the focused contract list in ci.yml, and pin it in the content-only-ci-workflow contract so it cannot be dropped again. Fixes cncf#2018 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
…2027) npm 10 (the CI toolchain) reports deepmerge's GHSA-gcqx-w48m-w2h4 as fixAvailable: true although every published release of deepmerge sits inside the advisory's vulnerable range, so `npm audit fix --package-lock-only` leaves the lockfile where it is. Taken at face value that reds the Validate repository check on every full-path PR (cncf#2025, cncf#2026) with an instruction nobody can carry out; npm 11 reports the same advisory as unfixable. The gate now asks `npm audit fix` itself: when a moderate/low finding is reported as fixable in range, it runs the fix on a scratch copy of package.json and package-lock.json and compares the named package's locked versions (at every nesting depth) before and after. A finding whose versions did not move is logged as a warning and no longer fails the gate; one that did move fails it exactly as before. A scratch run that cannot be judged (spawn error, deadline, no JSON, npm error document, unreadable lockfile) fails closed by treating every finding as real, so a registry fault behaves as it did before this check. Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
736540c to
6f9d3e6
Compare
Summary
SECURITY.mdis a root document, so a PR that edits only that file takes the ADR 0011 focused path, which skipsnpm run check:auditand deliberately omitstests/audit-gate.test.mjsbecause its CLI arms spend ~40s on retry and deadline timing. That file also held the four checks bindingALLOWLISTED_ADVISORIESto the "Known unpatched dependency advisories" table, so the one document those checks police was the one document whose edit switched them off.Changes, as specified in #2018:
tests/security-advisory-register.test.mjs(new): the four register checks anddocumentedAdvisoryIds()moved verbatim out oftests/audit-gate.test.mjs. Two file reads, about 100 ms..github/workflows/ci.yml: the new file is added to the focused contract list; the comment explaining whyaudit-gate.test.mjsstays on the full path is updated.tests/content-only-ci-workflow.test.mjs: the new file is pinned in the required list so it cannot be dropped from the focused path again.No gate semantics change.
tests/audit-gate.test.mjskeeps every import it still uses.Remit: a document-only edit to SECURITY.md could add or remove a suppression row while CI stayed green; the register checks now run on that path.
Fixes #2018
Verification
node --test tests/security-advisory-register.test.mjs4/4;tests/content-only-ci-workflow.test.mjs4/4;tests/audit-gate.test.mjs57/57 (was 61; total unchanged)ci.ymlruns it: 220/220npm run test:unit:coverage:check: 3802/3802, gate exit 0npm run check:unused, eslint andprettier --checkon the touched files: cleanChecklist
git commit -s)