From cd67bd5d30b81cb8eed65d7b1625542005fc5850 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Wed, 29 Jul 2026 00:02:43 +0200 Subject: [PATCH] ci(audit): scope decky to shipped deps; make docs-site non-blocking deterministically MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First real-runner dispatch (run 13627) surfaced two calibration issues: * pnpm audit flagged 6 high advisories — all in decky's devDependencies (the rollup build toolchain), which never ship: the plugin bundle carries prod deps only. --prod scopes the gate to what users get, matching the locally-validated state (clean). * docs-site relied on job-level continue-on-error, which act_runner does not reliably honor — replaced with a step-level '||' warning so the known advisories can never take the run red while staying visible in the log. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/audit.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/audit.yml b/.gitea/workflows/audit.yml index 8cfc0f79..b19398b7 100644 --- a/.gitea/workflows/audit.yml +++ b/.gitea/workflows/audit.yml @@ -85,13 +85,14 @@ jobs: run: bun audit # Kept OUT of the bun-audit matrix so this tree's known-advisory state can't normalize failure - # in a shipping tree. See the header for why this one is non-blocking. + # in a shipping tree. Non-blocking via a step-level `||` (NOT job-level continue-on-error, which + # act_runner does not reliably honor — a red job here would take the whole run red). The full + # advisory list still lands in the log; the warning marks it wasn't clean. docs-site-audit: runs-on: ubuntu-24.04 container: image: oven/bun:1 timeout-minutes: 15 - continue-on-error: true defaults: run: working-directory: docs-site @@ -101,7 +102,7 @@ jobs: run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git - uses: actions/checkout@v4 - name: bun audit (non-blocking) - run: bun audit + run: bun audit || echo "::warning::docs-site has known advisories (CMS/UI + nitropack chains) — tracked in punktfunk-planning design/cra-readiness.md" pnpm-audit: runs-on: ubuntu-24.04 @@ -115,10 +116,13 @@ jobs: - uses: actions/checkout@v4 # decky is pnpm-managed (pnpm-lock.yaml lockfileVersion 9.0 → pnpm 10 reads it). Like # bun audit, `pnpm audit` needs no install/build — lockfile + registry advisory DB only. + # --prod: rollup bundles only the prod deps into the shipped plugin; devDependencies are + # build tooling that never leaves CI (auditing them fails on toolchain advisories that + # can't reach a user — the docs-site problem in miniature). - name: pnpm audit run: | npm install -g pnpm@10 - pnpm audit + pnpm audit --prod # The regression guard about.toml documents: fail if any crate in either Rust workspace carries # a license outside the `accepted` allowlist (e.g. a copyleft dep silently entering the linked