Skip to content

ci: npm advisories in the repository tooling fail CI, braces declared until it is patched #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rgdevment merged 1 commit into from
Oct 4, 2026
Merged

ci: npm advisories in the repository tooling fail CI, braces declared until it is patched #44

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,24 @@ jobs:
- name: npm advisories in the picker
working-directory: app
run: npm audit --package-lock-only --audit-level=moderate
- name: npm advisories in the repository tooling
env:
# braces has no patched release; it reaches markdownlint-cli2 through globby, dev tooling only.
KNOWN: GHSA-vfj7-8cjw-p6xm
run: |
npm audit --package-lock-only --json > "$RUNNER_TEMP/audit.json" || true
jq -e '.vulnerabilities' "$RUNNER_TEMP/audit.json" > /dev/null
found=$(jq -r '[.vulnerabilities[].via[] | objects
| select(.severity != "low" and .severity != "info") | .url] | unique[]' "$RUNNER_TEMP/audit.json")
left=$(grep -v "/$KNOWN\$" <<< "$found" || true)
if [ -n "$left" ]; then
echo "::error::npm advisories at moderate or above:"
echo "$left"
exit 1
fi
if ! grep -q "/$KNOWN\$" <<< "$found"; then
echo "::warning::$KNOWN no longer shows up; drop it from this step"
fi

coverage:
name: coverage
Expand Down
Loading