ci: move dependency audits off unrelated PRs, add daily sweep - #1063
Open
SnowboardTechie wants to merge 5 commits into
Open
ci: move dependency audits off unrelated PRs, add daily sweep#1063SnowboardTechie wants to merge 5 commits into
SnowboardTechie wants to merge 5 commits into
Conversation
Contributor
|
🚀 Website Preview Deployed! Preview your changes at: https://cg-pr-1063.billy-daly.workers.dev This preview will be automatically deleted when the PR is closed. |
New advisories against deps already on main were redding every open PR that touched a package's source, even when the PR changed no deps. - Per-package CI workflows no longer run the audit; it only ever ran on PRs there, and dep-changing PRs are already gated by the audit in ci-catalog-validation.yml (every dep change updates the root lockfile, which triggers it). - audit-deps.js gains --recursive: plain `pnpm list` at the workspace root only covers the root importer (~49 pkgs), so the no-filter audit in ci-catalog-validation.yml was silently auditing almost nothing. With --recursive it covers all workspace projects (~800 pkgs). - New deps-audit.yml runs the workspace-wide audit daily on main and opens/updates a tracking issue on failure, so advisories that drop with no dep PR in flight are still caught within a day. Templates and examples keep their own audits: they are standalone projects outside the workspace, tightly path-scoped already.
- postcss@<=8.5.22 -> >=8.5.23 (GHSA-fxqj-rqcc-2cmp, moderate) via website>@astrojs/react>vite>postcss; resolves to 8.5.25. - body-parser@<1.20.6 -> >=1.20.6 <2 (GHSA-v422-hmwv-36x6, low) via lib/cli>express; bounded below 2 so express 4 keeps the 1.x line. Verified: pnpm audit and audit-deps.js --recursive both clean; cli and website test suites green against the new resolutions.
SnowboardTechie
force-pushed
the
bryan/scoped-dep-audit
branch
from
August 4, 2026 16:09
ececad9 to
1ce18cc
Compare
github-actions
Bot
added
the
dependencies
SnowboardTechie
marked this pull request as ready for review
August 4, 2026 16:21
# Conflicts: # pnpm-lock.yaml
# Conflicts: # .github/scripts/audit-deps.js # .github/workflows/ci-catalog-validation.yml # .github/workflows/ci-lib-changelog-emitter.yml # .github/workflows/ci-lib-cli.yml # .github/workflows/ci-lib-core.yml # .github/workflows/ci-lib-ts-sdk.yml # .github/workflows/ci-website-preview.yml # pnpm-lock.yaml # pnpm-workspace.yaml
The validate job no longer runs an audit step, so the comment describing checks/tests/audit was stale.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
maincurrently reds every open PR that touches a package's source, even when the PR changes no dependencies. This moves audits to where dependencies actually change, plus a daily sweep onmain.Changes proposed
ci-lib-core,ci-lib-cli,ci-lib-ts-sdk,ci-lib-changelog-emitter,ci-website-preview). These ran on any PR touching the package's source, so an advisory that could only be fixed onmainblocked every in-flight PR for that package.deps-audit.yml: a daily workspace-widepnpm auditonmain(15:00 UTC, plusworkflow_dispatch), opening or updating a tracking issue on failure. Advisories that drop with no dependency PR in flight are caught within a day.Context for reviewers
Dependency-changing PRs stay gated. Any dependency change in any workspace package updates the root
pnpm-lock.yaml, which triggers the audit inci-catalog-validation.yml. That gate is genuinely workspace-wide, not root-importer-only:pnpm audit --jsonat the root reports 1270 audited dependencies across all seven workspace projects.Two behavior changes worth a second opinion:
low(the fourlibpackages run barepnpm audit) and athigh(the website'saudit:high). Catalog validation fails atmoderate, its existing setting. The daily sweep runs atlow, so low-severity advisories still surface within a day, as an issue rather than a PR blocker.if: github.base_ref == 'main'guard existed so advisories fixable only onmainwouldn't block PRs intoHOLD-*batching branches. Audits no longer run on per-package PRs at any base, which covers the same case more directly.Out of scope, unchanged: the two Node templates keep their own audits (standalone projects outside the workspace, already tightly path-scoped), and the Python example audits stay
continue-on-error: trueperDEPENDENCY_MANAGEMENT.md.Additional information
deps-audit.ymltriggers on changes to itself, so the run on this PR exercises the real sweep end to end:actionlintis clean on all six touched workflows.