Repository navigation
ci(audit): show the remediation result on the run page; judge changes by audited versions - #160
Merged
Merged
Conversation
…anges by audited versions A run of audit-remediate.yml that found nothing to fix was invisible on the run page: the result was plain log text, and the new Actions layout shows no step list, only 'This job succeeded'. Every outcome (nothing to fix, skipped because a fix PR is open, dry run, PR opened) now also goes to the job summary and a notice annotation. 'Did npm update change anything' compared the lockfile text. A different npm version rewrites unrelated fields (npm 10 drops the libc fields of optional dev entries), so churn alone counted as a fix. It now compares the versions of the audited packages (audit-remediate.mjs changed) and restores the lockfile when none changed. The steps' run blocks are executed offline in audit-remediate-workflow.node-test.mjs (git, npm and gh mocked, real script and real audit fixture); three deliberate breakages of the workflow were each caught by the intended test. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012ESxuEjCeVsRAAxAb29Yjr
Contributor
Coverage Report
File CoverageNo changed files found. |
Merged
5 of 12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #158/#159 after the first real run of
audit-remediate.yml(a manual dry run: it worked, but its result was hard to find).1. Every outcome is written to the job summary and a notice annotation
The dry run correctly said
Nothing to remediate on main or develop., but only as plain log text. The Actions page in the current layout showed just "This job succeeded" (no step list; the only gear option is "Download log archive"), so the answer was found by downloading the log zip. Now each outcome also goes to$GITHUB_STEP_SUMMARYand, where it matters, a::notice:::2. "Did the update change anything" compares audited versions, not lockfile text
Found while testing: npm 10.9.4 (my sandbox) rewrites unrelated parts of
package-lock.json(it drops thelibcfields of optional dev entries), so agit diff --quietcheck cannot tell churn from a fix.scripts/audit-remediate.mjs changednow compares the versions of the packages the audit flagged, and the step restores the lockfile and opens nothing when none changed. I checked what npm 11 (the runner's major version, 11.21.1) does on the currentmainlockfile: a no-op update leaves it byte-identical, so churn is not expected on the runner; this is the guard for when it happens.A correction about an earlier PR
While testing I found that my hand-made hotfix #152 (run with that same npm 10.9.4) also removed all six
"libc"lines frompackage-lock.json, unrelated to the advisories; I had only checked version fields in that diff, so my "only the vulnerable entries changed" statement was incomplete. They are dev-only optional native bindings, CI passed, andmainhas 4libcblocks again from later changes, so I expect no effect, but it is unflagged churn that shipped in 1.0.0-alpha.1.Verification
run:blocks executed underbash -ewith the real registry, realnpm auditand real git (onlyghfaked): the nothing-to-fix, PR-already-open, dry-run and real-PR outcomes each write the expected summary and notice; the update step on already-current packages (with npm 10'slibcchurn present) reports no change, restores the lockfile and opens nothing; the real vulnerable scenario still opens exactly one PR.tests/automation/audit-remediate-workflow.node-test.mjsruns those steps offline in CI (git, npm, gh mocked; real script and real audit fixture): 10 tests. I broke the workflow three ways (dropped notice, dry run that still pushes, swallowed audit failure) and each was caught by the intended test; the file is restored byte for byte.npm run checkpasses (598 tests), the changelog guard passes against thev1.0.0-alpha.1baseline.Not verified
main: this takes effect after the companion hotfix PR tomain.Type of change
Checklist
npm testpasses locally (598 passed, 29 skipped);node --test tests/automation/*.node-test.mjs101 passednpx tsc --noEmitpasses locallyMerge as a merge commit, never squash or rebase.
Generated by Claude Code