Originally created by: Redo-San
Originally owned by: Redo-San
The scheduled Security Audit workflow (security-audit.yml, Mon 03:00 UTC) has been red since 2026-10-05 — and it fails before the exceptions-policy gate even runs:
npm audit --json exits 1 whenever it finds any vulnerability (this is documented npm behaviour, not an error).Run npm audit (full scope) step had run: npm audit --json > audit-report.json, so bash -e killed the step there, with an unhelpful Process completed with exit code 1.Enforce advisory exceptions policy — the actual gate added in [#533] — was never reached (its status shows as skipped - in the failed run).Verified from run 37454060543 (manual dispatch of the merged [#533]): X Run npm audit (full scope) / - Enforce advisory exceptions policy.
set +e → run npm audit --json > audit-report.json → set -eJSON.parse + has metadata and vulnerabilities). npm error payloads are JSON too but lack those keys, so genuine audit failures (network/registry/lockfile) still fail the step loudly.No unexcepted high/critical advisories. pass (guard-fatigue proofing). The policy gate remains the single failing gate with the actionable "fix or document" message.No || true, no continue-on-error — the collector cannot decide, only validate; the gate decides.
| Scenario | Result |
|---|---|
Findings report (run 37294123943 artifact) + exception row |
✅ No unexcepted high/critical advisories. (exit 0) |
npm error JSON {"error":{"code":"ENOTFOUND",...}} |
❌ exit 1 — did not produce a valid report (collect and enforce) |
| Empty file | ❌ exit 1 (JSON parse) |
Clean report (npm audit --omit=dev --json, exit 0) |
✅ exit 0 — vulnerabilities:{} present |
Gates: actionlint clean on the workflow, cspell 0 issues, biome lint-staged passed on commit, pre-push commitlint + actionlint OK.
Dispatch security-audit.yml on main and confirm green end-to-end; link the run on issue [#532].
Originally posted by: github-actions[bot]
PR Statistics
Changed files:
.github/workflows/security-audit.yml(+14/-1)Originally posted by: github-actions[bot]
Here is my review of the pull request:
Files changed:
.github/workflows/security-audit.ymlSummary: This PR fixes a CI issue where
npm auditexiting with code 1 (due to found vulnerabilities) prevented the subsequent policy gate step from running. The fix wraps the audit command to always capture the JSON report, then validates its structure before proceeding.Strengths:
.github/workflows/security-audit.yml:34— Correctly usesset +e/set -eto prevent the step from failing on non-zero exit fromnpm audit..github/workflows/security-audit.yml:39— Validates the report contains expectedmetadataandvulnerabilitiesfields, distinguishing a real audit result from an error payload..github/workflows/security-audit.yml:47— Adds defensive validation in the policy gate step as well, ensuring downstream code can safely access those fields.Concerns / Suggestions:
.github/workflows/security-audit.yml:33— The comment references "the 2026-10-05 failure mode". If this is a placeholder, consider replacing it with an actual issue reference or a more generic description..github/workflows/security-audit.yml:49— The error message says "audit error instead of findings" but the check is identical to the one above; the distinction is not strictly necessary. It may be clearer to use the same message as the previous step for consistency.Overall: The change is minimal, targeted, and correctly addresses the race between audit failure and policy enforcement. The duplicate validation is harmless and adds robustness.
Originally posted by: github-actions[bot]
Gemini review skipped: API quota exceeded (daily free-tier limit). The review will run automatically again once quota resets.
Originally posted by: github-actions[bot]
Depcheck
No dependency issues found.
Originally posted by: github-actions[bot]
🏗️ DOM Review\n\n✅ No issues found across all pages.\n
Ticket changed by: Redo-San