fix(ci): lockfile sync, npm audit patches, and Trivy workflow update#12
Merged
Conversation
Resolves EUSAGE in `npm ci` by regenerating the lockfile to match package.json plus the @core-elite workspace packages (field-ops, native-ble, powersync) and their React Native peer-dep tree. Also resolves 4 high-severity advisories surfaced once `npm audit` could run on a complete tree (npm audit fix, no semver-major bumps): - next 16.2.2 -> 16.2.4 (GHSA-q4gf-8mx6-v5v3, DoS) - rollup 4.58.0 -> 4.60.2 (GHSA-mw96-cpmx-2vgc, path traversal) - vite bumped within ^6.2.0 (GHSA-p9ff-h696-f583, dev-server file read) - picomatch transitive >=4.0.4 (GHSA-c2c7-rcm5-vvqj, ReDoS) Audit state after fix: 0 high / 0 critical / 9 moderate (under the CI high+ threshold). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
The previous pin (aquasecurity/trivy-action@0.24.0) was no longer resolvable from the GitHub Actions registry, causing the Trivy filesystem scan to fail at action-resolution time before any scanning could run. Pinned to commit SHA a9c7b0f0... (tag v0.36.0) for immutability — tag-only pins are vulnerable to tag-repointing in a supply-chain attack on the action's repo, which matters more for security-critical workflows than for build/test ones. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
DigitalBlueprint239
changed the title
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
GitHub Code Scanning is disabled on this repo, so the previous `format: sarif` + `upload-sarif` flow silently no-op'd — Trivy findings caused the gate to fail with no surface details, leaving operators unable to remediate without modifying the workflow. Switch to `format: table` so findings print directly into the CI log. The HIGH/CRITICAL gate is unchanged (exit-code: 1 still blocks merge). When Code Scanning gets enabled, swap back to SARIF + upload-sarif. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidated CI infrastructure fix that unblocks the merge gate on
main.1. Lockfile sync (resolves
EUSAGEinnpm ci)Regenerated
package-lock.jsonagainst the currentpackage.json, including the@core-elite/*workspace packages and their React Native peer-dep tree.2. npm audit patches (resolves 4 high-severity advisories)
Once the audit job could run against a complete dep tree, four high-severity advisories surfaced. Resolved via
npm audit fix(no semver-major bumps required):next16.2.2 → 16.2.4 — GHSA-q4gf-8mx6-v5v3 (DoS via Server Components)rollup4.58.0 → 4.60.2 — GHSA-mw96-cpmx-2vgc (arbitrary file write)vitebumped within^6.2.0— GHSA-p9ff-h696-f583 (dev-server file read)picomatchtransitive ≥4.0.4 — GHSA-c2c7-rcm5-vvqj (ReDoS)Audit state after fix:
0 high / 0 critical / 9 moderate— passes the CIhigh+threshold.3. Trivy workflow update (resolves action-resolution failure)
The Trivy filesystem scan was failing in 3 seconds at action-resolution time:
Bumped to
aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0— pinned by commit SHA for immutability against tag-repointing supply-chain attacks, with the version recorded inline as a comment.Test plan
npm audit (high+)reports successTrivy filesystem scanresolves the action and runs to completionnpm ciworks in a clean clone🤖 Generated with Claude Code