From 2ec194b61e00207963e89c26b728603fb466c13c Mon Sep 17 00:00:00 2001 From: illodev Date: Fri, 7 Aug 2026 20:55:44 +0200 Subject: [PATCH] Close T-0148 with the CI run that proved the audit gate fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Its last criterion asked that a pull request prove the audit fails in CI, and #30 and #31 had only shown the job running and passing — the wiring and the green path. The red path had been run locally, which this repository does not accept as proof of a pull request. So #32 pinned `hono` to 4.12.33 and changed nothing else. The `audit` job failed on the pull request at the `--audit-level=moderate` step, naming GHSA-8j4g-w8fx-2239, its patched range and the full path through `shadcn` → `@modelcontextprotocol/sdk`, and exited 1. Closed unmerged, branch deleted, `main` untouched. The same install exits 0 at `--audit-level=high`, which demonstrates T-0222's floor change on one tree rather than in prose: an advisory the old floor could not see is exactly what sat in the security tab for days. Recorded with `method: ci` and the run URL, so the claim is the run rather than the assertion. Cards: T-0148 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01D3LTdq3mzMAQ98rwBegGjU --- ...ease-gate-fails-on-a-devdependency-the-pack.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.project/cards/T-0148-the-release-gate-fails-on-a-devdependency-the-pack.md b/.project/cards/T-0148-the-release-gate-fails-on-a-devdependency-the-pack.md index 83fa1df..981030d 100644 --- a/.project/cards/T-0148-the-release-gate-fails-on-a-devdependency-the-pack.md +++ b/.project/cards/T-0148-the-release-gate-fails-on-a-devdependency-the-pack.md @@ -1,7 +1,7 @@ --- id: T-0148 title: The release gate fails on a devDependency the package never ships -status: review +status: done type: bug priority: medium area: infra @@ -10,6 +10,12 @@ created: 2026-08-03 updated: 2026-08-07 scope: [package.json, .github/workflows, scripts/audit-consumer.ts] related: [ADR-0021, T-0221, T-0220] +verified: + at: "2026-08-07T18:55:12.547Z" + method: ci + commit: aa0ac9df751eeaef6c6c4d2bc1868993a50ee96c + run: "https://github.com/illodev/workfile/actions/runs/31208898683/job/92966664406" + digest: "sha256:8b14d9b6ac816c9a47e215b59e9ef8ec8f5357c8ad169455e77e19ec407c5923" --- The `Release` workflow for `v0.5.4` failed at `pnpm run check:release`. Build, @@ -53,13 +59,14 @@ because the gate only runs on a tag push. Two options, neither obviously right: - [x] `pnpm audit --audit-level=high` passes on a clean install - [x] The decision above is recorded, whichever way it goes -- [ ] If the audit moves into ordinary CI, a pull request proves it fails there +- [x] If the audit moves into ordinary CI, a pull request proves it fails there first ## Activity - 2026-08-07 17:29Z illodev@local#42eb42f5 · claimed - 2026-08-07 17:39Z illodev@local#42eb42f5 · released +- 2026-08-07 18:55Z illodev@local#42eb42f5 · review → done ## Notes @@ -67,3 +74,7 @@ because the gate only runs on a tag push. Two options, neither obviously right: Criterion 1 was already met before this card was worked: the four pnpm.overrides make pnpm audit --audit-level=high exit 0 on a clean install, with one moderate remaining (hono via shadcn, below the gate). And the finding that matters more than the timing question. This card's body reads the workspace/tarball distinction as reassuring — "nothing vulnerable was ever going to reach a user" — and for two of the four overrides it is the opposite. sharp and adm-zip both sit under @huggingface/transformers, which is a dependencies entry of the published @illodev/workfile-search-local. Overrides are a workspace-install mechanism and do not travel inside a published package, so those two entries made this gate green and fixed the advisories for nobody who installed it. Measured rather than reasoned: resolving what the publishable manifests declare, with no overrides, reports four packages at high — sharp <0.35.0 with the libvips CVEs, adm-zip <0.6.0, and onnxruntime-node and transformers through them — all with no fix available, and transformers 4.2.0 is the latest release and pins sharp ^0.34.5. So a third gate exists now that neither card asked for: scripts/audit-consumer.ts audits the tree a consumer resolves, blocking, with no allowlist. That no-allowlist posture is the maintainer's explicit call over a doctor-style baseline, and its consequence is deliberate — the gate is red today and stays red until the published tree changes. Tracked as T-0221 with the routes laid out, because choosing between them is a product decision. Criterion 3 is unchecked on purpose: the job is wired and the command fails locally with the exit code CI will see, but nothing has run in CI, and this repository does not treat a local run as proof of a pull request. It needs one push. +- 2026-08-07 18:55Z illodev@local#42eb42f5 — Criterion 3 proven in CI, not locally. PRs #30 and #31 showed the audit job running and passing, which proves the wiring and the green path but not the one the criterion asks about. So a throwaway draft PR (#32) pinned hono to 4.12.33 — the version GHSA-8j4g-w8fx-2239 covers, which T-0222 had overridden away — and changed nothing else. The audit job failed on the pull request at the pnpm audit --audit-level=moderate step, naming the advisory, its patched range and the full path packages__workfile>shadcn>@modelcontextprotocol/sdk>hono, and exited 1: https://github.com/illodev/workfile/actions/runs/31208898683/job/92966664406 — closed unmerged, branch deleted, main untouched at aa0ac9d. +The same install also demonstrated T-0222's threshold change on one tree rather than in prose: exit 1 at --audit-level=moderate, exit 0 at --audit-level=high. An advisory that the old floor could not see is exactly what sat in the security tab for days. +So the shape T-0148 was filed about is closed: an advisory in a transitive devDependency now turns a pull request red, where a re-run fixes it, instead of failing a tag push and burning a version the way v0.5.4 did. +- 2026-08-07 18:55Z illodev@local#42eb42f5 — ci verification: The audit job failed on PR #32 at the pnpm audit --audit-level=moderate step with GHSA-8j4g-w8fx-2239 and exit code 1, naming the advisory, its patched range and the path packages__workfile>shadcn>@modelcontextprotocol/sdk>hono. Same install exits 0 at --audit-level=high, which demonstrates T-0222's floor change on one tree. PR closed unmerged and branch deleted; main is aa0ac9d and audits clean at moderate. The passing path was already recorded on PRs #30 (audit pass, 27s) and #31 (audit pass, 20s).