ci: add automated dependency vulnerability scanning #65

Merged

pook merged 1 commit from feature/dependency-audit-ci into main

2026-04-09 06:14:06 -04:00

pook commented

2026-04-08 16:33:16 -04:00

Owner

Summary

Adds .gitea/workflows/dependency-audit.yml CI workflow that runs npm audit on PRs, pushes to main, and weekly schedule
High/critical vulnerabilities fail the build (blocking)
Low/moderate vulnerabilities produce warnings only (non-blocking)
Generates a temporary package-lock.json since the project uses bun.lock
Includes inline comments explaining how to resolve audit findings (npm audit fix, overrides, exception documentation)

Test plan

Verify workflow triggers on PR to main
Confirm high/critical vulns cause CI failure
Confirm low/moderate vulns produce warnings without blocking
Validate weekly schedule cron fires correctly

🤖 Generated with Claude Code

Closes #64

## Summary - Adds `.gitea/workflows/dependency-audit.yml` CI workflow that runs `npm audit` on PRs, pushes to main, and weekly schedule - **High/critical** vulnerabilities fail the build (blocking) - **Low/moderate** vulnerabilities produce warnings only (non-blocking) - Generates a temporary `package-lock.json` since the project uses `bun.lock` - Includes inline comments explaining how to resolve audit findings (npm audit fix, overrides, exception documentation) ## Test plan - [ ] Verify workflow triggers on PR to main - [ ] Confirm high/critical vulns cause CI failure - [ ] Confirm low/moderate vulns produce warnings without blocking - [ ] Validate weekly schedule cron fires correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Closes #64

pook added 1 commit

2026-04-08 16:33:16 -04:00

ci: add automated dependency vulnerability scanning

agent-worker/pr-tests Running PR tests...

Dependency Vulnerability Audit / npm audit (pull_request) Has been cancelled

Details

3618b77138

Add npm audit step to CI that fails on high/critical vulnerabilities
and warns on low/moderate ones. Runs on PRs, pushes to main, and
weekly schedule. Includes inline guidance for resolving findings.

Since the project uses bun.lock, the workflow generates a temporary
package-lock.json for npm audit compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pook commented

2026-04-08 16:33:26 -04:00

Author

Owner