[onkar717]

📌 Fixes

Closes #530

---

📝 Summary of Changes

#519 (closing the gate proposed in #515) added the devDependency npm audit step to .github/workflows/npm-audit.yml as warning-only: continue-on-error: true on the Audit development dependencies step, with a comment promising to drop it "for one release (ratchet, #515)". This repo cuts no tags or releases (continuous Netlify deploy), so that condition never fires on its own, leaving a required-style security gate that can never go red.

This PR removes continue-on-error: true and the now-stale ratchet comment, per the exact replacement given in #530.

---

Changes Made

• Removed continue-on-error: true from the Audit development dependencies step in .github/workflows/npm-audit.yml
• Retired the "Warning-only for one release (ratchet, [sec-check] Gate proposal: dev-tree npm advisories are never audited in CI (6th instance: re2js GHSA-gg6h-894w-4m9c via markdownlint-cli2) #515)" sentence from the preceding comment

---

Checklist

• I have reviewed the project's contribution guidelines.
• I have performed a self-review of my changes.
• I have written unit tests for the changes (n/a — one-line workflow edit)
• I have updated the documentation (n/a)
• I have tested the changes locally and ensured they work as expected (confirmed npx tsx scripts/npm-audit-gate.ts passes at --level=high on the full tree at main@6a4fa59, per evidence cited in [quality] Enforce the devDependency npm audit gate: drop continue-on-error from npm-audit.yml (ratchet from #515/#519) #530)
• All CI checks are passing (pending this PR's own run)

Security Considerations

If this PR modifies any security-sensitive files, confirm:

• CI/CD workflows — removes a continue-on-error escape hatch on a security gate; no new permissions, secrets, or external actions introduced. .github/npm-audit-exceptions.json is currently empty, so no PR turns red on landing; future dev-tree advisories are acknowledged there with an expiry.

---

— hive: backend=claude model=claude-sonnet-5-5 effort=medium

[netlify]

👷 Deploy request for hivecommons-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	9908649

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Decision needed: @clubanderson should confirm that the devDependency npm audit step in .github/workflows/npm-audit.yml may become a hard gate now (dropping continue-on-error), as #530 recommends.

The diff does what #530 asks and nothing else: it deletes continue-on-error: true from the Audit development dependencies step and the stale "Warning-only for one release" sentence in .github/workflows/npm-audit.yml. No permissions, actions, secrets or step commands change; permissions: contents: read and the SHA-pinned actions are untouched.

Verified the gate is safe to enforce at this head's base: on main I ran npm ci && npm audit --json (full tree, including dev) through npx tsx scripts/npm-audit-gate.ts … --level=high and it exits 0 (✅ npm audit gate passed at level "high"), and .github/npm-audit-exceptions.json is [], so no PR goes red the moment this lands. #530 already stated the same evidence.

Routing to a human because this is a CI workflow edit from an external fork, which .github/CODEOWNERS reserves for @clubanderson / @KPRoche. The question is only whether to flip the gate to enforcing; the code itself looks correct to me.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should decide whether the devDependency npm audit step in .github/workflows/npm-audit.yml becomes blocking now, as #530 proposes, given this repo never cuts the "one release" the ratchet comment waited for.

Decision needed: @clubanderson should decide whether the devDependency npm audit step in .github/workflows/npm-audit.yml becomes blocking now, as #530 proposes, given this repo never cuts the "one release" the ratchet comment waited for.

The change itself is exactly what the body says and nothing more: .github/workflows/npm-audit.yml:56 drops continue-on-error: true from the Audit development dependencies step and :52-53 retires the ratchet sentence. No permissions, triggers, actions or pins change (permissions: contents: read at :15-16 is untouched).

Facts for the decision, verified on main@6a4fa59:

• npm audit --json over the full tree (devDependencies included) piped into npx tsx scripts/npm-audit-gate.ts --level=high exits 0 — "npm audit gate passed at level high" — so enforcing does not turn main red today. .github/npm-audit-exceptions.json is currently [].
• This PR's own run of the Audit production dependencies job (which contains the now-enforced step) is green.
• Author is an external contributor on a fork; .github/workflows/ is a CODEOWNERS-protected path (.github/CODEOWNERS: @clubanderson @KPRoche), so a code-owner review is required regardless.

I am routing rather than confirming because this makes a CI gate blocking for every future PR — a policy call for the owners, not a code defect. I found no problem with the diff.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

9908649

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @onkar717, head 9908649ab107) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/npm-audit.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @9908649
• the review found: the reviewer marked this change high-risk
• reviewer question: @clubanderson should decide whether the devDependency npm audit step in .github/workflows/npm-audit.yml becomes blocking now, as [quality] Enforce the devDependency npm audit gate: drop continue-on-error from npm-audit.yml (ratchet from #515/#519) #530 proposes, given this repo never cuts the "one release" the ratchet comment waited for.
• a sentinel alert is open on this PR
• the automerge lane will not merge this unattended

Head: verdict requires_human @9908649, 4/4 checks green, DCO yes, sentinel alert, soak 16m0s of 30m0s.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed. An ordinary contributor cannot release their own PR.
• Resolve the sentinel alert and have a maintainer clear its label.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}