From 9908649ab1073ee7ab01c244d5f9e1dff7122eda Mon Sep 17 00:00:00 2001 From: onkar717 Date: Fri, 30 Oct 2026 16:18:39 +0530 Subject: [PATCH] ci: enforce devDependency npm audit gate, drop continue-on-error Ratchets the warning-only devDependency audit step added in #519 (closing the gate proposed in #515) to a hard gate: the "one release" condition in the ratchet comment never fires because this repo cuts no tags/releases (continuous Netlify deploy), so the soft gate could never go red. Verified safe at main@6a4fa59: npm-audit-gate.ts passes at --level=high on the full tree, the latest npm-audit workflow run is green, and .github/npm-audit-exceptions.json is empty. Hive-Run: hivecommons/docs#530 Hive-Plan: Enforce the devDependency npm audit gate Hive-Spec: npm-audit-gate#ratchet-515-519 Signed-off-by: onkar717 --- .github/workflows/npm-audit.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/npm-audit.yml b/.github/workflows/npm-audit.yml index e6df21c4..839605fe 100644 --- a/.github/workflows/npm-audit.yml +++ b/.github/workflows/npm-audit.yml @@ -49,11 +49,9 @@ jobs: # Dev-tree advisories (markdownlint-cli2, jsdom, …) have repeatedly gone # unnoticed because the steps above omit devDependencies. Gate them too; # unpatched upstreams are acknowledged, with an expiry, in - # .github/npm-audit-exceptions.json. Warning-only for one release - # (ratchet, #515): drop `continue-on-error` to enforce. + # .github/npm-audit-exceptions.json. - name: Run npm audit (including devDependencies) run: npm audit --json > npm-audit-dev.json || true - name: Audit development dependencies - continue-on-error: true run: npx tsx scripts/npm-audit-gate.ts npm-audit-dev.json --level=high